{"ip":"91.92.47.220","total_events":16,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["16 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,912 bytes sent","bytes_sent":1912,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T12:28:49","last_seen":"2026-08-15T16:04:26","events_24h":4,"events_7d":16,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9100,"proto":"tcp","label":"Printer","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_17292dadbc7b","ge11nn0300_042112399351"]},"fingerprint_peers":{"ge11nn0300_042112399351":3329,"ge11nn0400_17292dadbc7b":2854},"user_agents":["curl/8.5.0","Go-http-client/1.1"],"timeline":[{"date":"2026-08-09","count":3},{"date":"2026-08-11","count":5},{"date":"2026-08-12","count":4},{"date":"2026-08-15","count":4}],"recent_events":[{"timestamp":"2026-08-15T16:04:26","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"898b3741-da08-46ba-a0a2-b10204eee2c1","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-08-15T16:02:45","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"27f5cb5e-5bad-4c9a-87e0-ce7e92116729","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-08-15T15:59:12","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"25cefe4c-a5ee-4d55-8104-ed187e9ad3f2","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":77},{"timestamp":"2026-08-15T15:52:00","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"0cacbdb0-9c48-46a2-9484-ac1c10dde8d5","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":77},{"timestamp":"2026-08-12T10:17:15","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"19f7d1e5-b0ce-4616-8e70-c9db8ebedb49","seq":1,"duration_ms":101,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-08-12T10:17:10","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"cde23987-6fc0-4540-9a26-5ff9cde47890","seq":1,"duration_ms":101,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-08-12T10:16:31","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"b9018882-0506-479b-a4b9-fe1bec63c77f","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":77},{"timestamp":"2026-08-12T09:56:13","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a467d79f-f2fd-4e12-9c8d-54efdf848fa8","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":77},{"timestamp":"2026-08-11T12:59:06","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"0bbeefb8-9403-42f5-806a-30894f31557c","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-08-11T12:54:00","port":9100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f706c61696e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"9e4ffd73-364d-45f5-94ca-673d84049e10","seq":1,"duration_ms":105,"bytes_in":121,"bytes_out":77}],"http_methods":[{"method":"GET","count":16}],"distinct_ports_total":1,"top_paths":[{"path":"/metrics","count":16,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/plain","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9100","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T23:42:45.899806+00:00"}