{"ip":"91.231.89.98","data_as_of":"2026-10-25T23:35:31+00:00","observed":true,"total_events":666,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"onyphe","confidence":"high","network_type":null,"why":["The address is in a published scanner range (onyphe).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 65 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"185,087 bytes sent","bytes_sent":185087,"session_seconds":16,"persistent":false},"basis":"combined"},"first_seen":"2026-08-11T22:16:17","last_seen":"2026-10-25T22:20:10","events_24h":3,"events_7d":63,"interactive_sessions":65,"interactive_sessions_24h":1,"interactive_sessions_7d":52,"interactive_protocols":[{"protocol":"http","sessions":33},{"protocol":"tls","sessions":23},{"protocol":"pjl","sessions":1}],"geo":{"country_code":"FR","country_name":"France","region":"Hauts-de-France","city":"Gravelines","lat":50.9853,"lon":2.1311,"asn":213412,"org":"ONYPHE SAS"},"source_domain":"padilla.probe.onyphe.net","known_scanners":["onyphe","ONYPHE"],"scanner_tag":{"key":"onyphe","label":"ONYPHE","category":"commercial","url":"https://www.onyphe.io/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":65,"first_seen":"2026-10-14T21:33:21","last_seen":"2026-10-25T02:23:16","verdicts":[{"verdict":"scan","sessions":34},{"verdict":"unknown","sessions":31}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":8},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":6},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":1},{"persona":"printer@HP LaserJet 400 M401dn","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"tcp","port":2347,"sessions":1},{"protocol":"tls","port":20089,"sessions":1},{"protocol":"http","port":3067,"sessions":1},{"protocol":"http","port":10800,"sessions":1},{"protocol":"http","port":5506,"sessions":1},{"protocol":"tcp","port":2086,"sessions":1},{"protocol":"http","port":1313,"sessions":1},{"protocol":"tls","port":21243,"sessions":1},{"protocol":"http","port":3790,"sessions":1},{"protocol":"http","port":5094,"sessions":1},{"protocol":"tls","port":4003,"sessions":1},{"protocol":"tls","port":3344,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"d9def6977112ab71d4a32d2b797c7c50d8cf497e07c24258e69129fecb208d10","name":"job-1","size":262,"mime_type":"text/plain","kind":"print-job","times":1,"first_seen":"2026-10-18T15:09:57","last_seen":"2026-10-18T15:09:57","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":34}]},"top_ports":[{"port":4137,"proto":"tcp","label":"","count":3,"sessions":1},{"port":3820,"proto":"tcp","label":"","count":3,"sessions":0},{"port":86,"proto":"tcp","label":"","count":3,"sessions":0},{"port":1047,"proto":"tcp","label":"","count":3,"sessions":0},{"port":13720,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4800,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5202,"proto":"tcp","label":"","count":2,"sessions":0},{"port":31210,"proto":"tcp","label":"","count":2,"sessions":0},{"port":1620,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3290,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2763,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8301,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3519,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9951,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7001,"proto":"tcp","label":"WebLogic","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311100_e8f1e7e78f70_ccd0985badbe","t13d691200_ea0618708e31_b11171733d3d"],"tls_client_hello":"1603010200010001fc0303459184f69d2422727877b04361ce27f06cfd5979f8c5f221ec2115a454fb81082023bdac2261087d119a3438acccab9184d3129fa5e73759ad07ecd3f3e62f7747003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000005000501000000000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00207f3a908ff1bd93b8de8f2334e4c125102722f8176120b470ac80b0990e72b412001500d300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["cd350275e54f0c0d6df9f3c93af0211d","4ab40ed46d2f0f15292e2ccc59b55f0d"],"http_akin":["b11cun050_0004001d_5cbb346f"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d691200_ea0618708e31_b11171733d3d","t13i311100_e8f1e7e78f70_ccd0985badbe"],"tls_ja3":["4ab40ed46d2f0f15292e2ccc59b55f0d","cd350275e54f0c0d6df9f3c93af0211d"]}},"fingerprint_peers":{"t13i311100_e8f1e7e78f70_ccd0985badbe":1024,"t13d691200_ea0618708e31_b11171733d3d":0,"b11cun050_0004001d_5cbb346f":978},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0"],"timeline":[{"date":"2026-08-11","count":1,"sessions":0},{"date":"2026-08-12","count":6,"sessions":0},{"date":"2026-08-13","count":12,"sessions":0},{"date":"2026-08-14","count":6,"sessions":0},{"date":"2026-08-15","count":10,"sessions":0},{"date":"2026-08-16","count":2,"sessions":0},{"date":"2026-08-17","count":9,"sessions":0},{"date":"2026-08-18","count":6,"sessions":0},{"date":"2026-08-19","count":10,"sessions":0},{"date":"2026-08-20","count":12,"sessions":0},{"date":"2026-08-21","count":15,"sessions":0},{"date":"2026-08-22","count":8,"sessions":0},{"date":"2026-08-23","count":1,"sessions":0},{"date":"2026-08-24","count":12,"sessions":0},{"date":"2026-08-25","count":8,"sessions":0},{"date":"2026-08-26","count":14,"sessions":0},{"date":"2026-08-27","count":14,"sessions":0},{"date":"2026-08-28","count":12,"sessions":0},{"date":"2026-08-29","count":4,"sessions":0},{"date":"2026-08-30","count":1,"sessions":0},{"date":"2026-08-31","count":3,"sessions":0},{"date":"2026-09-01","count":7,"sessions":0},{"date":"2026-09-02","count":13,"sessions":0},{"date":"2026-09-03","count":14,"sessions":0},{"date":"2026-09-04","count":13,"sessions":0},{"date":"2026-09-05","count":6,"sessions":0},{"date":"2026-09-06","count":3,"sessions":0},{"date":"2026-09-07","count":3,"sessions":0},{"date":"2026-09-08","count":11,"sessions":0},{"date":"2026-09-09","count":10,"sessions":0},{"date":"2026-09-10","count":10,"sessions":0},{"date":"2026-09-11","count":10,"sessions":0},{"date":"2026-09-12","count":4,"sessions":0},{"date":"2026-09-13","count":1,"sessions":0},{"date":"2026-09-14","count":7,"sessions":0},{"date":"2026-09-15","count":12,"sessions":0},{"date":"2026-09-16","count":8,"sessions":0},{"date":"2026-09-17","count":9,"sessions":0},{"date":"2026-09-18","count":11,"sessions":0},{"date":"2026-09-19","count":3,"sessions":0},{"date":"2026-09-20","count":2,"sessions":0},{"date":"2026-09-21","count":5,"sessions":0},{"date":"2026-09-22","count":11,"sessions":0},{"date":"2026-09-23","count":4,"sessions":0},{"date":"2026-09-24","count":9,"sessions":0},{"date":"2026-09-25","count":18,"sessions":0},{"date":"2026-09-26","count":12,"sessions":0},{"date":"2026-09-27","count":2,"sessions":0},{"date":"2026-09-28","count":5,"sessions":0},{"date":"2026-09-29","count":16,"sessions":0},{"date":"2026-09-30","count":9,"sessions":0},{"date":"2026-10-01","count":11,"sessions":0},{"date":"2026-10-02","count":22,"sessions":0},{"date":"2026-10-03","count":14,"sessions":0},{"date":"2026-10-04","count":2,"sessions":0},{"date":"2026-10-05","count":8,"sessions":0},{"date":"2026-10-06","count":21,"sessions":0},{"date":"2026-10-07","count":8,"sessions":0},{"date":"2026-10-08","count":10,"sessions":0},{"date":"2026-10-09","count":9,"sessions":0},{"date":"2026-10-10","count":10,"sessions":0},{"date":"2026-10-11","count":5,"sessions":0},{"date":"2026-10-12","count":11,"sessions":0},{"date":"2026-10-13","count":13,"sessions":0},{"date":"2026-10-14","count":8,"sessions":2},{"date":"2026-10-15","count":10,"sessions":4},{"date":"2026-10-16","count":12,"sessions":4},{"date":"2026-10-17","count":12,"sessions":1},{"date":"2026-10-18","count":3,"sessions":2},{"date":"2026-10-19","count":5,"sessions":13},{"date":"2026-10-20","count":12,"sessions":7},{"date":"2026-10-21","count":12,"sessions":3},{"date":"2026-10-22","count":12,"sessions":9},{"date":"2026-10-23","count":4,"sessions":16},{"date":"2026-10-24","count":15,"sessions":3},{"date":"2026-10-25","count":3,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T22:20:10","port":3411,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3411\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333431310d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"dc5d7f9f-35ab-4941-8bad-e0b27a7d4896","seq":1,"duration_ms":101,"bytes_in":271,"bytes_out":77},{"timestamp":"2026-10-25T12:58:10","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10443\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"1820cf42-c4c0-4a81-bf2f-10560c987d26","seq":1,"duration_ms":2498,"bytes_in":262,"bytes_out":77},{"timestamp":"2026-10-25T11:36:17","port":5427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5427\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353432370d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"b7405240-b4e3-41e4-8a0d-f3fe4a1c7a2d","seq":1,"duration_ms":2518,"bytes_in":261,"bytes_out":77},{"timestamp":"2026-10-25T02:23:16","port":1228,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1228\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313232380d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"9c438fa9-5119-455e-9094-dbb5d761a29d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T22:24:19","port":1287,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1287\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313238370d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"f13baf88-623b-4a81-90be-1ff41bf1f192","seq":1,"duration_ms":1166,"bytes_in":261,"bytes_out":77},{"timestamp":"2026-10-24T21:33:20","port":2520,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2520\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323532300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"5e2ed677-65ef-4436-97dd-5f4f53f4691a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T20:41:17","port":3721,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3721\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333732310d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"c1ccc845-3f69-4dee-b63b-79c335e6b20e","seq":1,"duration_ms":105,"bytes_in":272,"bytes_out":77},{"timestamp":"2026-10-24T17:05:20","port":5585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5585\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353538350d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"a84c5a5e-1e5a-4394-94f9-351dc426eee6","seq":1,"duration_ms":100,"bytes_in":271,"bytes_out":77},{"timestamp":"2026-10-24T13:55:48","port":4800,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4800\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343830300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"c6877244-272f-49d2-9831-412b5f98695a","seq":1,"duration_ms":2947,"bytes_in":262,"bytes_out":77},{"timestamp":"2026-10-24T13:42:21","port":50995,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:50995\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303939350d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"cd350275e54f0c0d6df9f3c93af0211d","session":"f0a2551a-b9ac-49d9-8938-580e200741ca","seq":1,"duration_ms":100,"bytes_in":273,"bytes_out":77}],"http_methods":[{"method":"GET","count":690}],"distinct_ports_total":639,"top_paths":[{"path":"/","count":362,"ports":310},{"path":"/favicon.ico","count":328,"ports":313}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3411","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}