{"ip":"192.42.116.14","total_events":33,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Church of Cyberology","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (Church of Cyberology).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,589 bytes sent","bytes_sent":6589,"session_seconds":2,"persistent":false}},"first_seen":"2026-07-28T18:15:22","last_seen":"2026-09-23T09:19:34","events_24h":1,"events_7d":1,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":215125,"org":"Church of Cyberology"},"source_domain":"this-is-a-tor-exit-node-hviv114.hviv.nl","known_scanners":["Church of Cyberology"],"scanner_tag":{"key":"cyberology","label":"Church of Cyberology","category":"research","url":""},"cve_matches":[],"malware":[],"top_ports":[{"port":37777,"proto":"tcp","label":"","count":8},{"port":1935,"proto":"tcp","label":"","count":8},{"port":6665,"proto":"tcp","label":"","count":8},{"port":3000,"proto":"tcp","label":"Web-alt","count":5},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":8332,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cuq081_0000065d_03107b03"]},"fingerprint_peers":{"a11cuq081_0000065d_03107b03":1},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0","python-requests/2.28.1","Go-http-client/1.1"],"timeline":[{"date":"2026-07-28","count":19},{"date":"2026-08-11","count":5},{"date":"2026-09-04","count":8},{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T09:19:34","port":8332,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"authorization\":\"Basic YTph\",\"content-length\":\"74\",\"content-type\":\"application/json\",\"host\":\"192.3.118.146:8332\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0\"}","body":"{\"jsonrpc\": \"1.0\", \"id\":\"curltest\", \"method\": \"getbalance\", \"params\": [] }","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a383333320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f5736343b2072763a34352e3029204765636b6f2f32303130303130312046697265666f782f34352e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037340d0a417574686f72697a6174696f6e3a20426173696320595470680d0a0d0a7b226a736f6e727063223a2022312e30222c20226964223a226375726c74657374222c20226d6574686f64223a202267657462616c616e6365222c2022706172616d73223a205b5d207d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0","ja3":"","session":"e93370a5-49de-4526-81bb-59eeb40d410f","seq":1,"duration_ms":100,"bytes_in":423,"bytes_out":78},{"timestamp":"2026-09-04T00:26:23","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000`5\u0000\u0000\u0000lawman\u0000\u0000@blackhackingcamVIP1@,a\u0004\u0001\u0000\u0000\u0000\u0000��lawman&&@blackhackingcamVIP1@,a\u0000Random:1788481581\r\n\r\n","payload_hex":"a0000060350000006c61776d616e000040626c61636b6861636b696e6763616d56495031402c61040100000000a1aa6c61776d616e262640626c61636b6861636b696e6763616d56495031402c610052616e646f6d3a313738383438313538310d0a0d0a","method":"","user_agent":"","ja3":"","session":"807bad47-9cab-4564-bb2b-60c852e3448d","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":13,"enriched":{"digest":"6361f4318df10670","strings":["lawman","@blackhackingcamVIP1@,a","lawman&&@blackhackingcamVIP1@,a","Random:1788481581","`5lawman@blackhackingcamVIP1@,a","lawman&&@blackhackingcamVIP1@,aRandom:1788481581"]}},{"timestamp":"2026-09-04T00:26:23","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000��","payload_hex":"a00500600000000000000000000000000000000000000000050200010000a1aa","method":"","user_agent":"","ja3":"","session":"0ef54549-4393-4c77-accf-3838ba74418f","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13},{"timestamp":"2026-09-04T00:26:22","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000��","payload_hex":"a00500600000000000000000000000000000000000000000050200010000a1aa","method":"","user_agent":"","ja3":"","session":"a62bf11f-e781-43a4-ae02-97294f2cffb4","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13},{"timestamp":"2026-09-04T00:26:19","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000`3\u0000\u0000\u0000tggvoth\u0000@blackhackingcamVIP1\u0004\u0001\u0000\u0000\u0000\u0000��tggvoth&&@blackhackingcamVIP1\u0000Random:1788481577\r\n\r\n","payload_hex":"a000006033000000746767766f74680040626c61636b6861636b696e6763616d56495031040100000000a1aa746767766f7468262640626c61636b6861636b696e6763616d564950310052616e646f6d3a313738383438313537370d0a0d0a","method":"","user_agent":"","ja3":"","session":"ccd0e96c-86c6-4e78-bf95-448153d158f0","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"4f003cfda28452a5","strings":["tggvoth","@blackhackingcamVIP1","tggvoth&&@blackhackingcamVIP1","Random:1788481577","`3tggvoth@blackhackingcamVIP1","tggvoth&&@blackhackingcamVIP1Random:1788481577"]}},{"timestamp":"2026-09-04T00:26:18","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000`6\u0000\u0000\u0000tggvoth\u0000@blackhackingcamVIP1@,a\u0004\u0001\u0000\u0000\u0000\u0000��tggvoth&&@blackhackingcamVIP1@,a\u0000Random:1788481576\r\n\r\n","payload_hex":"a000006036000000746767766f74680040626c61636b6861636b696e6763616d56495031402c61040100000000a1aa746767766f7468262640626c61636b6861636b696e6763616d56495031402c610052616e646f6d3a313738383438313537360d0a0d0a","method":"","user_agent":"","ja3":"","session":"a3989746-d7d3-414f-bb09-59045b872274","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":13,"enriched":{"digest":"72ba621edf82577d","strings":["tggvoth","@blackhackingcamVIP1@,a","tggvoth&&@blackhackingcamVIP1@,a","Random:1788481576","`6tggvoth@blackhackingcamVIP1@,a","tggvoth&&@blackhackingcamVIP1@,aRandom:1788481576"]}},{"timestamp":"2026-09-04T00:26:18","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000��","payload_hex":"a00500600000000000000000000000000000000000000000050200010000a1aa","method":"","user_agent":"","ja3":"","session":"2c6acf6f-795e-487d-b48e-01b27a303c86","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13},{"timestamp":"2026-09-04T00:26:17","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000`4\u0000\u0000\u0000security@blackhackingcamVIP1\u0004\u0001\u0000\u0000\u0000\u0000��security&&@blackhackingcamVIP1\u0000Random:1788481576\r\n\r\n","payload_hex":"a000006034000000736563757269747940626c61636b6861636b696e6763616d56495031040100000000a1aa7365637572697479262640626c61636b6861636b696e6763616d564950310052616e646f6d3a313738383438313537360d0a0d0a","method":"","user_agent":"","ja3":"","session":"696b6d73-1283-4edd-9fbf-6629de43721c","seq":1,"duration_ms":100,"bytes_in":96,"bytes_out":13,"enriched":{"digest":"7180093b98889078","strings":["security@blackhackingcamVIP1","security&&@blackhackingcamVIP1","Random:1788481576","`4security@blackhackingcamVIP1","security&&@blackhackingcamVIP1Random:1788481576"]}},{"timestamp":"2026-09-04T00:26:17","port":37777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0005\u0000`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0002\u0000\u0001\u0000\u0000��","payload_hex":"a00500600000000000000000000000000000000000000000050200010000a1aa","method":"","user_agent":"","ja3":"","session":"7c248793-9788-4a64-b386-950896bf4559","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13},{"timestamp":"2026-08-11T18:55:43","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"1d2197c0-5c61-4ee5-86c3-bd77b73a9676","seq":3,"duration_ms":941,"bytes_in":427,"bytes_out":234}],"http_methods":[{"method":"GET","count":24},{"method":"POST","count":1}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/api/trpc/settings.ai?batch=1&input=%7B%7D","count":1,"ports":1},{"path":"/register","count":1,"ports":1},{"path":"/api/auth/get-session","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=user&pwd=","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=moggy","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=gueest&pwd=gueest","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin&pwd=user","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=user","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin&pwd=moggy","count":1,"ports":1},{"path":"/login","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=user112&pwd=user","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=guest","count":1,"ports":1}],"distinct_paths_total":24,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Authorization","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Authorization","value":"Basic YTph","notable":true},{"name":"Content-Length","value":"74","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"192.3.118.146:8332","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0","notable":false}],"distinct_sets":2,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-23T16:05:12.112063+00:00"}