Home/Threat intelligence/Scanner intelligence

Scanner intelligence

Aggregate port scanning, service probing, reconnaissance and path-probing events observed by owned sensors.

Observation window
Related activity observed

These results come from real owned-honeypot events after excluding loopback, private, link-local and documentation ranges.

Total events2Within selected window
Public sources2Unique source IPs
24-hour events0Current activity
Observing sensors1Observation coverage
Last observed8/28/2026, 14:27:17UTC evidence time

Daily events and sources

Shows up to the latest 30 days in the selected window. Bar height is event volume; the number is unique sources that day.

There are no public events to plot in this window.

Public source aggregates

Only redacted source IP, type, protocol, destination port, count and time are shown. Open an IP for its complete threat evidence.

2 sources
Source IPEventsObserved behaviorProtocol / portFirst observedLast observed
129.211.162.231 sensor1HTTP probehttp / :80888/28/2026, 14:27:178/28/2026, 14:27:17
20.118.250.501 sensor1HTTP probehttp / :80888/28/2026, 14:24:358/28/2026, 14:24:35

Types, protocols and destination ports

Event types

HTTP probe2

Protocols

http2

Destination ports

:80882
CHA.LA owned-observation modelScanning, brute force and web attacks are classified independently from sensor event type and protocol. One event may belong to both scanning and web probing. Not observed never means safe.The public page never exposes usernames, passwords, request paths, User-Agent values, payloads or sensor identifiers.ClickHouse analytics · Aggregated 10/15/2026, 21:09:41