{"ip":"5.253.57.10","total_events":382,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"62+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 62 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"84,170 bytes sent","bytes_sent":84170,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T12:12:48","last_seen":"2026-10-06T02:33:01","events_24h":189,"events_7d":382,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":212171,"org":"Local NCC Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":15443,"proto":"tcp","label":"","count":12},{"port":8055,"proto":"tcp","label":"","count":12},{"port":8026,"proto":"tcp","label":"","count":12},{"port":8045,"proto":"tcp","label":"","count":9},{"port":33443,"proto":"tcp","label":"","count":6},{"port":48443,"proto":"tcp","label":"","count":6},{"port":444,"proto":"tcp","label":"","count":6},{"port":7500,"proto":"tcp","label":"","count":6},{"port":8014,"proto":"tcp","label":"","count":6},{"port":18443,"proto":"tcp","label":"","count":6},{"port":47500,"proto":"tcp","label":"","count":6},{"port":8048,"proto":"tcp","label":"","count":6},{"port":8049,"proto":"tcp","label":"","count":6},{"port":45500,"proto":"tcp","label":"","count":6},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c2010005be0303ad9c078faa9c20462cb07fa90d4677e3b33434ce0aad5f6c59ddd4980380d9e820b453ac2f28730a0e2033cd466a5753f7606ed28896830d53c9da3b63fe2d9dc9001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055b000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c01af0512c5ab786095229a51adf342561b1779bda07f1aba14b3cc935a6377a77ac09992d0779460e2113b73b74b20bb1630c97bf53bf2a623ea3324f34d9253527428e7733f6c56b0a0c540f978b42f790b526c2449c59e0f86669585d794998c25c76e8378f207a54a43036ba5771938ca2d99764c352125ef5a865990bbee05dbd85a0cc542c82fb9bcac116797023dc588358e5557b8319cca00bb7ca5b57529506c66411f3b38ca6965901c778a05a28ec2201d4827895a699ab272d040a43470d18dcb3b6694744987ed620379b921b20377f5cb166b064473250c9cb0300a56c2341d8a5f3936eb9d4a3f3bc0318f257737128b7150dbd8c86203aa7b7002118c171639b70507c5e12b14c40230c003495957c66cbca156b2342e56a8231a54f7f435f710c681c019395459e4d3649b5fc65c54608e1850726a9338f15cecbab7332e29d5180a01d9755e4b069e7e9779b5a825696b887392186f516a51597e5d571ae27156d4734afbb82083a4586f03d32cb3aa7341143a46316466a6c31a9f4b015ad09bcc51a8359768ca9189daee3cc378c25adc01eb069929db53ceda024d617a6043171d544b3051986515757cea02156fc308a93b96e36a2e4310ce7030168244e34f52ae294053b577fd31045d8e8a841a34eb03c6643293e10319d828aa95847ad5b699462eb4e6530b1e3f52b935958e08313ce2437e1208f10d37c1e9b9d93f12adaebc0981b1a131cbbb7c30ad83a8b04a92184f39c6e59ac897b570450ae3eb24f1b7790c93a0254b864ff580b4c253934eacd609c979c124a732a84690738c222a96f01b7fb743ce592b92a617c7b22567699be06628b45ab0f5bc0cced622622b412e0887627453fd83b617be15ca27b99a3409a854c676c2bc05321159cc454d75a8a308b834f023cc7622b12ccc2380a50fdf0a4ff069059a832742082cd0644376888f4105b15250d0a23ceafc30263d52f47d7b763355f5618ad9cf1cd96e3a4c8e43e6ca0537d88939f982981986295ecaaa5b721ddf001f4a85128e6762165689223850819812ab141811703ba0c5b3dd4b864f128b3237261d9834ed5bb8e6a5ba81a75daf6284b375b521c5a98e72449e82fab826c9cbb7e7d224495919d90882bb166c9036458230b41d022acedfaca60903deba77bfbc72db6aa268d17730d0b54ee9bc034317c50c89187fc12225730b6a6b7a5d7a8888494b532730204bad7bb64f8794cd8f8a98af29b75a38f28f822d0f65795d5c09ef7c1241607ceb29d5c3b088c08a1ed14239cb3097b9a0d795ac67076774d0c880a03ad59a4c4076240506787b50a12547415335b188f9228ac25120972cb3748093f7194f214c2362c210dd677c6d1483f38024cab40ea00599e1548de3b73e5c9742ed2735996cf883573fd83b9bc67a538f32637209256454bd8443d7e191db6305cf5b35ee35532c163123b64829a8bbd778bb51443101d886348d0b3e7e6931259618a4540793812aa849ca57b7dc18532019cba0865b567f539a47ac8e260af5c4ab52dabcb4e434fd188939c96874463acb64b9ec07aa3d64115d310988cc270ce53868a019e26c49640ea1df1cb19dc0771c77035e16b1a2c7e4b8642ec9de000ec3a5d3df9516c16d3b56b60f2511b1b41a6a59dcb64962386b95e3c8880185bd7ecc7f112274c878766316ba76bac4d9bf09104001d0020cb64962386b95e3c8880185bd7ecc7f112274c878766316ba76bac4d9bf09104","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3845,"b11cun040_00040013_608dab68":4393},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"],"timeline":[{"date":"2026-10-05","count":193},{"date":"2026-10-06","count":189}],"recent_events":[{"timestamp":"2026-10-06T02:33:01","port":8027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"a74c352e-faa4-45e6-ae03-7ff95549577f","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:33:00","port":8027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"56041fed-f711-427d-b2da-a2ea9e99886c","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:33:00","port":8027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"c1fb5fdd-d3b2-41a5-b438-58ef22e5c55b","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":76},{"timestamp":"2026-10-06T02:33:00","port":8027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"9baf87f8-c769-4d16-86d3-be2b589f8b6c","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":76},{"timestamp":"2026-10-06T02:32:59","port":8027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"56f8f7e2-7c82-40a1-9172-3aed81ceff6f","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":76},{"timestamp":"2026-10-06T02:32:59","port":8027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8027\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383032370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"ea167cc5-c5a4-42e8-bdbd-af4596da4549","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":76},{"timestamp":"2026-10-06T02:32:04","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"1f6c282b-95a2-4f4f-a1dd-1850f7298240","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:32:03","port":8090,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"ee26123e-610c-457f-b817-c8595ad8f1ab","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:32:03","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"60326e88-9756-47b7-9384-38d00d381f43","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":76},{"timestamp":"2026-10-06T02:32:03","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"ac8e73af-2b1a-46aa-a085-27f11b55bcb1","seq":1,"duration_ms":101,"bytes_in":234,"bytes_out":76}],"http_methods":[{"method":"GET","count":382}],"distinct_ports_total":62,"top_paths":[{"path":"/","count":128,"ports":62},{"path":"/remote/login","count":127,"ports":62},{"path":"/RDWeb/Pages/en-US/login.aspx","count":127,"ports":62}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8027","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-06T20:37:22.149139+00:00"}