{"ip":"198.211.98.87","total_events":3563,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"2666+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 2666 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-06-28T07:54:17","last_seen":"2026-06-28T07:56:42","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":3449,"proto":"tcp","label":"","count":5},{"port":1606,"proto":"tcp","label":"","count":4},{"port":4700,"proto":"tcp","label":"","count":4},{"port":34814,"proto":"tcp","label":"","count":4},{"port":9965,"proto":"tcp","label":"","count":4},{"port":18956,"proto":"tcp","label":"","count":4},{"port":5671,"proto":"tcp","label":"","count":4},{"port":7291,"proto":"tcp","label":"","count":4},{"port":10963,"proto":"tcp","label":"","count":4},{"port":6783,"proto":"tcp","label":"","count":4},{"port":36,"proto":"tcp","label":"","count":4},{"port":5740,"proto":"tcp","label":"","count":4},{"port":1489,"proto":"tcp","label":"","count":4},{"port":10030,"proto":"tcp","label":"","count":4},{"port":6701,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":7779},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-06-28","count":3563}],"recent_events":[{"timestamp":"2026-06-28T07:56:42","port":48941,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:48941\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a34383934310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:1+pta1HrfK7mRmInGdzIEW4i+MM=","ja3":"","session":"862dd460-e94d-49b9-837d-5aa4ab784c91","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:HDVIrlqrsZw9UUt26k4vtYfemhA=","ja3":"","session":"e3b8eeb2-3275-42bc-a162-3a3ed9e0ebfe","seq":1,"duration_ms":103,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":7429,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7429\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a373432390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:XSYMe4bYzE1lwA13mV+CM5IWq78=","ja3":"","session":"c96e4b22-6155-42c5-961b-43054224e812","seq":1,"duration_ms":103,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":24250,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:24250\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a32343235300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:U2+DEEMVS5RVKsn7p6ENC0FqfQM=","ja3":"","session":"4daca72e-c34d-4924-8fbd-385e9c7475e7","seq":1,"duration_ms":103,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":5084,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5084\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a353038340d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:baRVjXeuqYVCZQGik4P0BGRjvcA=","ja3":"","session":"49e5897b-5bda-4ceb-84f6-292ef116ee42","seq":1,"duration_ms":102,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":2958,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2958\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a323935380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:dumSC3V3Km3F92CfkcDmPr0QlyM=","ja3":"","session":"07bf269c-2329-4d7f-8a06-e2197ead11e6","seq":1,"duration_ms":102,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":2085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2085\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a323038350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:1hSHAkTM3oIzfqVI214WEkjjjVA=","ja3":"","session":"9841a517-834b-487d-8dab-58a78241f705","seq":1,"duration_ms":102,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":10030,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10030\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a31303033300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:yapCodOOOFdKA9Avct30eu02zYE=","ja3":"","session":"8a6d116a-b12a-4004-a4f9-aeee9fd0fee7","seq":1,"duration_ms":102,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":7242,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7242\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a373234320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:OEdFcP9ZOcuz/ae6+HfrJAde3gI=","ja3":"","session":"c042846b-7c6c-4946-9c58-3055308e2aa5","seq":1,"duration_ms":102,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-06-28T07:56:39","port":6725,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6725\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a363732350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:rlInpZR25IjpJ4ApmvWwX4VaeEA=","ja3":"","session":"a5d04713-29f8-4ad7-be4d-77d0835cb4f2","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":78}],"http_methods":[{"method":"GET","count":3563}],"distinct_ports_total":2666,"top_paths":[{"path":"/squid-internal-mgr/cachemgr.cgi","count":3563,"ports":2666}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:48941","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-07-06T06:13:19.272407+00:00"}