{"ip":"23.94.67.174","total_events":157,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"31+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 31 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"65,821 bytes sent","bytes_sent":65821,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-15T02:56:45","last_seen":"2026-09-27T07:17:53","events_24h":0,"events_7d":153,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":36352,"org":"HostPapa"},"source_domain":"23-94-67-174-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[{"cve_id":"CVE-2026-56681","title":"9router <=0.5.4 - Authentication Bypass","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/models"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":11},{"port":8081,"proto":"tcp","label":"","count":9},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":9},{"port":1234,"proto":"tcp","label":"","count":8},{"port":7860,"proto":"tcp","label":"","count":6},{"port":8001,"proto":"tcp","label":"","count":6},{"port":3000,"proto":"tcp","label":"Web-alt","count":6},{"port":9997,"proto":"tcp","label":"","count":6},{"port":9000,"proto":"tcp","label":"Web-alt","count":6},{"port":11434,"proto":"tcp","label":"","count":6},{"port":9090,"proto":"tcp","label":"Prometheus","count":6},{"port":5000,"proto":"tcp","label":"Web-alt","count":6},{"port":20128,"proto":"tcp","label":"","count":6},{"port":5001,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun040_0000004b_d76a48e1"]},"fingerprint_peers":{"a11cun040_0000004b_d76a48e1":2},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) OpenAI-Exposure-Scanner/5.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) OpenAI-Exposure-Scanner/6.4-Go"],"timeline":[{"date":"2026-08-15","count":4},{"date":"2026-09-25","count":96},{"date":"2026-09-27","count":57}],"recent_events":[{"timestamp":"2026-09-27T07:17:53","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"be169b33-d548-4b10-9f9d-4c2265350dbe","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":1080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"f7209bb8-bb43-4405-8cc0-16a6003c5bf2","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"6339487a-a717-4efc-877f-a218cea6fc7d","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"3e4c7ba2-2117-413e-a342-9e96db749957","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"f9bebae4-0e4f-4a3c-a5e1-8ab091c3043f","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":9050,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"23011609-47fd-408c-8ca5-2dc7c556d4b8","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":8000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"771c8030-52b6-4f76-b579-1e4d43bae3ac","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":1081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"4503fc7a-c22f-41d7-bdd8-05bd82919f62","seq":1,"duration_ms":103,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"d22bf55e-d668-478f-a4e3-ac9af87a06b6","seq":1,"duration_ms":103,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-09-27T07:17:53","port":8888,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000Pg�Z�\u0000","payload_hex":"0401005067b05a8c00","method":"","user_agent":"","ja3":"","session":"c8217e20-c9de-404c-832e-d0e7fb63b8c9","seq":1,"duration_ms":103,"bytes_in":9,"bytes_out":12}],"http_methods":[{"method":"GET","count":100}],"distinct_ports_total":31,"top_paths":[{"path":"/api/v1/models","count":18,"ports":16},{"path":"/v1/models","count":18,"ports":16},{"path":"/models","count":16,"ports":16},{"path":"/v1/tags","count":16,"ports":16},{"path":"/api/models","count":16,"ports":16},{"path":"/api/v1/tags","count":16,"ports":16}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2026-56681","tag_type":"cve","title":"9router <=0.5.4 - Authentication Bypass","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/models","reference_urls":["https://github.com/advisories/GHSA-5mj8-gf6m-fhw8","https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8","https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3","https://github.com/decolua/9router/releases/tag/v0.5.6"]}],"data_as_of":"2026-09-28T20:50:21.677660+00:00"}