{"ip":"94.154.43.105","total_events":56,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["56 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,912 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,912 bytes sent","bytes_sent":5912,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-22T09:27:57","last_seen":"2026-09-04T10:52:59","events_24h":2,"events_7d":30,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8006,"proto":"tcp","label":"","count":16},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8007,"proto":"tcp","label":"","count":8},{"port":8069,"proto":"tcp","label":"","count":6},{"port":3000,"proto":"tcp","label":"Web-alt","count":6},{"port":8071,"proto":"tcp","label":"","count":4},{"port":8070,"proto":"tcp","label":"","count":4},{"port":8072,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0400_17292dadbc7b"]},"fingerprint_peers":{"ge10nn0400_17292dadbc7b":9},"user_agents":["odin-scanner/0.4"],"timeline":[{"date":"2026-08-22","count":6},{"date":"2026-08-23","count":3},{"date":"2026-08-28","count":17},{"date":"2026-09-01","count":7},{"date":"2026-09-02","count":8},{"date":"2026-09-03","count":11},{"date":"2026-09-04","count":4}],"recent_events":[{"timestamp":"2026-09-04T10:52:59","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"c1682e48-07fd-4957-be5d-c734d899b6da","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-04T10:43:07","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"3dc4a437-e59d-4695-a99a-19f82be40cf3","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":78},{"timestamp":"2026-09-04T09:40:35","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"071e371c-4d1f-49f1-940a-49ef578d4441","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":78},{"timestamp":"2026-09-04T07:16:16","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"45984c48-2c4a-4778-9f52-1c6946eca066","seq":1,"duration_ms":101,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:53:54","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"87657319-0345-465e-84ff-92663ebc0656","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:52:16","port":8007,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8007\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030370d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"1045ac4e-b323-4a25-aa15-1771dcb1f781","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:50:40","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"5bdb4134-3d7d-4f81-bac4-396a8690938e","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:41:01","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"5a2b00d1-c16c-4092-a1ab-41338dbe77c8","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:37:47","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8006\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"cf026159-c651-4406-80cd-c20700f54bc9","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-03T03:37:47","port":8007,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8007\",\"user-agent\":\"odin-scanner/0.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030370d0a557365722d4167656e743a206f64696e2d7363616e6e65722f302e340d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"odin-scanner/0.4","ja3":"","session":"e79a2672-7bd9-4746-8d6f-4f5619d215bb","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78}],"http_methods":[{"method":"GET","count":56}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":56,"ports":8}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8006","notable":false},{"name":"User-Agent","value":"odin-scanner/0.4","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-05T10:34:38.532808+00:00"}