{"ip":"178.128.158.73","total_events":10072,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"8996+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 8996 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-22T01:50:36","last_seen":"2026-07-22T15:00:22","events_24h":1,"events_7d":10072,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":15743,"proto":"tcp","label":"","count":4},{"port":6642,"proto":"tcp","label":"","count":4},{"port":28007,"proto":"tcp","label":"","count":3},{"port":45055,"proto":"tcp","label":"","count":3},{"port":15663,"proto":"tcp","label":"","count":3},{"port":511,"proto":"tcp","label":"","count":3},{"port":15482,"proto":"tcp","label":"","count":3},{"port":28141,"proto":"tcp","label":"","count":3},{"port":14206,"proto":"tcp","label":"","count":3},{"port":12247,"proto":"tcp","label":"","count":3},{"port":7904,"proto":"tcp","label":"","count":3},{"port":33352,"proto":"tcp","label":"","count":3},{"port":13462,"proto":"tcp","label":"","count":3},{"port":28123,"proto":"tcp","label":"","count":3},{"port":12477,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":5810},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-07-22","count":10072}],"recent_events":[{"timestamp":"2026-07-22T15:00:22","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","community_id":"1:2G5ROy0ertVnF8MbgoNIJpTUEHM=","ja3":"","session":"2617f648-7f01-4aff-ac3c-5da929fa6b5e","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-07-22T01:54:52","port":5917,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5917\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a353931370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:ag6j5Ary4wAMhMlaPMzYV1VyBw8=","ja3":"","session":"8341db90-967e-4c7b-9af9-73121047e92d","seq":1,"duration_ms":103,"bytes_in":147,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":10925,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10925\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a31303932350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:ptHECcYo3eYJC++wLYvmHm+/H/o=","ja3":"","session":"0e0958db-c125-41f0-928a-fa9c5816b35e","seq":1,"duration_ms":103,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":10566,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10566\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a31303536360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:UkZrlBKk54vn+4p3WEHybY80IxI=","ja3":"","session":"3479f929-d9ae-40e4-8c7d-f8b510eda9ad","seq":1,"duration_ms":101,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":146,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:146\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a3134360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:ixNqQLGZEysX9kWgQpsvn5zZVlA=","ja3":"","session":"e9c5cbe2-9647-47c6-b4fd-4e72a5c9d12b","seq":1,"duration_ms":102,"bytes_in":146,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":6749,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6749\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a363734390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:djKVRzai32m6d0tVcjRs64uComI=","ja3":"","session":"77d65789-293d-4f87-8e55-17609f46fac2","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":473,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:473\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a3437330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:O8X5hNG4ofguo3BvYAV6QMWfU80=","ja3":"","session":"9f95ce48-bb70-4404-b7f3-4b4b9c1a309c","seq":1,"duration_ms":102,"bytes_in":146,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":9757,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9757\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a393735370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:6f1lDicR/yo1FU8VI163vueZKDo=","ja3":"","session":"3572dea5-5e0c-498d-8c1e-613612489857","seq":1,"duration_ms":101,"bytes_in":147,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":991,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:991\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a3939310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:TFqE8P47eA0NUJWQOvhH1H82Uog=","ja3":"","session":"7c866abd-a08e-4d44-815b-01fa202c3cb8","seq":1,"duration_ms":102,"bytes_in":146,"bytes_out":79},{"timestamp":"2026-07-22T01:54:52","port":2099,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2099\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a323039390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:QEtxs6zcBXFO2M9C6GUoQltaid4=","ja3":"","session":"5671f137-4539-4c26-bc1a-d78e3a10406f","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":79}],"http_methods":[{"method":"GET","count":10071}],"distinct_ports_total":8996,"top_paths":[{"path":"/squid-internal-mgr/cachemgr.cgi","count":10071,"ports":8995}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5917","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[],"data_as_of":"2026-07-23T10:33:32.938437+00:00"}