{"ip":"95.182.94.63","total_events":28,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 19 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"4,002 bytes sent","bytes_sent":4002,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-15T17:37:54","last_seen":"2026-09-07T20:49:13","events_24h":0,"events_7d":0,"geo":{"country_code":"CZ","country_name":"Czechia","region":"","city":"","lat":50.0848,"lon":14.4112,"asn":211273,"org":"Cloud Software - FZCO"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":4},{"port":111,"proto":"tcp","label":"RPC","count":2},{"port":40443,"proto":"tcp","label":"","count":2},{"port":1521,"proto":"tcp","label":"Oracle","count":2},{"port":5986,"proto":"tcp","label":"","count":2},{"port":8091,"proto":"tcp","label":"","count":2},{"port":30005,"proto":"tcp","label":"","count":2},{"port":4500,"proto":"tcp","label":"","count":1},{"port":7001,"proto":"tcp","label":"WebLogic","count":1},{"port":27020,"proto":"tcp","label":"","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":5001,"proto":"tcp","label":"","count":1},{"port":3333,"proto":"tcp","label":"","count":1},{"port":3033,"proto":"tcp","label":"","count":1},{"port":8010,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["faa162b5a653756fba26803ea81b362f"],"http_akin":[]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":58},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-07-15","count":1},{"date":"2026-07-20","count":1},{"date":"2026-07-28","count":1},{"date":"2026-08-02","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-08","count":2},{"date":"2026-08-09","count":2},{"date":"2026-08-10","count":2},{"date":"2026-08-12","count":1},{"date":"2026-08-15","count":4},{"date":"2026-08-17","count":2},{"date":"2026-08-25","count":2},{"date":"2026-08-26","count":2},{"date":"2026-09-01","count":1},{"date":"2026-09-02","count":3},{"date":"2026-09-07","count":2}],"recent_events":[{"timestamp":"2026-09-07T20:49:13","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"86287b34-4aea-4787-8b75-dc6799380300","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-07T19:43:50","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"4ac3f665-d257-48d4-a4b4-b51eebcf56e4","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-02T17:26:52","port":5986,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"1abc331f-0d4c-4ecd-9daf-c2b84c132b68","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-02T16:57:04","port":5986,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"f102f274-d05b-4de5-a2b5-ce006c8cea0b","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-02T00:09:04","port":8091,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8091\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"a8312bbd-3d97-40fe-b84e-c84cfb48bd5c","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-01T23:46:02","port":8091,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8091\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"1fa39027-e95e-4ac0-98d9-fe2ec6a8725f","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-08-26T03:08:24","port":30005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30005\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"a8be4439-df87-4b06-9584-1bd0a8b8a3de","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-08-26T02:36:01","port":30005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30005\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"4eae0f3b-6525-439f-b224-7f77501698f3","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-08-25T22:00:18","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000m\u0000\u0000\u0001\u0000\u0000\u0000\u00018\u0001,\fA \u0000��\b\u0000\u0000\u0001\u0000\u00003\u0000:\u0000\u0000\b\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","payload_hex":"006d0000010000000138012c0c412000ffff7f08000001000033003a000008004141000000000000000000000000000000000000000000000000284445534352495054494f4e3d28434f4e4e4543545f444154413d284349443d2850524f4752414d3d7a677261623229292929","method":"","user_agent":"","ja3":"","session":"4d037ac2-0e38-495d-89d8-37e05a368c59","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":12,"enriched":{"digest":"30081fcac0a42ce3","strings":["(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","AA(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))"]}},{"timestamp":"2026-08-25T21:26:39","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000m\u0000\u0000\u0001\u0000\u0000\u0000\u00018\u0001,\fA \u0000��\b\u0000\u0000\u0001\u0000\u00003\u0000:\u0000\u0000\b\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","payload_hex":"006d0000010000000138012c0c412000ffff7f08000001000033003a000008004141000000000000000000000000000000000000000000000000284445534352495054494f4e3d28434f4e4e4543545f444154413d284349443d2850524f4752414d3d7a677261623229292929","method":"","user_agent":"","ja3":"","session":"6357a3fc-45e7-41a0-820d-c13d5a37bc60","seq":1,"duration_ms":101,"bytes_in":109,"bytes_out":12,"enriched":{"digest":"30081fcac0a42ce3","strings":["(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","AA(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))"]}}],"http_methods":[{"method":"GET","count":18}],"distinct_ports_total":19,"top_paths":[{"path":"/","count":18,"ports":14}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":13}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5986","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-24T13:38:29.491593+00:00"}