{"ip":"147.182.135.44","data_as_of":"2026-10-25T12:02:59+00:00","observed":true,"total_events":469,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"zern","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (zern).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 158 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"59,962 bytes sent","bytes_sent":59962,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-10-12T00:46:11","last_seen":"2026-10-22T21:54:24","events_24h":0,"events_7d":6,"interactive_sessions":158,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":54},{"protocol":"stratum","sessions":3},{"protocol":"http-proxy","sessions":2},{"protocol":"kerberos","sessions":2},{"protocol":"atg","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":["zern"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":158,"first_seen":"2026-10-15T10:57:25","last_seen":"2026-10-15T10:57:33","verdicts":[{"verdict":"unknown","sessions":110},{"verdict":"scan","sessions":48}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":54},{"persona":"miner@cgminer 4.11.1","sessions":3},{"persona":"kerberos@Windows Server 2019","sessions":2},{"persona":"proxy@squid/5.7","sessions":2},{"persona":"atg@Veeder-Root TLS-350","sessions":1}],"services":[{"protocol":"http-proxy","port":3128,"sessions":2},{"protocol":"tcp","port":4444,"sessions":2},{"protocol":"tcp","port":8084,"sessions":2},{"protocol":"http","port":7002,"sessions":2},{"protocol":"tcp","port":83,"sessions":2},{"protocol":"http","port":80,"sessions":2},{"protocol":"tcp","port":3000,"sessions":2},{"protocol":"http","port":8443,"sessions":2},{"protocol":"http","port":8070,"sessions":2},{"protocol":"http","port":8004,"sessions":2},{"protocol":"tcp","port":81,"sessions":2},{"protocol":"tcp","port":8007,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":48}]},"top_ports":[{"port":8085,"proto":"tcp","label":"","count":8,"sessions":2},{"port":38088,"proto":"tcp","label":"","count":8,"sessions":1},{"port":19999,"proto":"tcp","label":"","count":8,"sessions":1},{"port":32773,"proto":"tcp","label":"","count":8,"sessions":1},{"port":18083,"proto":"tcp","label":"","count":8,"sessions":1},{"port":21849,"proto":"tcp","label":"","count":8,"sessions":1},{"port":18082,"proto":"tcp","label":"","count":8,"sessions":1},{"port":5002,"proto":"tcp","label":"","count":6,"sessions":2},{"port":5050,"proto":"tcp","label":"","count":6,"sessions":2},{"port":7000,"proto":"tcp","label":"","count":6,"sessions":2},{"port":9081,"proto":"tcp","label":"","count":6,"sessions":1},{"port":51356,"proto":"tcp","label":"","count":6,"sessions":1},{"port":5080,"proto":"tcp","label":"","count":6,"sessions":1},{"port":8889,"proto":"tcp","label":"","count":6,"sessions":1},{"port":7474,"proto":"tcp","label":"","count":6,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc030395095b7fa8d590adc83a5f28733ff3dc6aa0ffec61400349a594a93b3d95412720d6f327116ef7d0cf4909c2cc3fe70bb83c196e64190ddeb4d0dd6e9dd89c4d31003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020fd6d9d5027d9f60fc09d395c49ff65e5ae1e014d53685276faab89889b47f809001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10cun040_00040015_4c87b06e"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":694,"b10cun040_00040015_4c87b06e":14},"akin_families":{},"user_agents":["zern-scanner (+https://zern.io)"],"timeline":[{"date":"2026-10-12","count":132,"sessions":0},{"date":"2026-10-14","count":106,"sessions":0},{"date":"2026-10-15","count":186,"sessions":158},{"date":"2026-10-16","count":39,"sessions":0},{"date":"2026-10-22","count":6,"sessions":0}],"recent_events":[{"timestamp":"2026-10-22T21:54:24","port":8085,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"84f79c25-44ef-488b-a553-c47444fdc160","seq":1,"duration_ms":159,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-22T21:54:24","port":8889,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"36c3b64b-da3d-4b8c-8e1d-8417b7c7b537","seq":1,"duration_ms":165,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-22T21:54:24","port":8702,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7893684a-5866-4ff3-8979-d3d73fcafee8","seq":1,"duration_ms":158,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-22T21:54:22","port":8889,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"189893e5-bfc7-496b-9f23-fe796ce8801b","seq":1,"duration_ms":102,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-22T21:54:22","port":8702,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"51396f5e-ebe7-4377-a4bf-89b31ce2ad38","seq":1,"duration_ms":102,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-22T21:54:22","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"48462a78-96df-42fe-a97e-9959aa723944","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-16T19:01:36","port":30005,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"bd8f5336-699a-4112-8d81-f840d91615d3","seq":1,"duration_ms":0,"bytes_in":116,"bytes_out":79},{"timestamp":"2026-10-16T19:01:34","port":50000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8598718b-6246-4e19-a64d-564d69dbd62a","seq":1,"duration_ms":0,"bytes_in":116,"bytes_out":79},{"timestamp":"2026-10-16T19:01:33","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"a7742cdc-3680-4776-89cb-1db66230c3a9","seq":1,"duration_ms":1773,"bytes_in":116,"bytes_out":79},{"timestamp":"2026-10-16T19:01:33","port":30005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"zern-scanner (+https://zern.io)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a207a65726e2d7363616e6e657220282b68747470733a2f2f7a65726e2e696f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"zern-scanner (+https://zern.io)","ja3":"","session":"ef96da49-fd2c-418e-850b-2afedf5ee2f0","seq":1,"duration_ms":0,"bytes_in":116,"bytes_out":79}],"http_methods":[{"method":"GET","count":479}],"distinct_ports_total":120,"top_paths":[{"path":"/","count":479,"ports":112}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"zern-scanner (+https://zern.io)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}