{"ip":"193.26.115.48","total_events":559,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"76+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 76 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"80,826 bytes sent","bytes_sent":80826,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-01T11:16:07","last_seen":"2026-08-14T20:29:21","events_24h":101,"events_7d":516,"geo":{"country_code":"US","country_name":"United States","region":"Florida","city":"Miami","lat":25.7735,"lon":-80.2008,"asn":210558,"org":"1337 Services GmbH"},"source_domain":"193.26.115.48.powered.by.rdp.sh","known_scanners":[],"scanner_tag":{"key":"peeringdb:as210558","label":"1337 Services GmbH","category":"cdn","url":"https://www.peeringdb.com/asn/210558"},"cve_matches":[],"malware":[],"top_ports":[{"port":427,"proto":"tcp","label":"","count":20},{"port":5000,"proto":"tcp","label":"Web-alt","count":16},{"port":3986,"proto":"tcp","label":"","count":16},{"port":6000,"proto":"tcp","label":"X11","count":15},{"port":119,"proto":"tcp","label":"NNTP","count":14},{"port":2717,"proto":"tcp","label":"","count":14},{"port":53,"proto":"tcp","label":"DNS","count":13},{"port":990,"proto":"tcp","label":"FTPS","count":12},{"port":49156,"proto":"tcp","label":"","count":12},{"port":13,"proto":"tcp","label":"","count":12},{"port":1028,"proto":"tcp","label":"","count":12},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":12},{"port":9,"proto":"tcp","label":"","count":11},{"port":10000,"proto":"tcp","label":"Webmin","count":11},{"port":1433,"proto":"tcp","label":"MSSQL","count":10}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0400_c3abebcf3d28","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i1909h2_9dc949149365_97f8aa674fd9":563,"t13i131000_f57a46bbacb6_ab7e3b40a677":5331,"ge11nn0300_0db47b7d240d":5561,"ge11nn0400_c3abebcf3d28":59,"ge11nn0400_88d30a62b7ad":4816,"e54ef3ec27fe1fea7ab64d3fa05359fd":195},"user_agents":["beyondmemory-research (+https://beyondmemory.io/opt-out)","Mozilla/5.0 zgrab/0.x","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3"],"timeline":[{"date":"2026-08-01","count":22},{"date":"2026-08-02","count":21},{"date":"2026-08-10","count":99},{"date":"2026-08-11","count":112},{"date":"2026-08-13","count":204},{"date":"2026-08-14","count":101}],"recent_events":[{"timestamp":"2026-08-14T20:29:21","port":3389,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"18529134-0a36-4256-83d6-9792e36cde94","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-14T20:29:21","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"e172db64-8040-45de-8bb7-71ee466ba76e","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-14T20:28:25","port":5051,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"953a24ee-43c4-493e-8224-8529ac772f89","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-14T20:28:21","port":5051,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"6efd5059-0e69-4f16-81a8-174392c0ecf5","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-14T20:28:13","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","ja3":"","session":"5cc505a9-77bc-49e8-a8a7-b2e53977ec17","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-14T20:27:44","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"beyondmemory-research (+https://beyondmemory.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a206265796f6e646d656d6f72792d726573656172636820282b68747470733a2f2f6265796f6e646d656d6f72792e696f2f6f70742d6f7574290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"beyondmemory-research (+https://beyondmemory.io/opt-out)","ja3":"","session":"1e68bdb3-c7d2-408f-aec7-218f9ff51b86","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-08-14T20:27:44","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"beyondmemory-research (+https://beyondmemory.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a206265796f6e646d656d6f72792d726573656172636820282b68747470733a2f2f6265796f6e646d656d6f72792e696f2f6f70742d6f7574290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"beyondmemory-research (+https://beyondmemory.io/opt-out)","ja3":"","session":"83df5fbe-1bae-44d6-8d86-cd2f9e5fa4ba","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-08-14T12:47:51","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"beyondmemory-research (+https://beyondmemory.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a206265796f6e646d656d6f72792d726573656172636820282b68747470733a2f2f6265796f6e646d656d6f72792e696f2f6f70742d6f7574290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"beyondmemory-research (+https://beyondmemory.io/opt-out)","ja3":"","session":"3192fed0-c5f7-4fad-95a1-d6880fbdc190","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-08-14T12:47:51","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"beyondmemory-research (+https://beyondmemory.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a206265796f6e646d656d6f72792d726573656172636820282b68747470733a2f2f6265796f6e646d656d6f72792e696f2f6f70742d6f7574290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"beyondmemory-research (+https://beyondmemory.io/opt-out)","ja3":"","session":"3a35a6ea-e4b2-431e-9e04-d061738a4bdd","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-08-14T12:44:56","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"beyondmemory-research (+https://beyondmemory.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a206265796f6e646d656d6f72792d726573656172636820282b68747470733a2f2f6265796f6e646d656d6f72792e696f2f6f70742d6f7574290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"beyondmemory-research (+https://beyondmemory.io/opt-out)","ja3":"","session":"194dd7ef-4dec-4525-bc6b-0472be1557ad","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":78}],"http_methods":[{"method":"GET","count":472}],"distinct_ports_total":76,"top_paths":[{"path":"/","count":325,"ports":71},{"path":"/favicon.ico","count":141,"ports":62},{"path":"/v1/models","count":6,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":11}],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-14T22:52:20.865265+00:00"}