{"ip":"31.42.177.96","total_events":213,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Shodan","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (Shodan).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"35,048 bytes sent","bytes_sent":35048,"session_seconds":7,"persistent":false}},"first_seen":"2026-08-03T04:30:03","last_seen":"2026-08-10T02:13:23","events_24h":0,"events_7d":149,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Haarlem","lat":52.3803,"lon":4.6422,"asn":43641,"org":"SOLLUTIUM EU Sp z.o.o."},"source_domain":"census8.shodan.io","known_scanners":["Shodan"],"scanner_tag":{"key":"shodan","label":"Shodan","category":"commercial","url":"https://www.shodan.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":6},{"port":636,"proto":"tcp","label":"LDAPS","count":6},{"port":6514,"proto":"tcp","label":"","count":6},{"port":8767,"proto":"tcp","label":"","count":6},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":1526,"proto":"tcp","label":"","count":4},{"port":3000,"proto":"tcp","label":"Web-alt","count":4},{"port":554,"proto":"tcp","label":"","count":4},{"port":8200,"proto":"tcp","label":"","count":4},{"port":1293,"proto":"tcp","label":"","count":4},{"port":6697,"proto":"tcp","label":"","count":4},{"port":18562,"proto":"tcp","label":"","count":4},{"port":9051,"proto":"tcp","label":"","count":4},{"port":1433,"proto":"tcp","label":"MSSQL","count":4},{"port":445,"proto":"tcp","label":"SMB","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d871100_c66346c74e42_ec21bdc2dd35"],"tls_ja3":["b4ea11096f7863635e34be81fc2725bd"],"ja4h":["ge11nn0200_3ed38b250d3d"]},"fingerprint_peers":{"t13d871100_c66346c74e42_ec21bdc2dd35":5,"ge11nn0200_3ed38b250d3d":1424},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-03","count":2},{"date":"2026-08-05","count":62},{"date":"2026-08-09","count":68},{"date":"2026-08-10","count":81}],"recent_events":[{"timestamp":"2026-08-10T02:13:23","port":5500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"2d1b6e88-8c22-4838-9087-4f4095e139f2","seq":1,"duration_ms":201,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-08-10T02:13:11","port":5500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"ed4b4da8-9c17-4321-8d74-9be174f4f630","seq":1,"duration_ms":201,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-10T02:12:51","port":8000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"6da4292c-cd0b-4a0f-a214-afee4a24979d","seq":1,"duration_ms":198,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-08-10T02:12:40","port":8000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"f9df2cc3-f9a4-4604-8c45-22ec632cee29","seq":1,"duration_ms":198,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-10T02:12:03","port":18562,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"9f03465e-e7d8-4305-8564-f9c0547c0a9d","seq":1,"duration_ms":198,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-08-10T02:11:51","port":18562,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"e2ac2d54-89d1-48b8-a347-acdf896b8a7d","seq":1,"duration_ms":196,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-10T02:11:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"94e0ea2d-9649-42bf-9c45-fd4dde570219","seq":1,"duration_ms":197,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-08-10T02:11:34","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"7307f069-ae3b-405c-be09-c22c1a2af369","seq":1,"duration_ms":196,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-10T02:11:29","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"a2863bca-f42b-466d-b71e-4a2bdbfee51d","seq":1,"duration_ms":197,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-08-10T02:11:29","port":115,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"b4ea11096f7863635e34be81fc2725bd","session":"004d7e3e-4771-499f-bd4f-dd98375e163e","seq":1,"duration_ms":198,"bytes_in":171,"bytes_out":77}],"http_methods":[{"method":"GET","count":211}],"distinct_ports_total":85,"top_paths":[{"path":"/","count":108,"ports":84},{"path":"/favicon.ico","count":103,"ports":81}],"distinct_paths_total":2,"top_snis":[{"value":"localhost","count":210}],"top_hosts":[{"value":"localhost","count":208}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host","User-Agent"],"representative":[{"name":"Host","value":"localhost","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-14T16:55:20.897916+00:00"}