{"ip":"199.45.154.60","total_events":817,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"censys","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (censys).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"112,933 bytes sent","bytes_sent":112933,"session_seconds":19,"persistent":false}},"first_seen":"2026-08-03T13:37:39","last_seen":"2026-09-30T08:12:25","events_24h":40,"events_7d":125,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":398722,"org":"Censys, Inc."},"source_domain":"60.154.45.199.censys-scanner.com","known_scanners":["censys","Censys"],"scanner_tag":{"key":"censys","label":"Censys","category":"research","url":"https://about.censys.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":18244,"proto":"tcp","label":"","count":36},{"port":47001,"proto":"tcp","label":"","count":24},{"port":51005,"proto":"tcp","label":"","count":23},{"port":101,"proto":"tcp","label":"","count":20},{"port":3299,"proto":"tcp","label":"","count":17},{"port":1521,"proto":"tcp","label":"Oracle","count":17},{"port":20546,"proto":"tcp","label":"","count":17},{"port":4839,"proto":"tcp","label":"","count":17},{"port":20201,"proto":"tcp","label":"","count":16},{"port":2403,"proto":"tcp","label":"","count":16},{"port":1244,"proto":"tcp","label":"","count":16},{"port":5902,"proto":"tcp","label":"","count":16},{"port":18789,"proto":"tcp","label":"","count":15},{"port":22222,"proto":"tcp","label":"","count":15},{"port":30005,"proto":"tcp","label":"","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303daf0b9a8a46d538bc6a9882c2f776a0d5f072c0bcf3bca6a48bdefa3492a021520dd8471db5d110ccc2f3fb3bb52d9a9136574a762db81584c925706c5dc29fd45001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c032d0495f2a1fb9d99c3fca79f1c5985a623884f755b38b37f2014b83c471401bc781ec9aa9f278850c5c9e4c5b85a4a3fb99581fd4a5e60969465b285c4300f2d46985f0c22c79374ef42a9de58fa7d6323c03aa0e8baf1a8cc91629cf85e263cc7449a7fb9a8c13ad3c026c9beabe1bacc52a648d58f4a93c682923e76523d555f21065081a9d80b0670a635ad4803fa6b3130749c4c1f03da5071340fcc2c5468116fc9ae3b37c6133ad43b839800a96d3f04c5819adab7cc881e27e3950b739a9396af34ac24333f1a3c2b36b9633991d30b950866808bb274b21a04bc969cb12cb454107bd0702714b586fb00b26f3bacae9b604596478a7b009cce0197aab4462064bed4516b72c249758c9b92896751b1b20614c060868d8cc1059b5a103f85256d5128d393d783b9af6225549d7450e615965003ba87b386b02cc16ab2a00b2c41945c2d8010cb2c213daa9ab399a2c2eaa0aeecc1182aa1002616eec0360cd778a45d184862b2b5b6777f591b2f3d015404a1f8c3b8f3ec2579a650ae3d7b85be82989978c65f40bfd422185f7b7cc760ede75b937b29501c6c5ddc1acfeccb831b0072d914b85558f2af547383c1c8f238fc10184d16220ce1a1500fcc9713c6bd2269e1cfc590bb9a29c3535965ca8284c1dc56c8c39d3b24bb257035cc092159ffb27aa682b8fb7c724d9a15615159de8d80a33e45f6f735f8756b34ad77b01daae96d856c00635b5bc71a8bcbd6af0799bfc3dd70751070c905eca6080e26f1d2acc5caa876506571ef477eae149be634717f41e99c15318a39d7a6b30d769710f4b11e35baa03869da2b339e83157f9264f816ac7d57cc828d604ad64557bd06332abb6aadcadacd318db424a43a5038f730cc9a24aa5d806ce063969a5c26beb3a27a0b8cf6a8ab0b7875ee28b777819fe9b36339b5a92cc20ac9c054e316559b8716a759325000c91abbbbd84b78e7c16494349e0f8764996513d9c7abe132a4b810eae1a273c1b7d779865c9a16d307a53ce91c3c0500e9db35da045a5d45b35699c224d014349a1150051b7a3353f4d0458d99c049b860afe301efe67283021a4cdb691e8139e86a0821e233008c43bf453020fc1410c7c126f00aa4e2388a3f920cf36071e88a7a4ea3868ca44a18c2e991848047c259d304b93db23fbd07f72521fed5373a80bb75d3b266e585e70c584d60c0e36d74a0c01cce050716d653f077277b94c0320d77176d7589927266a057227b94da966c2684b04ba76b42f809b5c0821dd852f39f7c3bbba36a95ab7b093a497904dbf689808192f299999c9243161e453032395e649a6b1696f80e94b7e9a415688665c5c6b212623ddea4a2e02bf4373714eb2c4534c427e55a34d54a7df3a43be180f67f1425af409ad679e40ec3abfe00fadf70927204b3c1307bfd21b8d2c6a2d89243183ace4a273f1c572a9f020c69c97aa523eaf6220f0719a175666836b54a69130d9383fb25bae8a44cd8cc6b918346beccc3dd196a208289b52473e0da7791208934bd82a2af20bb2029746d4ab31c987a3a3bf50bb5206d35830571fe10457578c1dd39cc17fc46f6be3190ad9c39aab373dc7c09f0c4b07687b8f89894b151c2b4972684b634fd288784e24f5259d1a4eeb40dc56953655c24d57933a5fcd0c0a4094fda127e0b8e8635aa5b37dd06ff0146369ab189a2bd2ee71f83a001d00205fcd0c0a4094fda127e0b8e8635aa5b37dd06ff0146369ab189a2bd2","tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5","35fa0a83e466acbec1cfbb9016d550ab","725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68","b11cun040_00040016_aa48e2c8","b11cuq050_00050805_650ae0b2"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3152,"t13i1909h2_9dc949149365_97f8aa674fd9":631,"t13i131000_f57a46bbacb6_ab7e3b40a677":4820,"b11cun010_00040000_c4b2c4aa":649,"b11cun040_00040013_608dab68":4317,"b11cun040_00040016_aa48e2c8":6194,"b11cuq050_00050805_650ae0b2":123},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"],"timeline":[{"date":"2026-08-03","count":9},{"date":"2026-08-04","count":32},{"date":"2026-08-05","count":24},{"date":"2026-08-06","count":16},{"date":"2026-08-07","count":16},{"date":"2026-08-08","count":8},{"date":"2026-08-09","count":19},{"date":"2026-08-10","count":16},{"date":"2026-08-12","count":15},{"date":"2026-08-13","count":8},{"date":"2026-08-14","count":26},{"date":"2026-08-15","count":18},{"date":"2026-08-16","count":17},{"date":"2026-08-17","count":16},{"date":"2026-08-18","count":32},{"date":"2026-08-19","count":19},{"date":"2026-08-20","count":16},{"date":"2026-08-21","count":21},{"date":"2026-08-23","count":16},{"date":"2026-08-25","count":16},{"date":"2026-08-26","count":23},{"date":"2026-08-27","count":3},{"date":"2026-08-28","count":9},{"date":"2026-08-29","count":42},{"date":"2026-08-30","count":24},{"date":"2026-08-31","count":8},{"date":"2026-09-01","count":12},{"date":"2026-09-02","count":9},{"date":"2026-09-04","count":26},{"date":"2026-09-05","count":7},{"date":"2026-09-06","count":19},{"date":"2026-09-07","count":23},{"date":"2026-09-08","count":24},{"date":"2026-09-10","count":9},{"date":"2026-09-11","count":9},{"date":"2026-09-12","count":9},{"date":"2026-09-14","count":17},{"date":"2026-09-16","count":8},{"date":"2026-09-17","count":17},{"date":"2026-09-18","count":17},{"date":"2026-09-20","count":8},{"date":"2026-09-22","count":9},{"date":"2026-09-24","count":9},{"date":"2026-09-25","count":18},{"date":"2026-09-26","count":9},{"date":"2026-09-27","count":15},{"date":"2026-09-29","count":50},{"date":"2026-09-30","count":24}],"recent_events":[{"timestamp":"2026-09-30T08:12:25","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"b4eac01c-3fd9-49e9-bddc-2ed31e24fcf3","seq":1,"duration_ms":304,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-09-30T08:12:21","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/y8rtifi61su","summary":"","payload_hex":"474554202f793872746966693631737520485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"430f1958-4973-4d31-b72b-eeb1fbba0346","seq":1,"duration_ms":6835,"bytes_in":175,"bytes_out":78},{"timestamp":"2026-09-30T08:12:11","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"bf73a91f-690d-4780-acb9-1b33e36bd1a4","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-09-30T08:12:06","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ai/site-profile.json","summary":"","payload_hex":"474554202f61692f736974652d70726f66696c652e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"7a7c0926-5e44-48c8-9344-f553917bb67e","seq":1,"duration_ms":102,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-09-30T08:11:40","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"214d7daf-56a8-47f8-8f7d-a67e86051af7","seq":1,"duration_ms":149,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-09-30T08:11:35","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00001804000000000000020000000000040000426800060004000000030000000a","method":"","user_agent":"","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"78d5cd50-9a57-4790-92d7-8e71dfcaf76c","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":13,"enriched":{"digest":"a89d180d93c3b6d2","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-09-30T08:11:30","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:20201\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"761b4949-61df-4c7c-b2c8-d5062cc084c8","seq":1,"duration_ms":652,"bytes_in":164,"bytes_out":78},{"timestamp":"2026-09-30T08:11:21","port":20201,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:20201\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303230310d0a0d0a","method":"GET","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"ed2ba565-dda7-4526-97bc-0015d6a9ae5b","seq":1,"duration_ms":5182,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-30T04:11:12","port":789,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:789\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/1fmc6vbql","summary":"","payload_hex":"474554202f31666d63367662716c20485454502f312e310d0a486f73743a20<HONEYPOT>3a3738390d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"af8d02ad-1416-414f-9c2d-4fcfba486cdf","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-09-30T04:11:12","port":789,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:789\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3738390d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"71bcd206-2510-41a5-a774-e17376bfbb32","seq":1,"duration_ms":101,"bytes_in":179,"bytes_out":78}],"http_methods":[{"method":"GET","count":661},{"method":"POST","count":1}],"distinct_ports_total":84,"top_paths":[{"path":"/favicon.ico","count":273,"ports":77},{"path":"/","count":194,"ports":77},{"path":"/security.txt","count":18,"ports":16},{"path":"/robots.txt","count":16,"ports":15},{"path":"/sitemap.xml","count":15,"ports":14},{"path":"/.well-known/security.txt","count":14,"ports":12},{"path":"/login","count":12,"ports":12},{"path":"/wiki","count":9,"ports":9},{"path":"/app-ads.txt","count":5,"ports":5},{"path":"/ai/site-profile.json","count":4,"ports":4},{"path":"/sellers.json","count":2,"ports":2},{"path":"/version","count":2,"ports":1},{"path":"/r43lifz9my138m","count":1,"ports":1},{"path":"/0teq9al4y9p76ug2","count":1,"ports":1},{"path":"/amjnjpfr0cx","count":1,"ports":1}],"distinct_paths_total":110,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2","count":94}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:20201","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","notable":false}],"distinct_sets":3,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-30T18:59:25.880414+00:00"}