{"ip":"134.209.119.139","data_as_of":"2026-10-23T02:35:42+00:00","observed":true,"total_events":257,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"103+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 103 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 56 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"37,445 bytes sent","bytes_sent":37445,"session_seconds":27,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T18:57:44","last_seen":"2026-10-22T22:04:01","events_24h":0,"events_7d":255,"interactive_sessions":56,"interactive_sessions_24h":20,"interactive_sessions_7d":56,"interactive_protocols":[{"protocol":"http","sessions":52},{"protocol":"stratum","sessions":4}],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":56,"first_seen":"2026-10-19T04:06:26","last_seen":"2026-10-22T22:04:01","verdicts":[{"verdict":"scan","sessions":56}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":32},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":20},{"persona":"miner@bfgminer 5.5.0","sessions":4}],"services":[{"protocol":"http","port":51356,"sessions":4},{"protocol":"http","port":9002,"sessions":4},{"protocol":"http","port":8008,"sessions":4},{"protocol":"http","port":8006,"sessions":4},{"protocol":"http","port":8282,"sessions":2},{"protocol":"http","port":27311,"sessions":2},{"protocol":"http","port":5002,"sessions":2},{"protocol":"http","port":9200,"sessions":2},{"protocol":"http","port":3002,"sessions":2},{"protocol":"http","port":8010,"sessions":2},{"protocol":"http","port":8086,"sessions":2},{"protocol":"http","port":8007,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":56}]},"top_ports":[{"port":51356,"proto":"tcp","label":"","count":4,"sessions":4},{"port":8006,"proto":"tcp","label":"","count":4,"sessions":4},{"port":9998,"proto":"tcp","label":"","count":6,"sessions":0},{"port":8004,"proto":"tcp","label":"","count":6,"sessions":0},{"port":8282,"proto":"tcp","label":"","count":4,"sessions":2},{"port":3002,"proto":"tcp","label":"","count":4,"sessions":2},{"port":5002,"proto":"tcp","label":"","count":4,"sessions":2},{"port":3333,"proto":"tcp","label":"","count":4,"sessions":2},{"port":9999,"proto":"tcp","label":"","count":5,"sessions":0},{"port":5050,"proto":"tcp","label":"","count":4,"sessions":0},{"port":6080,"proto":"tcp","label":"","count":4,"sessions":0},{"port":8800,"proto":"tcp","label":"","count":4,"sessions":0},{"port":8765,"proto":"tcp","label":"","count":4,"sessions":0},{"port":9001,"proto":"tcp","label":"Tor","count":4,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc03038d8ee436fbf4f68cc30a4b8683f59b9a094f2a90462f3fd642b6666265ac238120807c75c4b9a24e8e81fd77e53c263d5c667a42dff5ea43373c0668c5fd224e61003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020b538b8d673b0341695c404c3f76185aaa7b7e93f14e7bb44fc0e8646e2398454001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10cun040_00040015_4c87b06e"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":762,"b10cun040_00040015_4c87b06e":13},"akin_families":{},"user_agents":["zern-scanner (+https://zern.io)"],"timeline":[{"date":"2026-10-15","count":2,"sessions":0},{"date":"2026-10-16","count":143,"sessions":0},{"date":"2026-10-17","count":56,"sessions":0},{"date":"2026-10-19","count":56,"sessions":36},{"date":"2026-10-22","count":0,"sessions":20}],"recent_events":[{"timestamp":"2026-10-22T22:04:01","port":9200,"proto":"tcp","app_proto":"http","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"1603010200010001fc03032e4739f9463dd0e8c37167faf3911fa79b93bd4f8761776512348bd79b0b8c6a2097cbff35e494bc9f234392846b031b34a964d037dcdf79f145eda4b6e3efc3ee003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00201e2a02ce683a95c391a7898e85d98ba8b9bb387cb669224a2cccd6943611716e001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4b6f3cca-36f5-4c2a-b528-90a09f0604da-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":27311,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"8a1bd7fd-da12-46b8-8f42-b165afa71195-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":8008,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"5833629a-c0a2-4df1-81dd-349d8c675209-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":7474,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"95b5564c-75ac-4b55-ab78-4edd0268db27-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":8010,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"49c51464-c88c-461c-9cc4-d9806b45bc73-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":9002,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"03d7e918-fa2d-40f7-9936-c2fa0940459e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":8444,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"62ade1d7-7095-4cdb-b135-cbe4a0c456b8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":8006,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"12f61aff-0abc-47e9-9c23-cc1aa194adfd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":8043,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"18e59f0d-9f31-4548-93fe-2c7fb858bc4e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:03:57","port":51356,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"439e787f-c447-4a5b-a66d-5b444f4e36b8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":282}],"distinct_ports_total":103,"top_paths":[{"path":"/","count":283,"ports":100}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"zern-scanner (+https://zern.io)","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[]}