{"ip":"146.190.21.73","total_events":14,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowforce","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (shadowforce).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"878 bytes sent","bytes_sent":878,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-12T19:56:09","last_seen":"2026-09-23T05:51:16","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"red-1.scan.shadowforce.io","known_scanners":["shadowforce"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":2},{"port":3000,"proto":"tcp","label":"Web-alt","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":1080,"proto":"tcp","label":"SOCKS","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":1},{"port":993,"proto":"tcp","label":"IMAPS","count":1},{"port":6060,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191100_9dc949149365_9249cab70c77","t13i131200_f57a46bbacb6_1bd98dace775"],"tls_client_hello":"160301010a01000106030368a2e1bac48422bbbf1be511ad20043e0e9451c9602844a7d668439212a9d650207869d10d75895917db24972ce5172c650e24608a12a15d2f54c393b1748f5bd0001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a3000b0002010000230000ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003300260024001d00203f883710f3c0bc8b843db897316f08254ebbd191e9541640470c0f905ed70852002d00020101","tls_ja3":["30ae8660657b7198d6f11ae92ef04b28","21f6f572ee66e2f8dfd6bcfd23c697ba"],"http_akin":["b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i191100_9dc949149365_9249cab70c77":1,"t13i131200_f57a46bbacb6_1bd98dace775":26,"b11cun030_00040014_54d07b6d":3711},"akin_families":{},"user_agents":["CGrab/v8.12.0"],"timeline":[{"date":"2026-08-20","count":1},{"date":"2026-08-21","count":3},{"date":"2026-08-24","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-16","count":2},{"date":"2026-09-17","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T05:51:16","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"a1 CAPABILITY\r\n","payload_hex":"6131204341504142494c4954590d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"eb13e018-0406-426c-a5df-cc2215116428","seq":1,"duration_ms":108,"bytes_in":15,"bytes_out":20,"enriched":{"digest":"1b1cfd8e969efb3e","strings":["a1 CAPABILITY"]}},{"timestamp":"2026-09-22T19:39:55","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"FEAT\r\n","payload_hex":"464541540d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"ca8c2006-72c8-4aa7-bb39-b614448856b5","seq":1,"duration_ms":107,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"5b392bf01c965a67","strings":["FEAT"]}},{"timestamp":"2026-09-22T19:39:55","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"USER anonymous\r\n","payload_hex":"5553455220616e6f6e796d6f75730d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"ca8c2006-72c8-4aa7-bb39-b614448856b5","seq":2,"duration_ms":213,"bytes_in":22,"bytes_out":56,"enriched":{"digest":"e359d5ec0fa58580","label":"FTP","strings":["USER anonymous"]}},{"timestamp":"2026-09-19T08:06:09","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"240f52c7-ddfe-49c1-a98b-42c7f25e8408","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":78},{"timestamp":"2026-09-17T09:08:49","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1080\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313038300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"58f9ee6f-1d77-4e59-af4a-7e3dc9172a08","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-09-16T07:21:24","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"32a426b2-0c1f-486b-ae86-d0f689b7b321","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":78},{"timestamp":"2026-09-16T04:46:04","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"7c0c2474-110a-4032-a36f-78145673a4c5","seq":1,"duration_ms":101,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-09-03T09:50:01","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3128\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"088c97af-b500-4ab9-890d-8108a1e20ff2","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-08-24T13:15:53","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"30ae8660657b7198d6f11ae92ef04b28","session":"4c27d518-69c6-4bcb-a07e-bbb9bdcfc393","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":78},{"timestamp":"2026-08-21T21:52:08","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"d9a256bf-7fc9-4a55-8c9f-3384931bae87","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":78}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":10,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"CGrab/v8.12.0","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-13T22:21:50.172546+00:00"}