{"ip":"91.92.240.251","total_events":45,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,032 bytes sent","bytes_sent":5032,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-26T14:00:33","last_seen":"2026-10-01T20:44:02","events_24h":14,"events_7d":45,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1517,"lon":8.7523,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":11443,"proto":"tcp","label":"","count":4},{"port":30443,"proto":"tcp","label":"","count":4},{"port":4430,"proto":"tcp","label":"","count":4},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":4},{"port":1080,"proto":"tcp","label":"SOCKS","count":4},{"port":18443,"proto":"tcp","label":"","count":4},{"port":6000,"proto":"tcp","label":"X11","count":4},{"port":33443,"proto":"tcp","label":"","count":4},{"port":50443,"proto":"tcp","label":"","count":4},{"port":8082,"proto":"tcp","label":"","count":4},{"port":7000,"proto":"tcp","label":"","count":2},{"port":7070,"proto":"tcp","label":"","count":2},{"port":10443,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i220900_231e334592e8_29829a46703f"],"tls_client_hello":"16030100f1010000ed0303e713e14a753b8ff22185925a7fb1b0d7048d43f3f1b7602e0255b7feb9b364392087ee05772d879e8260087edd779d393b202e6c0b36f929e8aad2ce11f023df45002c13021301c02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000078002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300260024001d0020cf05fcd9e2ebc4ea8cd81c089c74096b99820e63df81f6d85629ff0af3c1741b0031000000170000ff01000100002d000201","tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0"],"http_akin":["b11cun030_00040003_21fe282e","b11cun020_00040002_5ff1c0a9"]},"fingerprint_peers":{"t13i220900_231e334592e8_29829a46703f":9,"b11cun030_00040003_21fe282e":14,"b11cun020_00040002_5ff1c0a9":128},"akin_families":{"b11cun030_00040003_21fe282e":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":128},"b11cun020_00040002_5ff1c0a9":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":128}},"user_agents":[],"timeline":[{"date":"2026-09-26","count":7},{"date":"2026-09-27","count":6},{"date":"2026-09-28","count":6},{"date":"2026-09-29","count":4},{"date":"2026-09-30","count":8},{"date":"2026-10-01","count":14}],"recent_events":[{"timestamp":"2026-10-01T20:44:02","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:11443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"219dc9dc-6aaa-47fa-8478-60e0bb51739b","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":78},{"timestamp":"2026-10-01T20:44:02","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"219dc9dc-6aaa-47fa-8478-60e0bb51739b","seq":2,"duration_ms":555,"bytes_in":158,"bytes_out":156},{"timestamp":"2026-10-01T19:28:47","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"2c434131-df01-4490-b1ef-6ac4135d97ea","seq":2,"duration_ms":449,"bytes_in":160,"bytes_out":156},{"timestamp":"2026-10-01T19:28:46","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:11443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"2c434131-df01-4490-b1ef-6ac4135d97ea","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":78},{"timestamp":"2026-10-01T17:02:21","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:50443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"e87f40f4-2f3e-4eeb-a74b-0e223a8d30e5","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":78},{"timestamp":"2026-10-01T17:02:17","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:50443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"0a3babbb-e904-43cf-9ee7-6af8cbdd14b0","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":78},{"timestamp":"2026-10-01T16:27:21","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:50443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"6dd91732-b224-4e12-857c-76783ea80aa1","seq":2,"duration_ms":469,"bytes_in":160,"bytes_out":156},{"timestamp":"2026-10-01T16:27:20","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:50443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"6dd91732-b224-4e12-857c-76783ea80aa1","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":78},{"timestamp":"2026-10-01T09:45:41","port":30443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:30443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"7096aa29-fe4e-45ae-a0ed-f520fa22e7d7","seq":2,"duration_ms":302,"bytes_in":160,"bytes_out":156},{"timestamp":"2026-10-01T09:45:40","port":30443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:30443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"7096aa29-fe4e-45ae-a0ed-f520fa22e7d7","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":78}],"http_methods":[{"method":"GET","count":45}],"distinct_ports_total":13,"top_paths":[{"path":"/","count":45,"ports":13}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:11443","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-02T00:18:52.899249+00:00"}