{"ip":"185.242.226.18","total_events":391,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"criminalip","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (criminalip).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-17T19:14:19","last_seen":"2026-07-25T20:29:57","events_24h":21,"events_7d":31,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":202425,"org":"IP Volume inc"},"source_domain":"security.criminalip.com","known_scanners":["criminalip","CriminalIP"],"scanner_tag":{"key":"criminalip","label":"CriminalIP","category":"commercial","url":"https://www.criminalip.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":301},{"port":8181,"proto":"tcp","label":"","count":34},{"port":53,"proto":"tcp","label":"DNS","count":31},{"port":3000,"proto":"tcp","label":"Web-alt","count":25}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d130600_2d7513195f68_021165082e1c"],"tls_ja3":["20c9baf81bfe96ff89722899e75d0190"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12d130600_2d7513195f68_021165082e1c":29,"ge11nn0400_88d30a62b7ad":5178},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"],"timeline":[{"date":"2026-04-27","count":3},{"date":"2026-04-29","count":3},{"date":"2026-05-04","count":2},{"date":"2026-05-05","count":1},{"date":"2026-05-09","count":3},{"date":"2026-05-11","count":3},{"date":"2026-05-12","count":1},{"date":"2026-05-15","count":1},{"date":"2026-05-16","count":2},{"date":"2026-05-20","count":7},{"date":"2026-05-21","count":14},{"date":"2026-05-24","count":2},{"date":"2026-05-26","count":3},{"date":"2026-05-29","count":1},{"date":"2026-05-30","count":2},{"date":"2026-05-31","count":1},{"date":"2026-06-04","count":21},{"date":"2026-06-05","count":7},{"date":"2026-06-07","count":2},{"date":"2026-06-08","count":1},{"date":"2026-06-09","count":2},{"date":"2026-06-12","count":7},{"date":"2026-06-13","count":21},{"date":"2026-06-16","count":3},{"date":"2026-06-17","count":3},{"date":"2026-06-20","count":1},{"date":"2026-06-22","count":2},{"date":"2026-06-23","count":1},{"date":"2026-06-26","count":7},{"date":"2026-06-28","count":3},{"date":"2026-06-30","count":3},{"date":"2026-07-04","count":1},{"date":"2026-07-05","count":2},{"date":"2026-07-06","count":1},{"date":"2026-07-12","count":2},{"date":"2026-07-13","count":1},{"date":"2026-07-15","count":7},{"date":"2026-07-16","count":14},{"date":"2026-07-18","count":3},{"date":"2026-07-20","count":3},{"date":"2026-07-24","count":7},{"date":"2026-07-25","count":21}],"recent_events":[{"timestamp":"2026-07-25T20:29:57","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456$\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456p\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0002\u0002\u0010\u0002\u0000\u0003\u0002\u0003\u0011\u0003\u0000\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0000\u0000\u0001\u0000,\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0001\u0000 \u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000000b4fe534d424000000000000000000000000000000000000000000000000000000000000000000000000000000000000000313233343536373839303132333435362400050001000000000000003132333435363738393031323334353670000000020000000202100200030203110300000200060000000000020002000100000001002c00000000000200020001000100200001000000000000000000000000000000000001000000000000000000000000000000","method":"","user_agent":"","community_id":"1:LKioGQGplXJNJI3DZuaaxA0q/ss=","ja3":"","session":"751fe083-5318-4be0-ab65-17f4708ef573","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"47a9d18bf6ce29cf","strings":["SMB@","1234567890123456$","1234567890123456p","SMB@1234567890123456$"]}},{"timestamp":"2026-07-25T20:29:47","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�g\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000926700000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:Y/qJpdEW62i4RellkGpIWi/kEpM=","ja3":"","session":"3748ddb9-d78c-4f3a-8e02-7b875d11daa1","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"b9367ad6c2436db0","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T20:29:37","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000S7\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000533700000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:L8CiTdDP4tDTMV6QFr3bi9oIXu4=","ja3":"","session":"092da719-b262-46e4-adce-db460ac99f7e","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"b1deb55a0a6e06fc","strings":["SMBr","NT LM 0.12","EhS7"]}},{"timestamp":"2026-07-25T20:29:27","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018E`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000=\u0007\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d42720000000018456000000000000000000000000000003d0700000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:A+eZYN6PMpI6YYBv9qqo5dIJS90=","ja3":"","session":"99c7041e-0835-4acc-b502-fcb858f9eef1","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"a8ec95947bd20b4d","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T20:29:17","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�.\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000982e00000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:TnjyTtt28URnrdhvzH58JGzJ9lA=","ja3":"","session":"0382e5d8-9b3e-4510-afd0-2ad2da970ae0","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"8be056a4a0556095","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T20:29:07","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003y\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000037900000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:kvJKNVLsRk3CUwqAOemEDNMOHkI=","ja3":"","session":"d91617d2-3a49-4475-801c-a6aa41baa24b","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"1897be8d5b3b743d","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T20:28:57","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�l\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000be6c00000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:4nPqrYLZokGKoXhQec7LoiAhHgY=","ja3":"","session":"3fe91686-4efa-4d9b-8d82-57c9eeebb3ed","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"272ef75a93ed1ef1","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T07:42:08","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456$\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00001234567890123456p\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0002\u0002\u0010\u0002\u0000\u0003\u0002\u0003\u0011\u0003\u0000\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0000\u0000\u0001\u0000,\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000\u0001\u0000 \u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000000b4fe534d424000000000000000000000000000000000000000000000000000000000000000000000000000000000000000313233343536373839303132333435362400050001000000000000003132333435363738393031323334353670000000020000000202100200030203110300000200060000000000020002000100000001002c00000000000200020001000100200001000000000000000000000000000000000001000000000000000000000000000000","method":"","user_agent":"","community_id":"1:+9bgEAl+qsP0wSTPdFo5oEhppBQ=","ja3":"","session":"464e8df6-6d7b-4e24-abe1-9408c9c17b72","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"47a9d18bf6ce29cf","strings":["SMB@","1234567890123456$","1234567890123456p","SMB@1234567890123456$"]}},{"timestamp":"2026-07-25T07:41:58","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�v\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000b47600000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:/VQDNnjAyDK4l7hjTvUji47spgg=","ja3":"","session":"2d2f5ef1-8ecb-4aeb-903a-37a6d871e74f","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"d69ded6469def761","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-07-25T07:41:47","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u00001�SMBr\u0000\u0000\u0000\u0000\u0018Eh\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \t\u0000\u0000\u0001\u0000\u0000\u000e\u0000\u0002NT LM 0.12\u0000\u0002\u0000","payload_hex":"00000031ff534d4272000000001845680000000000000000000000000000200900000100000e00024e54204c4d20302e3132000200","method":"","user_agent":"","community_id":"1:KBya8/IOV00Gei+U0yTX8Et4jIs=","ja3":"","session":"f3965be0-060b-49dc-a0c8-3afa34a432cb","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":14,"enriched":{"digest":"64d0b59f9aaf0072","strings":["SMBr","NT LM 0.12"]}}],"http_methods":[{"method":"GET","count":59}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":59,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-26T01:04:34.379543+00:00"}