{"ip":"85.137.56.197","total_events":39,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"33+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 33 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,146 bytes sent","bytes_sent":6146,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-13T15:30:20","last_seen":"2026-08-12T21:14:22","events_24h":0,"events_7d":9,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Haarlem","lat":52.3803,"lon":4.6422,"asn":43641,"org":"SOLLUTIUM EU Sp z.o.o."},"source_domain":"dedicated.vsys.host","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":55443,"proto":"tcp","label":"","count":2},{"port":3032,"proto":"tcp","label":"","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":1443,"proto":"tcp","label":"","count":2},{"port":8088,"proto":"tcp","label":"Hadoop","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":8009,"proto":"tcp","label":"","count":1},{"port":5443,"proto":"tcp","label":"","count":1},{"port":8003,"proto":"tcp","label":"","count":1},{"port":3390,"proto":"tcp","label":"","count":1},{"port":9043,"proto":"tcp","label":"","count":1},{"port":8087,"proto":"tcp","label":"","count":1},{"port":5433,"proto":"tcp","label":"","count":1},{"port":3031,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_ja3":["faa162b5a653756fba26803ea81b362f"],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":33,"ge11nn0400_9c3956fad5da":1491},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-06-13","count":2},{"date":"2026-06-23","count":1},{"date":"2026-06-24","count":1},{"date":"2026-07-01","count":1},{"date":"2026-07-03","count":2},{"date":"2026-07-04","count":2},{"date":"2026-07-07","count":1},{"date":"2026-07-08","count":7},{"date":"2026-07-09","count":2},{"date":"2026-07-13","count":1},{"date":"2026-07-14","count":1},{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":1},{"date":"2026-08-01","count":6},{"date":"2026-08-02","count":1},{"date":"2026-08-08","count":2},{"date":"2026-08-09","count":2},{"date":"2026-08-10","count":3},{"date":"2026-08-12","count":2}],"recent_events":[{"timestamp":"2026-08-12T21:14:22","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=ZZEQ46WFYEO7AWLGRMDMVPGQUI\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d5a5a45513436574659454f3741574c47524d444d5650475155490d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"9e2b43d9-7ece-4821-9f31-12b981b499d8","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":13,"enriched":{"digest":"ea025cd3fcda0abc","label":"RDP (X.224)","strings":["Cookie: mstshash=ZZEQ46WFYEO7AWLGRMDMVPGQUI"]}},{"timestamp":"2026-08-12T00:46:45","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"f4337971-a564-4bdd-9019-28100419b795","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-10T04:42:21","port":5433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"4915df4c-fe53-4e4b-9879-5cd36cc7375a","seq":1,"duration_ms":101,"bytes_in":8,"bytes_out":13},{"timestamp":"2026-08-10T02:54:07","port":9200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"3166423a-000a-481f-98b1-7dc652509ca9","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-10T01:57:31","port":9300,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9300\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393330300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"776018b7-ed38-4b6a-b1ab-37c79fc82c2d","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-09T23:39:59","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"81bf4ad7-0b38-4152-9322-bc3a88c6708d","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-08-09T22:43:45","port":5601,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5601\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353630310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"99041a53-0e65-448b-a512-69f498048ce9","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-08T13:46:27","port":7000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"22999ac0-e3e1-42f9-90f3-185520e1997a","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-08T05:39:44","port":27020,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"70f89483-faf8-4590-8cc4-d96e71db4c6b","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":13,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-08-02T10:05:13","port":3032,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3032\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333033320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"c9d8c7f1-0c94-458f-9191-e6955f99735b","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78}],"http_methods":[{"method":"GET","count":35}],"distinct_ports_total":33,"top_paths":[{"path":"/","count":35,"ports":29}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":24}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8088","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[],"data_as_of":"2026-08-14T17:52:04.851319+00:00"}