{"ip":"94.154.43.219","total_events":1085,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"127,925 bytes sent","bytes_sent":127925,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-31T08:06:34","last_seen":"2026-09-20T14:07:56","events_24h":0,"events_7d":14,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":744},{"port":8554,"proto":"tcp","label":"","count":95},{"port":555,"proto":"tcp","label":"","count":91},{"port":5555,"proto":"tcp","label":"","count":39},{"port":322,"proto":"tcp","label":"","count":35},{"port":10554,"proto":"tcp","label":"","count":31},{"port":9554,"proto":"tcp","label":"","count":14},{"port":1880,"proto":"tcp","label":"","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":9},{"port":9100,"proto":"tcp","label":"Printer","count":6},{"port":9999,"proto":"tcp","label":"","count":3},{"port":1881,"proto":"tcp","label":"","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":5554,"proto":"tcp","label":"","count":1},{"port":63002,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":[]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5121},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0","Go-http-client/1.1","curl/7.88.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"],"timeline":[{"date":"2026-07-31","count":18},{"date":"2026-08-01","count":9},{"date":"2026-08-04","count":5},{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":3},{"date":"2026-08-17","count":3},{"date":"2026-08-22","count":7},{"date":"2026-08-23","count":392},{"date":"2026-08-24","count":355},{"date":"2026-08-25","count":239},{"date":"2026-08-26","count":1},{"date":"2026-08-30","count":9},{"date":"2026-09-04","count":29},{"date":"2026-09-20","count":14}],"recent_events":[{"timestamp":"2026-09-20T14:07:56","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"34bc17eb-57f9-4936-aab0-00e31c478b47","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T14:07:55","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"1e397ef5-a2e7-41d5-ab71-39c0d086e00a","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T13:53:35","port":1881,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1881\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"d1ada0b0-f8f2-499c-9678-cfa028f0650c","seq":1,"duration_ms":100,"bytes_in":103,"bytes_out":78},{"timestamp":"2026-09-20T13:53:34","port":1881,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1881\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"7b079339-e3ca-4858-afa4-d20d246f6fc8","seq":1,"duration_ms":100,"bytes_in":103,"bytes_out":78},{"timestamp":"2026-09-20T13:50:16","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"43b7886b-aa6a-4b2a-b05e-8ec3097c5337","seq":1,"duration_ms":101,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T13:50:15","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"d4b8fe7b-eca6-4ff1-af4c-82ea007a18d9","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T11:58:03","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"40a4fe2a-0578-474f-a953-041d8f3d48fa","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T11:58:02","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"70a9458c-9939-475c-806b-e7cd8c6ec745","seq":1,"duration_ms":101,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T11:46:45","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"41bee0ff-a939-4e6b-a33d-44a221bf6d84","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-20T11:46:44","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"3c0d5aac-416f-4826-96c4-cfe562361978","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78}],"http_methods":[{"method":"GET","count":32},{"method":"POST","count":2}],"distinct_ports_total":15,"top_paths":[{"path":"/settings","count":14,"ports":2},{"path":"/nginx_status","count":7,"ports":1},{"path":"/metrics","count":6,"ports":1},{"path":"http://api.ipify.org/ip?format=json","count":3,"ports":1},{"path":"/boaform/admin/formLogin","count":2,"ports":1},{"path":"http://checkip.amazonaws.com/","count":1,"ports":1},{"path":"http://hp-check-d9b52a8ca9.invalid/","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":3},{"value":"checkip.amazonaws.com","count":1},{"value":"hp-check-d9b52a8ca9.invalid","count":1}],"top_alpns":[],"banners":[],"credentials":[{"username":"admin","password":"","count":2}],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:1880","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T14:21:41.344214+00:00"}