{"ip":"81.17.28.131","total_events":142,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["142 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 11,077 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,077 bytes sent","bytes_sent":11077,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-01T10:24:42","last_seen":"2026-08-15T23:29:05","events_24h":12,"events_7d":66,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3932,"lon":8.5168,"asn":51852,"org":"Private Layer INC"},"source_domain":"hostedby.privatelayer.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as51852","label":"Phase Layer Global Networks","category":"isp","url":"https://www.peeringdb.com/asn/51852"},"cve_matches":[],"malware":[],"top_ports":[{"port":8899,"proto":"tcp","label":"","count":64},{"port":8089,"proto":"tcp","label":"Splunk","count":62},{"port":135,"proto":"tcp","label":"MSRPC","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"ge11nn0400_9c3956fad5da":1488},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"timeline":[{"date":"2026-08-01","count":8},{"date":"2026-08-02","count":12},{"date":"2026-08-03","count":10},{"date":"2026-08-04","count":10},{"date":"2026-08-05","count":10},{"date":"2026-08-06","count":8},{"date":"2026-08-07","count":6},{"date":"2026-08-08","count":12},{"date":"2026-08-09","count":7},{"date":"2026-08-10","count":10},{"date":"2026-08-11","count":7},{"date":"2026-08-12","count":11},{"date":"2026-08-13","count":9},{"date":"2026-08-14","count":10},{"date":"2026-08-15","count":12}],"recent_events":[{"timestamp":"2026-08-15T23:29:05","port":8899,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","ja3":"","session":"2378a317-de55-432d-8bad-2bc04bc89805","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":77},{"timestamp":"2026-08-15T23:29:04","port":8089,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000","payload_hex":"00000000","method":"","user_agent":"","ja3":"","session":"1f6d19e6-e1cc-4d10-a711-643c131db438","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-08-15T21:22:12","port":8899,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","ja3":"","session":"4460e5b5-3b96-4215-a8db-1ea545237f4b","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":77},{"timestamp":"2026-08-15T21:22:12","port":8089,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000","payload_hex":"00000000","method":"","user_agent":"","ja3":"","session":"732dcc61-3a0e-4bc1-ab93-d11ff8bb706d","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-08-15T14:48:40","port":8899,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","ja3":"","session":"b73362aa-3347-464d-b060-a70b84b6784e","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":77},{"timestamp":"2026-08-15T14:48:39","port":8089,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000","payload_hex":"00000000","method":"","user_agent":"","ja3":"","session":"f9835aab-6f87-4884-88b1-63082afcea8e","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-08-15T10:06:41","port":8899,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8899\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","ja3":"","session":"c99ad5e2-95f5-4b79-8d73-34f017c7c84b","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":77},{"timestamp":"2026-08-15T10:06:40","port":8089,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000","payload_hex":"00000000","method":"","user_agent":"","ja3":"","session":"2a925fd3-11ac-4e3f-bc61-95d819dda1c5","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-08-15T07:25:00","port":135,"proto":"tcp","app_proto":"","app_protocol":"dce_rpc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000�\u0003\u0001\u0000\b���\u001f]�\u0011��\b\u0000+\u0014��\u0003\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b���\u001f]�\u0011��\b\u0000+\u0014��\u0003\u0000\u0000\u0000,\u001c�l\u0012�@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000","payload_hex":"05000b17100000007400000001000000001000100000000002000000e30301000883afe11f5dc91191a408002b14a0fa03000000045d888aeb1cc9119fe808002b10486002000000000001000883afe11f5dc91191a408002b14a0fa030000002c1cb76c12984045030000000000000001000000","method":"","user_agent":"","ja3":"","session":"592b408b-6253-42bc-bc8c-c67f5c18b406","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":12,"enriched":{"digest":"d6ec3649d9d93c1b","label":"SOCKS5"}},{"timestamp":"2026-08-15T05:14:16","port":135,"proto":"tcp","app_proto":"","app_protocol":"dce_rpc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0017\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0010\u0000\u0010\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000Vc\u0001\u0000\b���\u001f]�\u0011��\b\u0000+\u0014��\u0003\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b���\u001f]�\u0011��\b\u0000+\u0014��\u0003\u0000\u0000\u0000,\u001c�l\u0012�@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000","payload_hex":"05000b17100000007400000001000000001000100000000002000000566301000883afe11f5dc91191a408002b14a0fa03000000045d888aeb1cc9119fe808002b10486002000000000001000883afe11f5dc91191a408002b14a0fa030000002c1cb76c12984045030000000000000001000000","method":"","user_agent":"","ja3":"","session":"a778588c-261d-4601-8aaf-b526f14dbd6c","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":12,"enriched":{"digest":"5020d37eace3e771","label":"SOCKS5"}}],"http_methods":[{"method":"GET","count":64}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":64,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8899","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-08-15T23:43:33.633688+00:00"}