{"ip":"5.253.57.18","total_events":431,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"68+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 68 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"94,965 bytes sent","bytes_sent":94965,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T12:11:45","last_seen":"2026-10-06T02:29:23","events_24h":189,"events_7d":431,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":212171,"org":"Local NCC Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":27443,"proto":"tcp","label":"","count":12},{"port":14443,"proto":"tcp","label":"","count":12},{"port":8021,"proto":"tcp","label":"","count":12},{"port":62500,"proto":"tcp","label":"","count":12},{"port":39500,"proto":"tcp","label":"","count":12},{"port":41443,"proto":"tcp","label":"","count":10},{"port":36443,"proto":"tcp","label":"","count":6},{"port":8003,"proto":"tcp","label":"","count":6},{"port":28443,"proto":"tcp","label":"","count":6},{"port":8009,"proto":"tcp","label":"","count":6},{"port":16500,"proto":"tcp","label":"","count":6},{"port":38500,"proto":"tcp","label":"","count":6},{"port":45443,"proto":"tcp","label":"","count":6},{"port":8011,"proto":"tcp","label":"","count":6},{"port":4430,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c2010005be03030b80f45ad1ea74ec6901cf9aa4df0e3f56b893d1d5e4b115a252020755cb776a20d854631b74a0f587bce073c386b1edec6612b9355f1358cd99e21e68d627d3a8001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055b000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0c17163ab741943432d3019425055cec85c621e57048fe6611ff92e0cd8495bc4915a7a1365736ba8358e465c1854446e045128aa937bd75149812b8d26057a81c792c952bd6380066f776e71a53511199cfd5ba6652020cf7359d820ccf62b1cfde748e1f70df185b529d82716fc323078b6a4803c1a7499066b25eb756166f83e7b89be4b6957db174f32a754b9d01d96538d2f5077193c05d839585f17c78f55aca82a704ffabf08f6779bb9a9c2a0afd0db94992029873a0bdef2c8b974bbf68c4d6f2957bf931cd16432a78c273ea1c4c082164e921bc6a4941a53892b55c17fba14e36bc9c5974b36945372e12d2d3896b8ac1ceb205a925c1ac0a6c704c63b014b72a6066aaf595d49b84e56d62ae54500afaa9f2e1b459641c5fc1aa854d3c7c354b0bc4c3638548da9a37cb2961fd5201a204c7ec65a0910b0163b1a7a516c853d7959e465568dccb66905285dd85a2b5c6a3813ce39c2681a74cd6deb589bd905e3aa2795585017ea88d68643c49a128bc42d44c151f4bc8cfae48b1a1b0a882b0930161c6d576f378b7a34e32756d05e92386341c8b7a6f73085d33260d9cccf56c699b1ab0c25a8c52841f74c6788522b2cc6afa23572e82774fab92cfab8c32ceb1c963b300fbc93474b1835657736eb556ac2c1f9304da20481ea323c8caba707a4c7dfbb35cfc51b158c0a54a691a3c44d2158cb6fbcc961b3a8248627a5a71221f16c5cda00f8177f2c31449d2702bb5ba56392993803b824245c36596c1ed79068002ea1a95ee9785e43ea2f1d1901ac8a328a05910c622e0817329653b8dad3c7b3d269102ac438000b0485210652801eda18ff6c8b396936fcc47700c2c12543397c151d25c02aa4179115150cfe8874bb449d0d6ca613d975c8c778f239206e96805a300e9c031ab07ac6fe4c9547f471364811e4376570aa982967024f7c6e668017ddea910bf4052c5046452586278ab0782238a89c40d552570c8a17c3857fb22795d3fc480c0c4902a6924028406a59c7b0571621a0b0576890a0589bc88b258b25885649c158870232f8792dfc142e66815620aa8eeb7fb0b352962045f2437760e75041e64adbba3d72d0bd7389a5af5a072ef03cb2e330a50123ea5a03c1959aa362480160cee87a9642c88a41bbc09bd952e783476130408c6662e0419fca766367c7735d66a38c58657e9c4721b77e7bbbc7e2c343a0332fc0563660ebaa38b054bdf594c85781dfe20e58a5c6a4d581fc4817e4fc5cb3d000763aa88d987ec91710479867a715879c03c91fd0a062f4725fba61d1786e1c220e7b3b5abf46187a58a04cd4c4a7acb23135b0c346314129128fac868ec06275701fe2c04ec398a10aa8403400be0e45443a943a89800464f5020af51626f02de49a9555232367eaa377ec4f960808504231041a51533b2844330660dc7461658ebd7c4b60f76e9bf90868155017882cf55374a6e016664acacf4a4ab5575b66281dc53a64bb094bb2882db0836e176a9a06fb295f0aa6af95763bd871aae890fe0c6b11982e7a7a6a36bb9aa5e667bb2658d76833344c866b47799005354311459d531de4509d32838791aa51b33895eb17ccf3f07284fb1350bdc639674a35453c21c27b3b887205cc48bce73b9256b0e66bb81b7d8555dde7866af86d8a8be015b1af22f0965a71f38e3b41e6e97178d3b6502686558b05001d0020e7866af86d8a8be015b1af22f0965a71f38e3b41e6e97178d3b6502686558b05","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3845,"b11cun040_00040013_608dab68":4393},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"],"timeline":[{"date":"2026-10-05","count":278},{"date":"2026-10-06","count":153}],"recent_events":[{"timestamp":"2026-10-06T02:29:23","port":8038,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"2ffeb2b1-5998-4990-a3c8-67ab94102a75","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":76},{"timestamp":"2026-10-06T02:29:23","port":8038,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"83e338b5-a288-4867-8ed0-332946e5abf4","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:29:22","port":8038,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"b5ab265b-72ad-4f72-9dd4-9592050568da","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":76},{"timestamp":"2026-10-06T02:29:22","port":8038,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"25b1fcc7-6037-47b3-a3e1-dd9cf4691c18","seq":1,"duration_ms":101,"bytes_in":218,"bytes_out":76},{"timestamp":"2026-10-06T02:29:22","port":8038,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"61fc4f22-9671-4b17-b98b-bbb41226d273","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":76},{"timestamp":"2026-10-06T02:29:21","port":8038,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8038\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383033380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"f6d91f1a-76c5-453a-b04a-13fe93afb26f","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":76},{"timestamp":"2026-10-06T02:20:09","port":27500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"fa475dea-51fa-42c5-a72c-e73d218d89bb","seq":1,"duration_ms":100,"bytes_in":207,"bytes_out":76},{"timestamp":"2026-10-06T02:20:09","port":27500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a32373530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"8a862cfa-267e-49c9-a125-487cd5b74429","seq":1,"duration_ms":100,"bytes_in":235,"bytes_out":76},{"timestamp":"2026-10-06T02:20:09","port":27500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"460aa8e4-2f81-4dc1-b8c4-25d3a1117fa0","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":76},{"timestamp":"2026-10-06T02:20:08","port":27500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"42a285f4-1ecd-48ed-8984-08c2adedad6d","seq":1,"duration_ms":100,"bytes_in":207,"bytes_out":76}],"http_methods":[{"method":"GET","count":431}],"distinct_ports_total":68,"top_paths":[{"path":"/","count":145,"ports":68},{"path":"/remote/login","count":143,"ports":68},{"path":"/RDWeb/Pages/en-US/login.aspx","count":143,"ports":68}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8038","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-06T20:37:20.675328+00:00"}