{"ip":"5.253.57.239","total_events":471,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"73+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 73 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"103,819 bytes sent","bytes_sent":103819,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T12:14:47","last_seen":"2026-10-06T02:38:44","events_24h":246,"events_7d":471,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":212171,"org":"Local NCC Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":19500,"proto":"tcp","label":"","count":12},{"port":5500,"proto":"tcp","label":"","count":12},{"port":12443,"proto":"tcp","label":"","count":12},{"port":13443,"proto":"tcp","label":"","count":12},{"port":29443,"proto":"tcp","label":"","count":12},{"port":8017,"proto":"tcp","label":"","count":12},{"port":16500,"proto":"tcp","label":"","count":6},{"port":8053,"proto":"tcp","label":"","count":6},{"port":45443,"proto":"tcp","label":"","count":6},{"port":21443,"proto":"tcp","label":"","count":6},{"port":42443,"proto":"tcp","label":"","count":6},{"port":9500,"proto":"tcp","label":"","count":6},{"port":8048,"proto":"tcp","label":"","count":6},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":6},{"port":24443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c2010005be03039d62c35013eefcc96e30ab283e4e122885d9861249f9f16bd3198f5a8cfbd50320ed3fd066c3ee0458676752122fe1f9a6e34ed5e9793382354c6a48d90ae5b135001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055b000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c081418997b2236fa3b29cdcc8a25b437d1658628467a1f7905122c401b8214a2c708ddc56c7d9c869119be557462bbabb0d8c5fa967c2240412984564231a88bff0aa70845dfc4c82ccd00e2141b4a19ba0f431111ce67c7e8925c1440bbaba032a53b3487132196a33420b426c8ca071c90419276474023c95733a9d9027ad594c8af5635ef8019568c96540308764699370cbd3e39474c0a2df7b5bd8023d51a9c806698cc30b6c5709532391c9cb1ba3f9650d986356f967ab25a0451d394a59159dd67a12da4a0c40334b62349c64bb21bc08557ec028c107864853686ec4167e63a461b45324243ac898c3ba2c54f7f8cd5bfb363d22b2a8f681c4086dc6ea57abd944ade95ee27432582674ec9223891cb6c4c895ee27a17e028e991b5645a1487500bd559b51bc77070a2689859887d950637bc59f2db26454729553355e6a950667cbcde1bba547ab15d662200c82377c57a5990a07fad9b07e22ac999a20739054feb800de504737e400353470cc28c643b0790f5506d93c3516940cc451258a4991ac80c531097afee57efbec9883a420d3495cab85248cc389ba3bb5e56a926154828f9164a7004aae74a3b531645f75321dc30856738e0002208040678d609019ec09fc2c7cda58b25477a448ebaa01513878e4ceb6546f6a8127d2624e4d878f6f33ce0a079a8d5367fbc49013862a2c4b503712554e864900551e362a15dfa868d5ebbf68c06f097b65cadb054e09222eeccc37216007c7be23354c21d751a42ba1935b7cf46958d8371b3b1637fa70122a52c7601572af444fac2b3a4d2b7fe7b2bdfa7c605f132dc0ab0aa3d7a08e0a67acc37c9aebb8a9795763555ec2756034d989546126de5c88ae42737126be32051931d994cfbbaaeb248098699671490fdd6392482a25573b93608a0a09033f7ed5025300caf9f49924508ded2c1e57c23eda8951c89a3fe2b36b7019a21cbc2f65c0a03e07cefaab07b5087e1503990867aadf62041484b14bebc1c8f562dba12de137a2e1c21fdf536dabe40027050eb8e564aa9238fb09af918b593a332b5a1932127b47fed6427cdb9a32da0568f6cd198284ba9b7054d52f77f6a073e64751d38b12197c54f38de5012919207fc35b6178bbc57d410d66d523e066a21ce550d4321874fc1f71639616ca11054216bb4c28cc569e53644753d5b7ef44cf419302b09684a99846b291202f89ad29987b58404e939045c56689b1482c2a6717525c219fe459f482cc50fc6fd16970bed749dc4404372417c1171980862f8dfc1565e4c02127bf74fb1e62e773f357a2a2778ccebcadf64347e5890c1db956a758058186c10ea18938ca5294b08bca63cac6c38fa0dc17acc9992f02267b8086f2f566e4bca4e0f92f074b2cd9473789694863c036924762c9952eab85261dd030ab44c4fb22b016f28f88a18334360d54d34297bb2db513655f528187ebbdda53a0c98752f32aa41a27663d8146ece19640e78c808676274a124129c02d033104752157cccec41cc64f996f0d5b21d73c33d52513b0f8814edb37ac846514aa211a9b9652182b0be0bedae966970130657705c7636d3ffb89d759b4287a4dd12aaab2525f481897fb3a01f345917d56284b162f3af76faf328d00f3c2b984d695c8512430c1f6d52996715e07281461bcbe45809a6b1a6ef31b83d323d8e3f0b731868dc7bf6b53001d00202996715e07281461bcbe45809a6b1a6ef31b83d323d8e3f0b731868dc7bf6b53","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3845,"b11cun040_00040013_608dab68":4393},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"],"timeline":[{"date":"2026-10-05","count":243},{"date":"2026-10-06","count":228}],"recent_events":[{"timestamp":"2026-10-06T02:38:44","port":8044,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"4c14e434-3ae5-4f9c-861a-19ac4f71086e","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":77},{"timestamp":"2026-10-06T02:38:44","port":8044,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"4b59e7b5-c247-4172-8ce2-9fa5aa4db782","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":77},{"timestamp":"2026-10-06T02:38:44","port":8044,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"ce167111-4429-472e-a0d9-fb85e07d3cc4","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":77},{"timestamp":"2026-10-06T02:38:43","port":8044,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"76075951-6819-41f2-980c-8c5b449d1d81","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":77},{"timestamp":"2026-10-06T02:38:43","port":8044,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"5bce7bb0-55a9-4b57-80c9-20e44af3cecb","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":77},{"timestamp":"2026-10-06T02:38:43","port":8044,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8044\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383034340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"ee7dc78d-83e4-485f-9fb5-1bb3bccd033d","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":77},{"timestamp":"2026-10-06T02:35:12","port":6500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"909af9dd-b3fd-4f37-a90c-66fe7e5100a3","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":77},{"timestamp":"2026-10-06T02:35:12","port":6500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a363530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"f8e241f7-6792-4f45-8055-e2a46de8afa3","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":77},{"timestamp":"2026-10-06T02:35:12","port":6500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a363530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"","session":"39652f14-9b53-40ea-9a2e-61f64f996bb1","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":77},{"timestamp":"2026-10-06T02:35:11","port":6500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a363530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"9675d1a0-4b5b-4eea-95a3-b2842a46a341","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":77}],"http_methods":[{"method":"GET","count":471}],"distinct_ports_total":73,"top_paths":[{"path":"/","count":157,"ports":73},{"path":"/remote/login","count":157,"ports":73},{"path":"/RDWeb/Pages/en-US/login.aspx","count":157,"ports":73}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8044","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-06T20:37:11.011568+00:00"}