{"ip":"185.12.59.117","total_events":311,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,609 bytes sent","bytes_sent":4609,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T08:27:21","last_seen":"2026-09-25T09:57:03","events_24h":0,"events_7d":8,"geo":{"country_code":"NO","country_name":"Norway","region":"Oslo","city":"Oslo","lat":59.9133,"lon":10.7389,"asn":50304,"org":"Blix Solutions AS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as50304","label":"Blix Solutions AS","category":"isp","url":"https://www.peeringdb.com/asn/50304"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":228},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":11},{"port":80,"proto":"tcp","label":"HTTP","count":11},{"port":46980,"proto":"tcp","label":"","count":10},{"port":36357,"proto":"tcp","label":"","count":9},{"port":36699,"proto":"tcp","label":"","count":9},{"port":20699,"proto":"tcp","label":"","count":6},{"port":20357,"proto":"tcp","label":"","count":6},{"port":55716,"proto":"tcp","label":"","count":6},{"port":31990,"proto":"tcp","label":"","count":6},{"port":27980,"proto":"tcp","label":"","count":4},{"port":9080,"proto":"tcp","label":"","count":3},{"port":6969,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":["f93d28ee0c77e2612b27491518d909f4","e54ef3ec27fe1fea7ab64d3fa05359fd","16443846184eafde36765c9bab2f4397","01f5cd21c04273f3cce83480ec951586"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t12i1608h2_8cdfa2d4673b_ac0d2f4ec206","t12i160700_8cdfa2d4673b_ac0d2f4ec206"],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun020_00000048_724c10fb"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3153,"t12i1608h2_8cdfa2d4673b_ac0d2f4ec206":0,"t12i160700_8cdfa2d4673b_ac0d2f4ec206":0,"f93d28ee0c77e2612b27491518d909f4":1,"e54ef3ec27fe1fea7ab64d3fa05359fd":546,"01f5cd21c04273f3cce83480ec951586":0,"a11cun020_00000048_724c10fb":692,"16443846184eafde36765c9bab2f4397":24},"akin_families":{"a11cun020_00000048_724c10fb":{"head":"a11cun020_00000048_724c10fb","shapes":3,"ips":697}},"user_agents":["Mozilla/5.0 zgrab/0.x","Mozilla/5.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"],"timeline":[{"date":"2026-09-11","count":3},{"date":"2026-09-25","count":8}],"recent_events":[{"timestamp":"2026-09-25T09:57:03","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"6b1b8a84-624f-45f3-89e9-5f9dc01ac886","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-09-25T09:02:03","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"a64f271a-2c39-461a-a8d8-665304ab8e1f","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-09-25T08:53:42","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"19187a4f-bb67-4ad4-a1cd-a25f562e56f2","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-25T08:50:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"c2614610-6d21-42af-88ba-c249b78650a2","seq":1,"duration_ms":100,"bytes_in":172,"bytes_out":78},{"timestamp":"2026-09-25T08:04:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"ac761b3f-1088-42e5-a664-9c9ba82ae98e","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-25T08:02:58","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"ffd96b8a-ab68-40dc-ac54-a561a0f4d5a4","seq":1,"duration_ms":100,"bytes_in":172,"bytes_out":78},{"timestamp":"2026-09-25T07:28:57","port":6969,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0003adb","payload_hex":"0000000103616462","method":"","user_agent":"","ja3":"","session":"476f6077-c586-485d-bf8c-5941d90a4bb5","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":13},{"timestamp":"2026-09-25T07:25:23","port":6969,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0003adb","payload_hex":"0000000103616462","method":"","user_agent":"","ja3":"","session":"b564eb1d-2fa4-406f-87a2-a75a42c2cc6a","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":13},{"timestamp":"2026-09-11T07:42:15","port":9080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/","summary":"","payload_hex":"474554202f76312f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3133322e3029204765636b6f2f32303130303130312046697265666f782f3133322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","ja3":"","session":"83a5ff43-4d3b-42fc-aa52-fe24c190b4be","seq":1,"duration_ms":101,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-09-11T07:37:05","port":9080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/","summary":"","payload_hex":"474554202f76312f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3133322e3029204765636b6f2f32303130303130312046697265666f782f3133322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","ja3":"","session":"f7800d0c-af9d-485e-8c94-f3f7fdc7db83","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":78}],"http_methods":[{"method":"GET","count":238}],"distinct_ports_total":13,"top_paths":[{"path":"/Dr0v","count":195,"ports":1},{"path":"/","count":16,"ports":2},{"path":"/api/status","count":10,"ports":3},{"path":"/login","count":6,"ports":1},{"path":"/aaaaaw","count":5,"ports":1},{"path":"/v1/","count":3,"ports":1},{"path":"/state","count":3,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":3}],"banners":[{"value":"SSH-2.0","count":7},{"value":"SSH-2.0-libssh_0.10.6","count":6},{"value":"SSH-2.0-Go","count":4},{"value":"SSH-2.0-zgrab2-sneakydrop-probe","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-30T04:42:10.959089+00:00"}