{"ip":"5.253.57.238","total_events":417,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"66+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 66 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"91,882 bytes sent","bytes_sent":91882,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T12:12:06","last_seen":"2026-10-06T02:37:52","events_24h":213,"events_7d":417,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":212171,"org":"Local NCC Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":8031,"proto":"tcp","label":"","count":12},{"port":54443,"proto":"tcp","label":"","count":12},{"port":8082,"proto":"tcp","label":"","count":12},{"port":29500,"proto":"tcp","label":"","count":12},{"port":36443,"proto":"tcp","label":"","count":6},{"port":8001,"proto":"tcp","label":"","count":6},{"port":8015,"proto":"tcp","label":"","count":6},{"port":8003,"proto":"tcp","label":"","count":6},{"port":8004,"proto":"tcp","label":"","count":6},{"port":25500,"proto":"tcp","label":"","count":6},{"port":61500,"proto":"tcp","label":"","count":6},{"port":59443,"proto":"tcp","label":"","count":6},{"port":7500,"proto":"tcp","label":"","count":6},{"port":39443,"proto":"tcp","label":"","count":6},{"port":64500,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c2010005be03039f5844782de55f661536802dc5077cbb7e30293dd35099dbda5b665b32425aa120b3b458368c4a128405147b7baf2b533938c42760ba811d05e6be9d36b3072f18001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055b000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c061616dee670cf5000aa930cde813aadfda372bb66758052fdf550ba4aab1118082c1955d0c9a9817da53f908b31f3c86f6c37b1356826854c8b6f22681802f9e910d5576a5d56a271c02a092509e27662d74d917d9b2c6b90a4f9813bc9b76b6e30b91ba064a46660c05828bacc5b19366c831a9b64dc0b74315359aa768ffc2918ada864363b5a66a1333f9b1c653140d5019e5e06a35485785f54a3760605a65ab1f58cad3d60f6be50da80a76786550b862719934a601e6bef87b2613fc93f77025bd654b57477f8862abe91220fbe29634221edfc48c6eb52023b2600f828c9ac1889ab2578b5b439c352e04c6b061c061a7b94f5061a405c85c6f290de24b00408668fde43c2de3a7aae482b3b581d4db582bea13c754400334583c2981d405656b907bbbc44adf99222f71bfee4552797bbbc6ecc786d0c3c88791636704a7d51d7c23b42fa538be6953d3f7317b86b63553676039798b0a738d3a980ee36bf9a5c86d7533ecfacf95745a540607a105279e77723e5237d5cb19f5478a5a7724a2e52c9105c80e74907a9746712117e2c91582853e5b4a0fdf15483de978e3c44c3b0285ee517ff1a91f10e075a8ea22f3942a62748aded6810edb7b19b0362e5b29d03371cfe76dfaa34ce92a6f5a6559dde27ddfe4599b94286ce0bbd8233f9c5c6f1283488876be386127f1dcb8ddf98801440fd1946af99ba4b7617ae5a747f596109b7b9c58fb02d725ceec57ba68f8693a493f27d20a488b431cf5087d22b31d668ea8839694c02a7888c6d0e575a89937bf786115107a77471f7e7c94cda3268f74c7485a2b7beb93d404183a243ab59118c095a45d52c805337d195716cd287aa9257c951b7bc17a1c3d090995b27fdc58cdbdc8a0c14120bf42a65623637db394a10345a79a1f93f87f04170bfed9574e6c910b753958638303240009b03c9844c8bea66790b99f239026872821dca52d03c32bb349ca307796c628b8a04c34b78188c241788c752a71c465830aa55514b4b6c310ac2114fe760928f499a3b336ab15386bf4c9c730c23a605fbf2175c5d4ab3ff57f4b70b738a400ee925f96e8326e949a049b68a67ba6e80027c6c590cde2abefd2153a103a0ff38baafccd22c33c69a0ae6ce5c2f5520a99ab2a1db78bc2925e9c78cd76524f0b306097f0752d3a159150ba1f10bdad441b15a07000322b17e83223047c472084b3850c96e673f017ac9cb2a19728ccdf7430671157a439925c6a1d7170811c0028d1fc915d842eeaf0abc40aba25a2a2e35152ff6828ffc221e4633ab46b97707a372e37ac8614c3214275c503551f4035e448163e48669c0c877cd09f62d1216dc99d98046c30538a71f4cfecb9688e55babad787b55480c6810a5ee049b91910cc8bb71a489e22841bcfa6b9e0903c50d3a96f82264a5362effa7f482102728c79d0d7a2b52533411059390a33a9ec6da3c05ad7900895e7374e4b390df88cbfbba20ba516bf617f6616675df616684b1908b61cde939dd2360a69c657678a59c31a3f420864d3284c19f25fe7845006b65ed1511b1c70381bb3b16a9788cc72c9897a26ce42b3e1e47f0d731bd2092184f6ccec23468cb1a06c921bc9985534a97a0023abf7e8ef76067643c15db4dd5b4357f75bd790b5b6e4f5b8a89cf4bdb052772085f34def66c320ea2890f2e38e30fd3ddc0761699110fb12001d0020a89cf4bdb052772085f34def66c320ea2890f2e38e30fd3ddc0761699110fb12","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3845,"b11cun040_00040013_608dab68":4393},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"],"timeline":[{"date":"2026-10-05","count":216},{"date":"2026-10-06","count":201}],"recent_events":[{"timestamp":"2026-10-06T02:37:52","port":59500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"7797dcdb-4099-45b5-82ab-9437962f4755","seq":1,"duration_ms":100,"bytes_in":235,"bytes_out":77},{"timestamp":"2026-10-06T02:37:52","port":59500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"6633b80f-c7b2-4733-b4bb-26a090b24411","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":77},{"timestamp":"2026-10-06T02:37:51","port":59500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"a4434c17-e0ac-49ff-baaf-0876504b7b1d","seq":1,"duration_ms":101,"bytes_in":235,"bytes_out":77},{"timestamp":"2026-10-06T02:37:51","port":59500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"5cce6450-d6ca-4454-b082-37c33c8ac181","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":77},{"timestamp":"2026-10-06T02:37:51","port":59500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"6a62a059-382b-43fe-b362-76dec444af99","seq":1,"duration_ms":100,"bytes_in":207,"bytes_out":77},{"timestamp":"2026-10-06T02:37:50","port":59500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:59500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"8443dd39-1365-47d1-8576-61c699937e15","seq":1,"duration_ms":101,"bytes_in":207,"bytes_out":77},{"timestamp":"2026-10-06T02:34:47","port":11443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"9a3a32c4-4097-40bd-9680-8b727d114e1a","seq":1,"duration_ms":100,"bytes_in":235,"bytes_out":77},{"timestamp":"2026-10-06T02:34:47","port":11443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"920ec22d-7c6d-4bf3-8b31-fc57bee5ec95","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":77},{"timestamp":"2026-10-06T02:34:46","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"2f75016c-0753-45e7-94c4-bb2406d4b793","seq":1,"duration_ms":101,"bytes_in":235,"bytes_out":77},{"timestamp":"2026-10-06T02:34:46","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"3c92ec14-9c58-436c-8e23-bacd8a4d3200","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":77}],"http_methods":[{"method":"GET","count":417}],"distinct_ports_total":66,"top_paths":[{"path":"/","count":139,"ports":66},{"path":"/remote/login","count":139,"ports":66},{"path":"/RDWeb/Pages/en-US/login.aspx","count":139,"ports":66}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:59500","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-06T20:37:15.512773+00:00"}