{"ip":"45.156.129.190","total_events":121,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"bitsight","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (bitsight).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,082 bytes sent","bytes_sent":19082,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-13T07:15:20","last_seen":"2026-09-24T09:43:14","events_24h":15,"events_7d":40,"geo":{"country_code":"PT","country_name":"Portugal","region":"","city":"","lat":38.7057,"lon":-9.1359,"asn":211680,"org":"Sistemas Informaticos, S.A."},"source_domain":"sh-chi-us-gd17-wk101c.internet-census.org","known_scanners":["bitsight","Internet Census"],"scanner_tag":{"key":"internet-census","label":"Internet Census","category":"research","url":"https://internet-census.org/"},"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"}],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":21},{"port":443,"proto":"tcp","label":"HTTPS","count":18},{"port":80,"proto":"tcp","label":"HTTP","count":14},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6},{"port":8081,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":2},{"port":24442,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":8554,"proto":"tcp","label":"","count":2},{"port":82,"proto":"tcp","label":"","count":2},{"port":62078,"proto":"tcp","label":"","count":2},{"port":8089,"proto":"tcp","label":"Splunk","count":2},{"port":4848,"proto":"tcp","label":"","count":2},{"port":444,"proto":"tcp","label":"","count":2},{"port":13,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i330500_5172cef6ed69_021165082e1c"],"tls_client_hello":"160301009d0100009903034de808965cda39f710aaac47f26abe08dfbce3698bfbccb3c0767a843518cc63000042c011c007c013c009c014c00a0005002f0035c012000ac024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c01100050004c02bc02f009c0100002e000500050100000000000a00080006001700180019000b00020100000d000a00080401040302010203","tls_ja3":["02f32644e1b0655c19aaa3a2d6778b1e"],"http_akin":["a11cun040_0000004d_aa48e2c8"]},"fingerprint_peers":{"t12i330500_5172cef6ed69_021165082e1c":259,"a11cun040_0000004d_aa48e2c8":2120},"akin_families":{"a11cun040_0000004d_aa48e2c8":{"head":"a11cun040_0000004d_aa48e2c8","shapes":5,"ips":2120}},"user_agents":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"],"timeline":[{"date":"2026-07-07","count":1},{"date":"2026-07-08","count":1},{"date":"2026-07-11","count":2},{"date":"2026-07-13","count":1},{"date":"2026-07-14","count":1},{"date":"2026-07-18","count":1},{"date":"2026-07-19","count":1},{"date":"2026-07-24","count":1},{"date":"2026-07-25","count":1},{"date":"2026-07-28","count":1},{"date":"2026-07-29","count":3},{"date":"2026-07-30","count":1},{"date":"2026-07-31","count":2},{"date":"2026-08-01","count":6},{"date":"2026-08-03","count":2},{"date":"2026-08-05","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-14","count":1},{"date":"2026-08-16","count":2},{"date":"2026-08-19","count":1},{"date":"2026-08-24","count":2},{"date":"2026-08-27","count":3},{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":3},{"date":"2026-09-10","count":3},{"date":"2026-09-11","count":3},{"date":"2026-09-13","count":1},{"date":"2026-09-21","count":3},{"date":"2026-09-22","count":14},{"date":"2026-09-23","count":17},{"date":"2026-09-24","count":6}],"recent_events":[{"timestamp":"2026-09-24T09:43:14","port":13,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:13\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31330d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"486d36d3-6107-44ca-bd33-132b2dd1cfd3","seq":1,"duration_ms":100,"bytes_in":187,"bytes_out":79},{"timestamp":"2026-09-24T09:42:52","port":13,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:13\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31330d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"27fd0759-5853-4e97-aaba-96378f7e140f","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":79},{"timestamp":"2026-09-24T09:12:52","port":9042,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9042\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393034320d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"9b613f25-013c-4693-982f-0bafca1ffea9","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T06:14:15","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"2c13b3b9-ce59-4529-82f0-46617ce47659","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T05:13:18","port":195,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:195\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3139350d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"2940ac92-9b7a-451e-b350-03273ef3c180","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-24T05:04:42","port":2222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2222\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323232320d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"854fd4f3-58f3-4093-933f-e14f9d2020ca","seq":1,"duration_ms":101,"bytes_in":178,"bytes_out":79},{"timestamp":"2026-09-23T22:59:06","port":9001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9001\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"e5471e7d-ae02-491a-9913-fb163bc66f86","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":79},{"timestamp":"2026-09-23T22:46:52","port":137,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:137\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3133370d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"8f08959d-f435-4295-bae7-10cfec0e5c14","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-23T22:28:41","port":4848,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4848\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343834380d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"ee4dbfc4-8a05-4baf-9075-ec263cf00811","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-23T22:28:31","port":4848,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4848\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343834380d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"8328435a-f2cf-48d8-878e-b71d3de8a262","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":79}],"http_methods":[{"method":"GET","count":112}],"distinct_ports_total":51,"top_paths":[{"path":"/","count":44,"ports":29},{"path":"/favicon.ico","count":25,"ports":24},{"path":"/wp-json","count":22,"ports":5},{"path":"/license.txt","count":14,"ports":5},{"path":"/login/login","count":2,"ports":1},{"path":"/api/session/properties","count":2,"ports":2},{"path":"/admin/","count":1,"ports":1},{"path":"/php/login.php","count":1,"ports":1},{"path":"/cgi-bin/authLogin.cgi","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:13","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]}],"data_as_of":"2026-09-24T12:58:24.104483+00:00"}