{"ip":"178.128.250.218","total_events":9,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowforce","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (shadowforce).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"346 bytes sent","bytes_sent":346,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-20T16:06:45","last_seen":"2026-09-25T16:58:54","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"blue-2.scan.shadowforce.io","known_scanners":["shadowforce"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":1},{"port":6001,"proto":"tcp","label":"","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":6060,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_1bd98dace775"],"tls_client_hello":"160301010a010001060303030d800408c12c603b2c991107bb4a0e456c01549536e3688dc3a824ccf59d5d208cab28e77273a3ea82ef7402d04b39bc3f156673b962a6616231737c04bfe809001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a3000b0002010000230000ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003300260024001d0020eac73e8309555783232ced5a86c02b16e01392c3898db918898ba19e4fc92d0b002d00020101","tls_ja3":["21f6f572ee66e2f8dfd6bcfd23c697ba"],"http_akin":["b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_1bd98dace775":26,"b11cun030_00040014_54d07b6d":3711},"akin_families":{},"user_agents":["CGrab/v8.12.0"],"timeline":[{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-22","count":2},{"date":"2026-09-25","count":1}],"recent_events":[{"timestamp":"2026-09-25T16:58:54","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000B=�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=CGrab/v8.24.1-dev-throughput\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"030000423de00000000000436f6f6b69653a206d737473686173683d43477261622f76382e32342e312d6465762d7468726f7567687075740d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"4ffb4f00-c774-4ceb-b985-db9d8cfc4b80","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":15,"enriched":{"digest":"7a263b29434d8ed2","label":"RDP (X.224)","strings":["Cookie: mstshash=CGrab/v8.24.1-dev-throughput"]}},{"timestamp":"2026-09-22T16:13:40","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"FEAT\r\n","payload_hex":"464541540d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"513d2b0c-3822-42ef-be20-df3df27c0864","seq":1,"duration_ms":247,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"5b392bf01c965a67","strings":["FEAT"]}},{"timestamp":"2026-09-22T16:13:40","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"USER anonymous\r\n","payload_hex":"5553455220616e6f6e796d6f75730d0a","method":"","user_agent":"","ja3":"21f6f572ee66e2f8dfd6bcfd23c697ba","session":"513d2b0c-3822-42ef-be20-df3df27c0864","seq":2,"duration_ms":498,"bytes_in":22,"bytes_out":56,"enriched":{"digest":"e359d5ec0fa58580","label":"FTP","strings":["USER anonymous"]}},{"timestamp":"2026-09-18T05:42:55","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"5ca69af5-44cf-4385-9023-0126bd89a72d","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":80},{"timestamp":"2026-09-04T18:48:42","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"b7abeb26-b2b6-4c15-9dee-72d3afc74b0e","seq":1,"duration_ms":101,"bytes_in":83,"bytes_out":80},{"timestamp":"2026-09-03T10:09:05","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3128\",\"user-agent\":\"CGrab/v8.12.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a2043477261622f76382e31322e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"CGrab/v8.12.0","ja3":"","session":"280f1c92-aa78-4968-ab3a-25eaf2158b13","seq":1,"duration_ms":100,"bytes_in":85,"bytes_out":80},{"timestamp":"2026-02-21T19:50:46","port":6060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:6060\r\nUser-Agent: CGrab/v8.0.0\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363036300d0a557365722d4167656e743a2043477261622f76382e302e300d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"167ba27c-9af0-4818-b587-71385d3dbee9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dd56b36cd90c07f3","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:6060","User-Agent: CGrab/v8.0.0","Accept: */*"]}},{"timestamp":"2026-02-21T10:23:27","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:3128\r\nUser-Agent: CGrab/v8.0.0\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a2043477261622f76382e302e300d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"95015dba-e803-4c28-9390-766bdb1189d2","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5651c69fc7faf0b9","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:3128","User-Agent: CGrab/v8.0.0","Accept: */*"]}},{"timestamp":"2026-02-20T16:06:45","port":8080,"proto":"tcp","app_proto":"","app_protocol":"ookla","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:8080\r\nUser-Agent: CGrab/v8.0.0\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2043477261622f76382e302e300d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"f23a727f-c290-4fa7-b5c7-23fe17223408","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8d78de8b8328ad30","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:8080","User-Agent: CGrab/v8.0.0","Accept: */*"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:6001","notable":false},{"name":"User-Agent","value":"CGrab/v8.12.0","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-13T22:19:24.405339+00:00"}