{"ip":"81.22.132.64","total_events":37,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"32+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 32 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,251 bytes sent","bytes_sent":6251,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-13T16:16:05","last_seen":"2026-09-24T08:31:47","events_24h":1,"events_7d":1,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Drenthe","city":"Meppel","lat":52.6958,"lon":6.1956,"asn":199058,"org":"Serva One Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":2628,"proto":"tcp","label":"","count":4},{"port":3032,"proto":"tcp","label":"","count":2},{"port":8006,"proto":"tcp","label":"","count":2},{"port":9000,"proto":"tcp","label":"Web-alt","count":1},{"port":8085,"proto":"tcp","label":"","count":1},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1},{"port":9443,"proto":"tcp","label":"","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":8009,"proto":"tcp","label":"","count":1},{"port":3333,"proto":"tcp","label":"","count":1},{"port":8899,"proto":"tcp","label":"","count":1},{"port":65535,"proto":"tcp","label":"","count":1},{"port":9043,"proto":"tcp","label":"","count":1},{"port":8090,"proto":"tcp","label":"","count":1},{"port":9093,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["8939412039ec4e7b3550855bbb755c01"],"http_akin":[]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":58,"e54ef3ec27fe1fea7ab64d3fa05359fd":483},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-07-13","count":2},{"date":"2026-07-14","count":2},{"date":"2026-07-20","count":1},{"date":"2026-08-01","count":1},{"date":"2026-08-02","count":2},{"date":"2026-08-08","count":3},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-13","count":2},{"date":"2026-08-16","count":2},{"date":"2026-08-21","count":4},{"date":"2026-09-01","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-04","count":4},{"date":"2026-09-07","count":5},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":1},{"date":"2026-09-15","count":2},{"date":"2026-09-24","count":1}],"recent_events":[{"timestamp":"2026-09-24T08:31:47","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=3QXDGU34NCKQH7636HGJ4ARG6E\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d33515844475533344e434b51483736333648474a3441524736450d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"6318d238-f620-4b75-8156-85c2670b4533","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":12,"enriched":{"digest":"6cd075b06c16f48e","label":"RDP (X.224)","strings":["Cookie: mstshash=3QXDGU34NCKQH7636HGJ4ARG6E"]}},{"timestamp":"2026-09-15T07:28:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"8a1800a7-c575-4900-8afc-9bbafdce1f6e","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-09-15T00:28:57","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"e0fd4580-e235-4f7e-a42c-2d23c18f5fef","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-10T11:54:57","port":60000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:60000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"1ea6c91f-3265-45b4-a3d8-4dbd5e54235e","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-09-08T00:31:33","port":3478,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"8f1e0b7a-30c7-4276-969a-02b0a683d5f1","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-07T20:24:26","port":10050,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"224177e0-2158-4f6e-951b-c17701363238","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-07T13:53:44","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"01a6dda2-4051-445d-b64a-b26897399244","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":7,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-07T13:53:44","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"01a6dda2-4051-445d-b64a-b26897399244","seq":2,"duration_ms":213,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-07T13:53:44","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$11\r\nNONEXISTENT\r\n","payload_hex":"2a310d0a2431310d0a4e4f4e4558495354454e540d0a","method":"","user_agent":"","ja3":"","session":"01a6dda2-4051-445d-b64a-b26897399244","seq":3,"duration_ms":326,"bytes_in":50,"bytes_out":17,"enriched":{"digest":"6a74b11849fd84cf","label":"Redis (RESP)","strings":["NONEXISTENT"]}},{"timestamp":"2026-09-07T13:53:44","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nQUIT\r\n","payload_hex":"2a310d0a24340d0a515549540d0a","method":"","user_agent":"","ja3":"","session":"01a6dda2-4051-445d-b64a-b26897399244","seq":4,"duration_ms":439,"bytes_in":64,"bytes_out":22,"enriched":{"digest":"c8eec36f8388dba0","label":"Redis (RESP)","strings":["QUIT"]}}],"http_methods":[{"method":"GET","count":28}],"distinct_ports_total":32,"top_paths":[{"path":"/","count":28,"ports":26}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":9}],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-24T14:28:49.244185+00:00"}