{"ip":"66.132.195.163","data_as_of":"2026-10-24T17:02:48+00:00","observed":true,"total_events":203,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"censys","confidence":"high","network_type":null,"why":["The address is in a published scanner range (censys).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Held a session open for 67s, against a median of well under a second.","Counts include 175 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"29,332 bytes sent, longest session 67s","bytes_sent":29332,"session_seconds":67,"persistent":true},"basis":"combined"},"first_seen":"2026-10-08T22:47:04","last_seen":"2026-10-24T13:59:23","events_24h":0,"events_7d":50,"interactive_sessions":175,"interactive_sessions_24h":18,"interactive_sessions_7d":137,"interactive_protocols":[{"protocol":"tls","sessions":153},{"protocol":"http","sessions":6},{"protocol":"enip","sessions":1},{"protocol":"pcworx","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":398324,"org":"Censys, Inc."},"source_domain":"163.195.132.66.censys-scanner.com","known_scanners":["censys","Censys"],"scanner_tag":{"key":"censys","label":"Censys","category":"research","url":"https://about.censys.io/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":175,"first_seen":"2026-10-15T04:04:57","last_seen":"2026-10-24T13:59:23","verdicts":[{"verdict":"unknown","sessions":167},{"verdict":"scan","sessions":8}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":6},{"persona":"ics@Schneider Modicon M340","sessions":2}],"services":[{"protocol":"tls","port":15921,"sessions":10},{"protocol":"tls","port":51033,"sessions":10},{"protocol":"tls","port":17798,"sessions":10},{"protocol":"tls","port":38051,"sessions":10},{"protocol":"tls","port":36619,"sessions":10},{"protocol":"tls","port":23760,"sessions":10},{"protocol":"tls","port":30756,"sessions":10},{"protocol":"tls","port":18994,"sessions":10},{"protocol":"tls","port":222,"sessions":10},{"protocol":"tls","port":12321,"sessions":10},{"protocol":"tls","port":52873,"sessions":10},{"protocol":"tls","port":22050,"sessions":10}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":8}]},"top_ports":[{"port":1961,"proto":"tcp","label":"","count":9,"sessions":18},{"port":8883,"proto":"tcp","label":"","count":10,"sessions":0},{"port":222,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":12321,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":15921,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":17798,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":18994,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":22050,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":23316,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":23760,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":30756,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":36619,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":38051,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":38079,"proto":"tcp","label":"TLS","count":0,"sessions":10},{"port":51033,"proto":"tcp","label":"TLS","count":0,"sessions":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677","t11i080600_dafb69683c10_583ba773bd60","t12i160700_8cdfa2d4673b_ac0d2f4ec206"],"tls_client_hello":"16030105ba010005b60303244b4738d8e7fa03efdbbb10eb6d914f449fae345d8f61ed5a97fe4d5e5fee8b201f902696d920d642d7563f785c0efa4acd844655b142221a8349b3d0a1929ca10026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a13031301130201000547000500050100000000000a0012001011ec11ed11eb0202001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003304ea04e811ec04c04bfa43c8b37dcb1a905909ccbf004d5f9671f430328ac5889aa5667df350179b28f8696fb0193d58822f1244bafc5500882a1e18828078706ce5a0857e67c87e8713b2105c5794bc9c21a4db92c45cf93c920621bc2b52a768bcaa689cee8c01e3d528f264837457bb17b6a0d704be34204de6e5a3f6837345718d9f30375af72e4bb19c4cc6be741ab7001053e7389947e45c38529c91788cfec7373a2b8577317131f944ebfa45b184a7148abe7439a4d87b9f82a853c16acd50c53eea4000619464cd641ac33755fda55be491be42a411688314041b843f9938080502fb151f8362537df292056a6067f37bf309754a64a62b1cbe81559e3c40521ac9cd99365867a209afb1034e1258ff2842af540fd5866864f45eae4794824cca5db660406816a6e1999de7af1ef32bc6b0c5ac6592437325bea6b9c3a93d6c701b596a0589f68835db12b8857b709a07dd4b7c7502ac952159b6f54b1166450ce3c65013a572100f78dab57e75397373a51799aab35766102208208361ab169265d89d635a97e38542bda384d0550e6085b66fd5ac4f33082eca62bb1cc857638a43f645fc8850c5dccc62494107552fec79bf7925a1693003133a3fc18216c597558a88bee9356d64115b74e46fd00a611c97c8e8055235d21913830a4ec26914828484b19d97cc4b1ca4a82e914edf2c64ada29fe9bc85f0f76e23c3978714054766c825043446121e049c91cd4680978391d0523c2c64b0f7b4387d557466a76004344414516c196a96594138a7a46bb88a0bd13532966c0e99e4c4076026458931819c15858a60262942a4b35d98e678455bc290079a8a5213a205a5edf0bb667934be1b6eff5b06c88580b7024c852696f2d9bc44962efadb81890111beac1fe6c009da93af43b4814ea09fc873bdc3c376681a96f0ca06378439f4c126c604736ce81e02f5c8db2607fb432e0b440fd9470b7030b93b68a0902343859b6a83a7382ed4345b3c8cdd16339d49553a348b02b3014efb738adb329e306ed7c6a87d8b1316589a7424243e9b6cb7d804f6798941a189ef957937c184058441324371acbc4a3edc717ce28194c40593b80d924683be815c507937aae07774e1983337cfbce18a4f3217913c90ffd6028d8c04ad3a70ef3337a5e67ce287825f4a1001a08c97cc0710703cf6a315efb16cb5a55a0dea50ca2764f6fc943ea2c7a41b8ca228b3a000772677be41179b26b38608b9346de97ab6e0b31570bf21a5385616069d34061cc9b854ca9fc400401cd70e40029f08fc542fe315dde400f1c15946f1b78b2455305cb0d8c35db8aaca8204a64160462687797960bd0ef43eb99c0df0133954651c7b283294f8067d323b62bc234f396f14c130b5a5050cd9cb05f7154292a8e3b87fd0192258259e6a2a2218909018d45583196db70b35cf461478a12b62eb4116f52f70937a27dc39dca13269bab15af09cec3c5bedd03eac2b1008c4754206c2253551ab34a50a6271ac71ab81fa9567654e9ae6202098bc54c91250a45e179ac45be083e34b1ecab74d6601a97ce53967a21a730b19c40cbd2a7ac051866e285872d5acceace473f744c4a4f576683807c103b929db5b86681381cc60fcb2f10c4b8851bccaf45b55cd96045745fdaf295ad8de841f022d30ed3a37827078db9c641e00e537d54efd27489073070516ccff32a2ece28470ae46001d0020bf2f6d4e9a19f41696134f8a304924e1bacba1c8af2e393db4f6abedcfb10752","tls_ja3":["5af43e5eee17271a9eb37dce2ab407a8","e5c250b292fce278a62137836169e18f","725543c78edf669194c11dc7a039b56e","62af8f57328e1a9d8cf393b15b55aa86","cb5ee0df7dce572a1bda5ba25de39d53"],"http_akin":["b00cun000_00000000_334359b9","b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68","b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t11i080600_dafb69683c10_583ba773bd60","t12i160700_8cdfa2d4673b_ac0d2f4ec206","t13i131000_f57a46bbacb6_ab7e3b40a677","t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_ja3":["5af43e5eee17271a9eb37dce2ab407a8","62af8f57328e1a9d8cf393b15b55aa86","725543c78edf669194c11dc7a039b56e","cb5ee0df7dce572a1bda5ba25de39d53","e5c250b292fce278a62137836169e18f"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3246,"t13i131000_f57a46bbacb6_ab7e3b40a677":3144,"t11i080600_dafb69683c10_583ba773bd60":0,"t12i160700_8cdfa2d4673b_ac0d2f4ec206":0,"b00cun000_00000000_334359b9":393,"b11cun010_00040000_c4b2c4aa":942,"b11cun040_00040013_608dab68":4335,"b11cun040_00040016_aa48e2c8":5494,"t13i1909h2_9dc949149365_97f8aa674fd9":774},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"],"timeline":[{"date":"2026-10-08","count":8,"sessions":0},{"date":"2026-10-09","count":17,"sessions":0},{"date":"2026-10-10","count":30,"sessions":0},{"date":"2026-10-12","count":1,"sessions":0},{"date":"2026-10-13","count":31,"sessions":0},{"date":"2026-10-14","count":8,"sessions":0},{"date":"2026-10-15","count":17,"sessions":20},{"date":"2026-10-16","count":25,"sessions":18},{"date":"2026-10-17","count":16,"sessions":0},{"date":"2026-10-18","count":18,"sessions":30},{"date":"2026-10-19","count":7,"sessions":33},{"date":"2026-10-20","count":25,"sessions":31},{"date":"2026-10-21","count":0,"sessions":10},{"date":"2026-10-23","count":0,"sessions":15},{"date":"2026-10-24","count":0,"sessions":18}],"recent_events":[{"timestamp":"2026-10-24T13:59:23","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/phpinfo","summary":"","payload_hex":"474554202f706870696e666f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"24025003-0031-4908-a15f-66ea423856f4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:58:18","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-json/","summary":"","payload_hex":"474554202f77702d6a736f6e2f3f5f6669656c64733d6e616d652c6465736372697074696f6e2c686f6d652c676d745f6f66667365742c74696d657a6f6e655f737472696e672c6e616d6573706163657320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"edeac0fc-5a3f-4b17-b5fa-51a10b0ec844-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:55:50","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"a8a813ea-7c96-45f3-9943-1264699ed636-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:55:45","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/uploads/2024/03/cropped-favicon-32x32.png","summary":"","payload_hex":"474554202f77702d636f6e74656e742f75706c6f6164732f323032342f30332f63726f707065642d66617669636f6e2d33327833322e706e6720485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"a9977420-c65e-4202-ae9a-dedcff2dbd10-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:55:39","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1961\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"e65c8e6e-9471-42d6-ba4c-e1786546d08a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:55:26","port":1961,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:1961\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a313936310d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"0da913d1-afe1-4f47-9215-1ab8b1f08426-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T13:54:56","port":1961,"proto":"tcp","app_proto":"pcworx","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000\u001a\u0000\u0000\u0000\u0000x�\u0000\u0003\u0000\fIBETH01N0_M\u0000","payload_hex":"0101001a0000000078800003000c494245544830314e305f4d00","method":"","user_agent":"","ja3":"","session":"5600efcd-f314-4eb9-90dc-8bd6290d8a28-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"06579d67548344fc","strings":["IBETH01N0_M"]},"interactive":true},{"timestamp":"2026-10-23T08:22:58","port":44818,"proto":"tcp","app_proto":"enip","app_protocol":"enip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000OISYSNEC\u0000\u0000\u0000\u0000","payload_hex":"6400000000000000000000004f495359534e454300000000","method":"","user_agent":"","ja3":"","session":"45f2e371-3714-4d0d-9764-8ff75326f312-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5d56a4ec986560f2","strings":["OISYSNEC","dOISYSNEC"]},"interactive":true},{"timestamp":"2026-10-23T08:22:57","port":44818,"proto":"tcp","app_proto":"enip","app_protocol":"enip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000OISYSNEC\u0000\u0000\u0000\u0000","payload_hex":"0400000000000000000000004f495359534e454300000000","method":"","user_agent":"","ja3":"","session":"45f2e371-3714-4d0d-9764-8ff75326f312-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b52bb8d7d988fcd3","strings":["OISYSNEC"]},"interactive":true},{"timestamp":"2026-10-23T08:22:55","port":44818,"proto":"tcp","app_proto":"enip","app_protocol":"enip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000OISYSNEC\u0000\u0000\u0000\u0000","payload_hex":"6300000000000000000000004f495359534e454300000000","method":"","user_agent":"","ja3":"","session":"45f2e371-3714-4d0d-9764-8ff75326f312-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b2f78905745073c2","strings":["OISYSNEC","cOISYSNEC"]},"interactive":true}],"http_methods":[{"method":"GET","count":174},{"method":"PRI","count":13}],"distinct_ports_total":48,"top_paths":[{"path":"/favicon.ico","count":69,"ports":25},{"path":"/","count":52,"ports":26},{"path":"*","count":13,"ports":13},{"path":"/app-ads.txt","count":4,"ports":4},{"path":"/sitemap.xml","count":4,"ports":4},{"path":"/.well-known/security.txt","count":4,"ports":4},{"path":"/wiki","count":3,"ports":3},{"path":"/sellers.json","count":3,"ports":3},{"path":"/ads.txt","count":2,"ports":2},{"path":"/ai/site-profile.json","count":2,"ports":2},{"path":"/security.txt","count":2,"ports":2},{"path":"/cq1p0nlok","count":1,"ports":1},{"path":"/b0t3ejflgybdd5i","count":1,"ports":1},{"path":"/ktbc_8g4wqeczf","count":1,"ports":1},{"path":"/ke7rvku69exsoy0","count":1,"ports":1}],"distinct_paths_total":40,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2","count":24}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1961","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","notable":false}],"distinct_sets":4,"events_with_headers":6},"tags":[]}