{"ip":"86.92.55.73","data_as_of":"2026-10-29T01:18:23+00:00","observed":true,"total_events":848,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"848 events across 1 port(s)","confidence":"medium","network_type":"network service provider","why":["848 requests against 1 service(s), so the activity is deep on few services.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload was observed, so this describes volume and focus only.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,244 bytes sent","bytes_sent":20244,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-21T17:45:58","last_seen":"2026-10-28T23:27:33","events_24h":19,"events_7d":373,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Gelderland","city":"Harderwijk","lat":52.3278,"lon":5.603,"asn":1136,"org":"KPN B.V."},"source_domain":"86-92-55-73.fixed.kpn.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as1136","label":"KPN NL","category":"isp","url":"https://www.peeringdb.com/asn/1136"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":25569,"proto":"tcp","label":"","count":848}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-21","count":11},{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":4},{"date":"2026-09-30","count":2},{"date":"2026-10-01","count":3},{"date":"2026-10-02","count":10},{"date":"2026-10-03","count":7},{"date":"2026-10-04","count":50},{"date":"2026-10-05","count":2},{"date":"2026-10-07","count":4},{"date":"2026-10-10","count":8},{"date":"2026-10-11","count":55},{"date":"2026-10-12","count":25},{"date":"2026-10-13","count":224},{"date":"2026-10-15","count":17},{"date":"2026-10-16","count":12},{"date":"2026-10-17","count":11},{"date":"2026-10-18","count":7},{"date":"2026-10-19","count":16},{"date":"2026-10-21","count":5},{"date":"2026-10-22","count":3},{"date":"2026-10-23","count":86},{"date":"2026-10-24","count":123},{"date":"2026-10-25","count":22},{"date":"2026-10-26","count":93},{"date":"2026-10-27","count":27},{"date":"2026-10-28","count":19}],"recent_events":[{"timestamp":"2026-10-28T23:27:33","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"793bc350-8e4b-4c6e-b970-c923797933a5","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T23:27:18","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"abec947e-26df-4944-8bcf-2f312abf7036","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:20:40","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"e71e7792-0c91-4bc5-af5d-1566cb7e9d03","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:20:22","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"d5896b4e-fddd-4d03-9ee3-5d0021cbd25c","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:20:07","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"df7f11f7-912a-4d2b-a918-573a88c7ade1","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:19:52","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"a5714a89-fe93-425e-970c-e0ea9c73bdb7","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:19:37","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"6ef0a0f0-d2e6-4f3d-a3c7-7e5b808c9106","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:19:21","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"ee975c2e-dd49-4834-9f53-ef368db86c82","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:19:06","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"4313d0f5-2794-4e8d-ba9a-6f631a2f2754","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T21:18:51","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0006\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"150089060e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"67646068-36c2-4df2-a6b0-6867df223ff3","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"daa8edc0427ac94d","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}