{"ip":"204.76.203.31","total_events":206,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"134,414 bytes sent","bytes_sent":134414,"session_seconds":7,"persistent":false}},"first_seen":"2026-09-18T00:55:03","last_seen":"2026-09-23T10:51:07","events_24h":12,"events_7d":206,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"private.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":32},{"port":80,"proto":"tcp","label":"HTTP","count":22},{"port":3000,"proto":"tcp","label":"Web-alt","count":22},{"port":443,"proto":"tcp","label":"HTTPS","count":22},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":22},{"port":2087,"proto":"tcp","label":"","count":18},{"port":2096,"proto":"tcp","label":"","count":18},{"port":2086,"proto":"tcp","label":"","count":18},{"port":2083,"proto":"tcp","label":"","count":18},{"port":8089,"proto":"tcp","label":"Splunk","count":5},{"port":6379,"proto":"tcp","label":"Redis","count":5},{"port":8983,"proto":"tcp","label":"Solr","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_0000004a_c91eaf54"]},"fingerprint_peers":{"a11cun030_0000004a_c91eaf54":67},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":67}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","Go-http-client/1.1","Mozilla/5.0"],"timeline":[{"date":"2026-09-18","count":162},{"date":"2026-09-19","count":25},{"date":"2026-09-20","count":7},{"date":"2026-09-23","count":12}],"recent_events":[{"timestamp":"2026-09-23T10:51:07","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$3\r\ndir\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a24330d0a6469720d0a","method":"","user_agent":"","ja3":"","session":"5be9dc34-5910-4485-8de3-c9f81cfb05f6","seq":3,"duration_ms":494,"bytes_in":62,"bytes_out":17,"enriched":{"digest":"6e396dc600a391e2","label":"Redis (RESP)","strings":["CONFIG"]}},{"timestamp":"2026-09-23T10:51:07","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$10\r\ndbfilename\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a2431300d0a646266696c656e616d650d0a","method":"","user_agent":"","ja3":"","session":"5be9dc34-5910-4485-8de3-c9f81cfb05f6","seq":4,"duration_ms":691,"bytes_in":104,"bytes_out":22,"enriched":{"digest":"ae7a954eba732d9f","label":"Redis (RESP)","strings":["CONFIG","dbfilename"]}},{"timestamp":"2026-09-23T10:51:07","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nKEYS\r\n$1\r\n*\r\n","payload_hex":"2a320d0a24340d0a4b4559530d0a24310d0a2a0d0a","method":"","user_agent":"","ja3":"","session":"5be9dc34-5910-4485-8de3-c9f81cfb05f6","seq":5,"duration_ms":889,"bytes_in":125,"bytes_out":27,"enriched":{"digest":"480c4fe5136f83f7","label":"Redis (RESP)","strings":["KEYS"]}},{"timestamp":"2026-09-23T10:51:06","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"5be9dc34-5910-4485-8de3-c9f81cfb05f6","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":7,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-23T10:51:06","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"5be9dc34-5910-4485-8de3-c9f81cfb05f6","seq":2,"duration_ms":297,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-23T10:49:53","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f3634292048696768506572665363616e6e65722f3130470d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","ja3":"","session":"9c60c3eb-6c91-4567-a0d2-1c5cdb79f27e","seq":1,"duration_ms":100,"bytes_in":128,"bytes_out":78},{"timestamp":"2026-09-23T10:49:53","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f3634292048696768506572665363616e6e65722f3130470d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","ja3":"","session":"336c40ab-e48b-41bc-b779-5f84d36a994a","seq":1,"duration_ms":102,"bytes_in":128,"bytes_out":78},{"timestamp":"2026-09-23T10:49:53","port":8983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:8983\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a383938330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f3634292048696768506572665363616e6e65722f3130470d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","ja3":"","session":"10a8c255-4047-46cf-9328-7f251f81396c","seq":1,"duration_ms":100,"bytes_in":128,"bytes_out":78},{"timestamp":"2026-09-23T10:49:53","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f3634292048696768506572665363616e6e65722f3130470d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","ja3":"","session":"bb6ac6fa-9021-4ce0-b9b2-03eb203981d2","seq":1,"duration_ms":101,"bytes_in":128,"bytes_out":78},{"timestamp":"2026-09-23T10:49:53","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f3634292048696768506572665363616e6e65722f3130470d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","ja3":"","session":"bd5c6333-0d7f-423f-837e-dda20c5352b6","seq":1,"duration_ms":101,"bytes_in":126,"bytes_out":78}],"http_methods":[{"method":"GET","count":192},{"method":"POST","count":9}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":46,"ports":11},{"path":"/?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F","count":20,"ports":9},{"path":"/?target=http%3A%2F%2F169.254.169.254%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fapi%2Ftoken","count":10,"ports":9},{"path":"/?url=http%3A%2F%2F169.254.169.254%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F","count":10,"ports":9},{"path":"/?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/?url=http%3A%2F%2F169.254.169.254%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/?page=http%3A%2F%2F169.254.169.254%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/?page=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F204.76.203.31","count":10,"ports":9},{"path":"/env","count":9,"ports":9},{"path":"/management/env","count":9,"ports":9},{"path":"/q/health","count":9,"ports":9},{"path":"/actuator/env","count":9,"ports":9},{"path":"/.git/config","count":9,"ports":9}],"distinct_paths_total":17,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":7}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"192.3.118.146:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) HighPerfScanner/10G","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-23T15:10:32.090815+00:00"}