{"ip":"142.93.135.160","total_events":11,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowforce","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (shadowforce).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"591 bytes sent","bytes_sent":591,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-04T07:57:16","last_seen":"2026-09-23T09:47:44","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"red-7.scan.shadowforce.io","known_scanners":["shadowforce"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":1},{"port":6001,"proto":"tcp","label":"","count":1},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1},{"port":81,"proto":"tcp","label":"","count":1},{"port":993,"proto":"tcp","label":"IMAPS","count":1},{"port":995,"proto":"tcp","label":"POP3S","count":1},{"port":8085,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191100_9dc949149365_9249cab70c77","t13i131200_f57a46bbacb6_1bd98dace775"],"tls_client_hello":"160301010a0100010603032d774c074f05df940a96a52bd8fd1214eeb8f0d4ed6abe7303cdf6b5c0db9ff720412d99970c182a58702828d613c9455b61d759c8c23b799c3f5b6d75f90ea226001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a3000b0002010000230000ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003300260024001d00201712f886ff2672ed041cbcf4cbcf991a995962fa89a3fcb9fb73d859e9dfe304002d00020101","tls_ja3":["30ae8660657b7198d6f11ae92ef04b28","21f6f572ee66e2f8dfd6bcfd23c697ba"],"http_akin":["b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_1bd98dace775":26,"b11cun030_00040014_54d07b6d":3711,"t13i191100_9dc949149365_9249cab70c77":1},"akin_families":{},"user_agents":["CGrab/v8.12.0"],"timeline":[{"date":"2026-08-11","count":1},{"date":"2026-08-24","count":1},{"date":"2026-08-26","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T09:47:44","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"a1 CAPABILITY\r\n","payload_hex":"6131204341504142494c4954590d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"6bb97081-b160-4437-9658-6b2c1d34955c","seq":1,"duration_ms":193,"bytes_in":15,"bytes_out":20,"enriched":{"digest":"1b1cfd8e969efb3e","strings":["a1 CAPABILITY"]}},{"timestamp":"2026-09-20T01:41:21","port":81,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:81\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38310d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"1e67b602-c060-4c58-8d13-17855679720d","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":79},{"timestamp":"2026-09-19T00:07:27","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"a3dc2e7a-2e8c-45d6-86d5-797e25268b9f","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-09-18T05:37:48","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"0bd35cd4-d69f-4fb8-8cdd-17a4e4dad23e","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-17T03:16:36","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3128\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"00093702-f0f4-40a0-bd14-f2c99d822c2b","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-09-04T23:29:23","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"56784142-be16-4fb1-a017-c0178db72177","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-08-26T10:49:27","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"f5793ad7-6d06-4d17-8b14-b741531aae65","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":79},{"timestamp":"2026-08-24T18:34:22","port":995,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"CAPA\r\n","payload_hex":"434150410d0a","method":"","user_agent":"","ja3":"30ae8660657b7198d6f11ae92ef04b28","session":"69e3a85f-dffc-47a5-a1b7-6d6111a6ec8d","seq":1,"duration_ms":108,"bytes_in":6,"bytes_out":5,"enriched":{"digest":"56244a795b33ee3c","strings":["CAPA"]}},{"timestamp":"2026-08-11T15:47:25","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"1f687109-6f0c-4fb4-a3e5-642d51431e5c","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":79},{"timestamp":"2026-03-12T17:58:24","port":8080,"proto":"tcp","app_proto":"","app_protocol":"ookla","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:8080\r\nUser-Agent: CGrab/v8.7.0\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e372e300d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"02fd08fd-aace-480a-a5f3-615b3a0b01c0","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c9d35d1d1ef3cbd4","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:8080","User-Agent: CGrab/v8.7.0","Accept: */*"]}}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":7,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:81","notable":false},{"name":"User-Agent","value":"CGrab/v8.12.0","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-13T23:15:12.126505+00:00"}