{"ip":"94.154.43.63","data_as_of":"2026-10-23T18:08:45+00:00","observed":true,"total_events":725,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"971 events across 4 port(s)","confidence":"medium","network_type":null,"why":["971 requests against 4 service(s), so the activity is deep on few services.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload was observed, so this describes volume and focus only.","Not in any known-scanner range.","Counts include 246 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"395,623 bytes sent","bytes_sent":395623,"session_seconds":1,"persistent":false},"basis":"combined"},"first_seen":"2026-10-04T11:07:45","last_seen":"2026-10-23T17:47:37","events_24h":64,"events_7d":346,"interactive_sessions":246,"interactive_sessions_24h":48,"interactive_sessions_7d":243,"interactive_protocols":[{"protocol":"http","sessions":164}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":246,"first_seen":"2026-10-14T18:05:23","last_seen":"2026-10-23T17:30:46","verdicts":[{"verdict":"scan","sessions":164},{"verdict":"unknown","sessions":82}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":50},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":50},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":26},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":24},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":12},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":2}],"services":[{"protocol":"http","port":7681,"sessions":164},{"protocol":"tcp","port":7681,"sessions":82}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":164}]},"top_ports":[{"port":7681,"proto":"tcp","label":"","count":643,"sessions":246},{"port":22,"proto":"tcp","label":"SSH","count":67,"sessions":0},{"port":60001,"proto":"tcp","label":"","count":11,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e003030f87c75a185391995d0617ccf69ef2280037d576f901203426c5a526c206c25e201e6567733e263fa56951f67c593ed798aa7b7d3140de492617e1e8ec9b219df2001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d00206de9a326aeeef0dbaa8fa0a79ff3f41c8c77f61603573b474145f687","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun103_50340011_f5d02f95_x9f62a4acfdb1","b11cun030_00040410_e62b6d85"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":755,"16443846184eafde36765c9bab2f4397":45,"b11cun030_00040012_13ee3d34":5337,"b11cun030_00040410_e62b6d85":20,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":21},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-04","count":4,"sessions":0},{"date":"2026-10-05","count":32,"sessions":0},{"date":"2026-10-06","count":17,"sessions":0},{"date":"2026-10-07","count":18,"sessions":0},{"date":"2026-10-08","count":8,"sessions":0},{"date":"2026-10-09","count":64,"sessions":0},{"date":"2026-10-10","count":59,"sessions":0},{"date":"2026-10-11","count":58,"sessions":0},{"date":"2026-10-12","count":43,"sessions":0},{"date":"2026-10-13","count":24,"sessions":0},{"date":"2026-10-14","count":52,"sessions":3},{"date":"2026-10-17","count":22,"sessions":9},{"date":"2026-10-18","count":60,"sessions":30},{"date":"2026-10-19","count":57,"sessions":42},{"date":"2026-10-20","count":56,"sessions":45},{"date":"2026-10-21","count":50,"sessions":42},{"date":"2026-10-22","count":55,"sessions":39},{"date":"2026-10-23","count":46,"sessions":36}],"recent_events":[{"timestamp":"2026-10-23T17:47:37","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"isiCo7cn3wJ0rJHuENvV6w==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20697369436f37636e33774a30724a4875454e765636773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"6d27a747-9da8-4db5-824f-06dc88c8de73","seq":1,"duration_ms":105,"bytes_in":392,"bytes_out":77},{"timestamp":"2026-10-23T17:47:37","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"Co44UyNuHfzDfZb7nMdcjA==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20436f343455794e7548667a44665a62376e4d64636a413d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"f9367292-4d46-4333-9902-bf413e0115c1","seq":1,"duration_ms":105,"bytes_in":391,"bytes_out":77},{"timestamp":"2026-10-23T17:30:46","port":7681,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"Mh/Wd2Kl1iUmEW1LQ/Jw6w==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f3c484f4e4559504f543e3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204d682f5764324b6c3169556d4557314c512f4a7736773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"4a879339-2e0c-4900-82fb-e1731e70be98-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T17:30:46","port":7681,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"qjDkjk87crYrtk9bWGl8vA==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f3c484f4e4559504f543e3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20716a446b6a6b383763725972746b396257476c3876413d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"0b9e8ed2-c6d9-414e-9711-f58798f915eb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T16:55:50","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"wns3P1+Y18BvIwbFtj3h8g==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20776e733350312b593138427649776246746a336838673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"30f63828-1576-4cac-832f-4cffbe9ec7d8","seq":1,"duration_ms":101,"bytes_in":390,"bytes_out":77},{"timestamp":"2026-10-23T16:55:50","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"fp0f68e/tEGdK0vQvWFigQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20667030663638652f744547644b3076517657466967513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"136059be-22f7-46a3-93a3-7861eda3abb3","seq":1,"duration_ms":101,"bytes_in":389,"bytes_out":77},{"timestamp":"2026-10-23T16:49:33","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"n6C46d4nYNv+a+cx9B8Z4g==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a206e3643343664346e594e762b612b63783942385a34673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"66c2984c-0c84-4338-92fd-2d28f710b832","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":77},{"timestamp":"2026-10-23T16:49:33","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"K58+nKx7upsGtEuTG2zEdw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204b35382b6e4b7837757073477445755447327a4564773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"3e14894f-c9c8-4e23-ade8-774cffdedde4","seq":1,"duration_ms":101,"bytes_in":391,"bytes_out":77},{"timestamp":"2026-10-23T16:04:34","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"yqpMKyH4fKZ6gfKNhKqz1w==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a207971704d4b794834664b5a3667664b4e684b717a31773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"08351f10-b7ca-4fcf-823a-e830d0bd5232","seq":1,"duration_ms":100,"bytes_in":394,"bytes_out":77},{"timestamp":"2026-10-23T16:04:34","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"dQ34Ko4/VMnfrjgzaH/Y0Q==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20645133344b6f342f564d6e66726a677a61482f5930513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"72bb3d64-10b0-4a16-9a2d-049fd3a676c1","seq":1,"duration_ms":100,"bytes_in":393,"bytes_out":77}],"http_methods":[{"method":"GET","count":822}],"distinct_ports_total":4,"top_paths":[{"path":"/ws","count":807,"ports":1},{"path":"/","count":11,"ports":1},{"path":"/login","count":4,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":67}],"credentials":[],"header_profile":{"signature":["Cache-Control","Connection","Host","Origin","Pragma","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:7681","notable":false},{"name":"Origin","value":"https://<HONEYPOT>:7681","notable":true},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Websocket-Key","value":"isiCo7cn3wJ0rJHuENvV6w==","notable":false},{"name":"Sec-Websocket-Protocol","value":"tty","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}