{"ip":"185.242.226.19","total_events":208,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"criminalip","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (criminalip).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-16T14:49:11","last_seen":"2026-07-25T01:46:20","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":202425,"org":"IP Volume inc"},"source_domain":"security.criminalip.com","known_scanners":["criminalip","CriminalIP"],"scanner_tag":{"key":"criminalip","label":"CriminalIP","category":"commercial","url":"https://www.criminalip.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2375,"proto":"tcp","label":"Docker","count":93},{"port":1723,"proto":"tcp","label":"PPTP","count":42},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":38},{"port":8880,"proto":"tcp","label":"","count":35}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d130600_2d7513195f68_021165082e1c"],"tls_ja3":["20c9baf81bfe96ff89722899e75d0190"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0300_88b8dd6ae43e","ge11nn0300_c91e9608e9b6","ge11nn0300_bf386a68b7de"]},"fingerprint_peers":{"t12d130600_2d7513195f68_021165082e1c":29,"ge11nn0300_c91e9608e9b6":18,"ge11nn0300_88b8dd6ae43e":521,"ge11nn0300_bf386a68b7de":22,"ge11nn0400_88d30a62b7ad":5177},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"],"timeline":[{"date":"2026-04-27","count":3},{"date":"2026-04-28","count":3},{"date":"2026-04-29","count":2},{"date":"2026-04-30","count":1},{"date":"2026-05-05","count":3},{"date":"2026-05-06","count":1},{"date":"2026-05-08","count":6},{"date":"2026-05-09","count":2},{"date":"2026-05-10","count":4},{"date":"2026-05-12","count":3},{"date":"2026-05-17","count":1},{"date":"2026-05-18","count":2},{"date":"2026-05-20","count":6},{"date":"2026-05-21","count":3},{"date":"2026-05-23","count":2},{"date":"2026-05-28","count":2},{"date":"2026-05-29","count":1},{"date":"2026-05-30","count":2},{"date":"2026-05-31","count":7},{"date":"2026-06-01","count":4},{"date":"2026-06-03","count":3},{"date":"2026-06-08","count":2},{"date":"2026-06-10","count":6},{"date":"2026-06-11","count":3},{"date":"2026-06-12","count":3},{"date":"2026-06-13","count":3},{"date":"2026-06-18","count":1},{"date":"2026-06-19","count":1},{"date":"2026-06-21","count":6},{"date":"2026-06-22","count":5},{"date":"2026-06-24","count":3},{"date":"2026-06-30","count":2},{"date":"2026-07-01","count":1},{"date":"2026-07-03","count":6},{"date":"2026-07-04","count":2},{"date":"2026-07-05","count":3},{"date":"2026-07-07","count":3},{"date":"2026-07-12","count":2},{"date":"2026-07-13","count":1},{"date":"2026-07-15","count":6},{"date":"2026-07-16","count":2},{"date":"2026-07-17","count":2},{"date":"2026-07-19","count":3},{"date":"2026-07-24","count":2},{"date":"2026-07-25","count":1}],"recent_events":[{"timestamp":"2026-07-25T01:46:20","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":8880\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a383838300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:vOQB9EkJm1HD9cPXaMhW2HKxhLw=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"69018bee-7c39-4b5d-ab38-aab13a535e64","seq":1,"duration_ms":112,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-07-19T03:59:06","port":8880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":8880\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a383838300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:ZT3fMJ9WPNJnJox2TAnROOZq+wM=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"1618f17d-d873-4e57-8a03-ebd289ecd1e6","seq":1,"duration_ms":194,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-19T03:59:00","port":8880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":8880\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a383838300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:fWCYRD5ZyTVcmatNPWhtsFhIAkU=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"bf1ddd50-a48d-42b7-871e-253dba80d5d9","seq":1,"duration_ms":194,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-17T03:21:00","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":2376\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a323337360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:GSiNqjXtV7WJ9oZomvZdBBUUfug=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"9472f89c-8b6e-471f-bd7d-1d0764d43af3","seq":1,"duration_ms":107,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-07-17T01:58:14","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":2376\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a323337360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:iDXl46/eTavqwgq9+i8WP71IIFA=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"91d61e5f-90f2-48b4-92af-f795b3c9ce77","seq":1,"duration_ms":195,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-16T07:28:31","port":2375,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":2375\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38382e302e343332342e313930205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","community_id":"1:d7tgX/NTwlGVz3Hg0Fl4Ri8c7bI=","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"c542b245-eea9-4357-99a9-7abd614ce81b","seq":1,"duration_ms":110,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-07-16T07:16:35","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"132.183.175.5.servitro.com","headers":"{\"connection\":\"close\",\"host\":\"132.183.175.5.servitro.com:2375\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a203133322e3138332e3137352e352e736572766974726f2e636f6d3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","community_id":"1:4IhC5Skry5qqdX8RsEbvt9n4vu8=","ja3":"","session":"29cff1cf-4c3b-4c50-9fc8-aae63ac43f86","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":79}],"http_methods":[{"method":"GET","count":142}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":113,"ports":3},{"path":"/version","count":29,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"132.183.175.5.servitro.com","count":8},{"value":"panel.heliosnode.nl","count":7},{"value":"23-94-36-141-host.colocrossing.com","count":7},{"value":"23-94-37-227-host.colocrossing.com","count":7}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":":8880","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-07-26T01:43:04.917365+00:00"}