{"ip":"128.199.44.215","total_events":16,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowforce","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (shadowforce).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"927 bytes sent","bytes_sent":927,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-21T14:43:47","last_seen":"2026-09-23T04:46:35","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"blue-4.scan.shadowforce.io","known_scanners":["shadowforce"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":3},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8085,"proto":"tcp","label":"","count":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":1},{"port":7547,"proto":"tcp","label":"TR-069","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":993,"proto":"tcp","label":"IMAPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191100_9dc949149365_9249cab70c77","t13i131200_f57a46bbacb6_1bd98dace775"],"tls_client_hello":"160301010a010001060303b16766e173ff1eb74d778feac7b1e34ba8a426fa147f3132f982e7a32174a4a8203877bad8b3c38e7b6d4cc014549165f4c76d92ef050f1cafe77ef6d8290cf8f5001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a3000b0002010000230000ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003300260024001d00200866b1f8f5274122f00a42b683ce27bdfde913ba597fddb4a07d19fe41f3d939002d00020101","tls_ja3":["30ae8660657b7198d6f11ae92ef04b28","21f6f572ee66e2f8dfd6bcfd23c697ba"],"http_akin":["b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i191100_9dc949149365_9249cab70c77":1,"t13i131200_f57a46bbacb6_1bd98dace775":26,"b11cun030_00040014_54d07b6d":3711},"akin_families":{},"user_agents":["CGrab/v8.12.0","CGrab/v8.4.0","CGrab/v8.7.0"],"timeline":[{"date":"2026-08-11","count":2},{"date":"2026-08-14","count":2},{"date":"2026-08-21","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-07","count":1},{"date":"2026-09-15","count":2},{"date":"2026-09-19","count":1},{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T04:46:35","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"a1 CAPABILITY\r\n","payload_hex":"6131204341504142494c4954590d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"cf5663e2-a80b-4432-9f5f-4eca357b2d23","seq":1,"duration_ms":112,"bytes_in":15,"bytes_out":20,"enriched":{"digest":"1b1cfd8e969efb3e","strings":["a1 CAPABILITY"]}},{"timestamp":"2026-09-19T09:07:17","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"74542a82-e169-4df3-b791-77e50dc92fcb","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-15T10:57:17","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038350d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"568d3665-f3d0-4b91-a1ee-85c6b1d724e4","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-15T10:17:23","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038350d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"95feba7c-5890-468b-b091-68efd741db42","seq":1,"duration_ms":100,"bytes_in":85,"bytes_out":79},{"timestamp":"2026-09-07T11:07:13","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"30ae8660657b7198d6f11ae92ef04b28","session":"e7162974-8022-4831-8b37-d88bfa89f5e2","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-03T09:55:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"30ae8660657b7198d6f11ae92ef04b28","session":"ea6512c2-6a9d-478a-928c-da55a32aadd1","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-09-02T12:03:58","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"3c8b92ef-9904-4d80-ab0e-3a0835a1e0ac","seq":1,"duration_ms":101,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-08-21T20:02:43","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"3e03f978-1377-417c-a50d-4437920f5293","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-08-14T09:34:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"3b074af5-6cf3-4e6f-9143-aa3525f04dba","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":79},{"timestamp":"2026-08-14T06:59:06","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"4bcff881-2b7a-4655-ac95-ccc9d1205d70","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79}],"http_methods":[{"method":"GET","count":13}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":13,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"CGrab/v8.12.0","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[],"data_as_of":"2026-10-13T22:17:00.712898+00:00"}