{"ip":"199.45.154.52","total_events":251,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"censys","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (censys).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"35,835 bytes sent","bytes_sent":35835,"session_seconds":16,"persistent":false}},"first_seen":"2026-08-03T06:53:22","last_seen":"2026-08-15T03:10:54","events_24h":16,"events_7d":176,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":398722,"org":"Censys, Inc."},"source_domain":"52.154.45.199.censys-scanner.com","known_scanners":["censys","Censys"],"scanner_tag":{"key":"censys","label":"Censys","category":"research","url":"https://about.censys.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2078,"proto":"tcp","label":"","count":10},{"port":101,"proto":"tcp","label":"","count":10},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":10},{"port":4369,"proto":"tcp","label":"","count":10},{"port":502,"proto":"tcp","label":"","count":9},{"port":20548,"proto":"tcp","label":"","count":9},{"port":10259,"proto":"tcp","label":"","count":9},{"port":8636,"proto":"tcp","label":"","count":9},{"port":9200,"proto":"tcp","label":"Elastic","count":9},{"port":1801,"proto":"tcp","label":"","count":9},{"port":18444,"proto":"tcp","label":"","count":9},{"port":5432,"proto":"tcp","label":"Postgres","count":9},{"port":27017,"proto":"tcp","label":"MongoDB","count":9},{"port":19999,"proto":"tcp","label":"","count":9},{"port":4840,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5","35fa0a83e466acbec1cfbb9016d550ab","725543c78edf669194c11dc7a039b56e"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0100_4740ae6347b0","ge10nn0100_4740ae6347b0","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i1909h2_9dc949149365_97f8aa674fd9":564,"t13i131000_f57a46bbacb6_ab7e3b40a677":5329,"t13i190800_9dc949149365_97f8aa674fd9":1503,"ge11nn0100_4740ae6347b0":615,"ge10nn0100_4740ae6347b0":363,"ge11nn0400_9c3956fad5da":1486,"ge11nn0400_88d30a62b7ad":4815},"user_agents":["Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"],"timeline":[{"date":"2026-08-03","count":24},{"date":"2026-08-04","count":10},{"date":"2026-08-05","count":17},{"date":"2026-08-06","count":17},{"date":"2026-08-07","count":7},{"date":"2026-08-08","count":17},{"date":"2026-08-09","count":21},{"date":"2026-08-10","count":35},{"date":"2026-08-11","count":9},{"date":"2026-08-12","count":27},{"date":"2026-08-13","count":43},{"date":"2026-08-14","count":16},{"date":"2026-08-15","count":8}],"recent_events":[{"timestamp":"2026-08-15T03:10:54","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"f7f5a29c-1458-46d4-a755-cb8a24b9fcc2","seq":1,"duration_ms":369,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-08-15T03:10:51","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/5hue_bxxr","summary":"","payload_hex":"474554202f356875655f6278787220485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"fb921731-35a7-4d67-875d-7d57b4ef7117","seq":1,"duration_ms":348,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-08-15T03:10:45","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"a24d85fe-c3eb-49b3-871a-460a62593a5e","seq":1,"duration_ms":528,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-08-15T03:10:42","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"c6495285-d5c6-4c16-916d-33f6cc80710d","seq":1,"duration_ms":631,"bytes_in":167,"bytes_out":78},{"timestamp":"2026-08-15T03:10:12","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"0aa37623-ee4d-43ef-9908-37eab28ed5b8","seq":1,"duration_ms":959,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-08-15T03:10:01","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:427\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"eaeb4b02-cec8-4b2b-a97c-1f639731c9e9","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":78},{"timestamp":"2026-08-15T03:09:39","port":427,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:427\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3432370d0a0d0a","method":"GET","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"e289cc6d-855e-4c2e-92da-f1e2c5f074e8","seq":1,"duration_ms":4832,"bytes_in":42,"bytes_out":78},{"timestamp":"2026-08-15T03:09:05","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0002\u0001\u0000\u0000/\u0000\u0000\u0000\u0000\u0000D\u0000\u0000\u0002en\u0000\u0000\u0000\u000eservice:censys\u0000\u0007DEFAULT\u0000\u0000\u0000\u0000","payload_hex":"020100002f000000000044000002656e0000000e736572766963653a63656e737973000744454641554c5400000000","method":"","user_agent":"","ja3":"","session":"de371a51-d35b-4f81-b99c-21d8abc745e4","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b5ffe55679837590","strings":["service:censys","DEFAULT"]}},{"timestamp":"2026-08-14T16:00:45","port":1961,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"8bf059e3-280e-415b-be17-d0a5925edf32","seq":1,"duration_ms":202,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-08-14T16:00:43","port":1961,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/3byeep5vlw8z9s","summary":"","payload_hex":"474554202f33627965657035766c77387a397320485454502f312e310d0a486f73743a20<HONEYPOT>3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"40d3f126-97a6-4f99-b0f7-740e20d558ac","seq":1,"duration_ms":366,"bytes_in":177,"bytes_out":78}],"http_methods":[{"method":"GET","count":204}],"distinct_ports_total":30,"top_paths":[{"path":"/favicon.ico","count":86,"ports":29},{"path":"/","count":60,"ports":29},{"path":"/sitemap.xml","count":8,"ports":8},{"path":"/robots.txt","count":7,"ports":7},{"path":"/security.txt","count":5,"ports":5},{"path":"/wiki","count":4,"ports":4},{"path":"/.well-known/security.txt","count":3,"ports":3},{"path":"/login","count":2,"ports":2},{"path":"/nm23ub_hs2","count":1,"ports":1},{"path":"/ogme2mx0ibdhxilnk","count":1,"ports":1},{"path":"/pbvs7o_8xm","count":1,"ports":1},{"path":"/9ptvlti2a","count":1,"ports":1},{"path":"/9rocwf1vkxq","count":1,"ports":1},{"path":"/x8kkhti0pgqj092","count":1,"ports":1},{"path":"/mx92xl026t40","count":1,"ports":1}],"distinct_paths_total":37,"top_snis":[],"top_hosts":[{"value":"x","count":1}],"top_alpns":[{"value":"h2","count":27}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:427","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","notable":false}],"distinct_sets":3,"events_with_headers":9},"tags":[],"data_as_of":"2026-08-15T10:36:04.155781+00:00"}