{"ip":"66.132.195.176","observed":true,"total_events":38,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"censys","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (censys).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,581 bytes sent","bytes_sent":5581,"session_seconds":5,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-11T07:55:15","last_seen":"2026-10-14T13:07:31","events_24h":9,"events_7d":38,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":398324,"org":"Censys, Inc."},"source_domain":"176.195.132.66.censys-scanner.com","known_scanners":["censys","Censys"],"scanner_tag":{"key":"censys","label":"Censys","category":"research","url":"https://about.censys.io/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1201,"proto":"tcp","label":"","count":18},{"port":26257,"proto":"tcp","label":"","count":9},{"port":20256,"proto":"tcp","label":"","count":9},{"port":22,"proto":"tcp","label":"SSH","count":1},{"port":10261,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["52c99fce46b6758a467102ce5bd1c565"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303a4a90cbed5a552144553ae3dac77a2c82a4a56d251d53a6798da69a4227c0a572031d30cc317aee049dcd39e13571d531d3ae2c3f56b30e08e4a8ced84cf97b024001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0a88523e9e8230604af7528106a92aebea408ad6866b7062bc174a6bf84c77ada7e0af11c39638d22067ca041391187b323543a1be0a134c99be6db837b9ab459bc131a5a7618e161e3f7c6f2985a160766fca8530ac2681bea74c5db75f7cc4dd47a0ca32b9e17c2b888b642e6caafaac9c32fd5639d4c98afd8c31a9b4bd2276079cb4a58e8cdf5237d6989431bbcb8786311422b2e6809b74b014853631126e117490baadfb77a1ff40e6bb4059d62381606c5e3397b01e9b2f77c14ac9810a5684594b2a06e31683fbb2656c8a2bfd7426552bbc297c6774999ca349676f76f29a82fadfb9032c3a36b22a3615c6166e260cbca53f345a375681fea0444e5531260693e5f25a5e79a0c80e1bf441061203b2e914cb4a1f9235397500b447416218c6dba44591523c17738d8d11cced19db485baa74cc20ceaa3fdd5c1a00437b61b399c08bc2c7072f9b24a9bb329811c40c2423b57f781c791c0df0748506882e8a821e7a87eda576f22e16b08a60f2f1a6b4af2789fd37820ac23e602250933b0fa4cbce4933ef8e267d51b3f4a741ef372895e79a4f0d02cc4f9223e5800cea030e34027a3803306674a7d500205d21c2ffc8bf785ae9b0a28d71282fc7835a28290ff479a7a638d6324b888e06d63a2536b4a1961cb098165ac8c683f4a471d88d8812d54bc26168bff5793f436404fd7615133acc44b41cef85f4fe07cef24683cdb299b22588eec81dbf9bfe220bde0ca23b2dc7f9f4756b9840f2302c781e1be77c6643cf7bafcc744183b5d49001f151693be405de3b0abb7515a554670efe158cb80ca1f99c0465798d3590e127172f2349974ab2d2c462ff97175fe344962154ff614cd8e60cdd5d85ff585bac8d57c7855643c480087eb1673e919397552f198845c8367ce26847ea42ab8454eb10baab65a4c65a61f8314c44b31c83f6abc346c32d160bb915898d8a02233288494b41ec992ad1a288e15881d38897321766a09706d1df1bd63760a6ddaa86aea959ac994d7298bc12377dec56551eba072e22eed4bc2e78b5f55a8347a6a2d3dc9149ea88e86678019f1415506c017b9248b49bd05678d7da51588dc79a8a1047170c4b3786c01888a7592a74814716ba1841d9ca5ab39bc9f070d0b302838e885c77811dfc75aa206bb564a4012f2574576c68c595e30a60251e67d41520caaa0c98ab8031cf8c1e558c91a4787b302764553aa86c8cbf7164de2d894dbe395dd504d254c1abe117c8e310da15acca95a395766bd2b9a2ae661983a9b3a017a6656743d412886fb849ffca2222b088afba44743eca433456117366a0814369c994614d28db9c562fb0bb465c857bfa740da3354bef374d2e38c43f069c67cceb81598fa6519f0a7bca43aae9f3c3eb3b45715d6635834366bd6cba62bc6be2a7bfc959da1eb55f3a3594a7cc5deeb07f2279fea14263c66baf9797d9f36a56921396e6ca44064b126a51caa18afcb72bc8838485185a69af758d0a84d910617af9b19eb40326a99c59fc28b86f79deccb02d4f2848ac28e369b8c6db1cb65027b7416797d2c9562f503fa66a8093008790396b4179bfe3c4a2e4b753f0ac55228cac7c054a9687771c28731a5ee7843d39944326fbdf3ac98df433431ae7bb2059efcecbcf3679a46e1f9aafafb8adc39d388aa6e8ad691f160b91a600bf24c7337b120a294897164811d001d0020aafafb8adc39d388aa6e8ad691f160b91a600bf24c7337b120a29489","tls_ja3":["5af43e5eee17271a9eb37dce2ab407a8","e5c250b292fce278a62137836169e18f","725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2991,"t13i1909h2_9dc949149365_97f8aa674fd9":728,"t13i131000_f57a46bbacb6_ab7e3b40a677":3142,"b11cun010_00040000_c4b2c4aa":813,"b11cun040_00040013_608dab68":4374,"b11cun040_00040016_aa48e2c8":5475,"52c99fce46b6758a467102ce5bd1c565":22},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":6,"ips":4375}},"user_agents":["Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"],"timeline":[{"date":"2026-10-11","count":10},{"date":"2026-10-12","count":18},{"date":"2026-10-13","count":1},{"date":"2026-10-14","count":9}],"recent_events":[{"timestamp":"2026-10-14T13:07:31","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"395c3fe4-1204-40fc-8d6b-64a277a0d804","seq":1,"duration_ms":497,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-10-14T13:07:28","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/d4kq84n_1s0wh","summary":"","payload_hex":"474554202f64346b7138346e5f317330776820485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"8cc069fd-0ab3-40c1-8da3-0818a2ec9774","seq":1,"duration_ms":354,"bytes_in":178,"bytes_out":79},{"timestamp":"2026-10-14T13:07:26","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"2ec537c0-1ebb-4207-8fb1-119f3e904275","seq":1,"duration_ms":169,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-10-14T13:07:23","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"a2e7e761-daa0-4d97-bca1-bea7850f7aaa","seq":1,"duration_ms":1966,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-10-14T13:07:06","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"c98836c6-80dc-4b3e-9714-b8a9c029f742","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-10-14T13:07:05","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:26257\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"0441e49d-8c90-4964-aae0-9250110d6f5c","seq":1,"duration_ms":315,"bytes_in":165,"bytes_out":79},{"timestamp":"2026-10-14T13:07:05","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00001804000000000000020000000000040000426800060004000000030000000a","method":"","user_agent":"","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"e3415f4e-9a19-4912-9a35-c90bb3cc51e2","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":14,"enriched":{"digest":"a89d180d93c3b6d2","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-10-14T13:07:00","port":26257,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:26257\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32363235370d0a0d0a","method":"GET","user_agent":"","ja3":"e5c250b292fce278a62137836169e18f","session":"991a1cf2-4b75-4fdd-951d-cbec9ba3d99b","seq":1,"duration_ms":4665,"bytes_in":45,"bytes_out":79},{"timestamp":"2026-10-14T13:06:44","port":26257,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"65befb42-c81e-4ca4-b44e-d9fff419147a","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":14},{"timestamp":"2026-10-13T15:59:08","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003<\r\u0014\u0001��k\u00035��N�p�wÈ�\u0000\u0000\u0000�curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000aaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc\u0000\u0000\u0000aaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�5(~���&�+���","payload_hex":"5353482d322e302d476f0d0a0000033c0d1401cdf26b033580f34ed570b777c388e2000000b1637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235360000012d7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d65643235353139000000616165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6362632c336465732d636263000000616165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6362632c336465732d63626300000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000008a35287efd93a926e22b92aa87","method":"","user_agent":"","ja3":"","session":"86b168ba-e274-4570-ac7c-35e1a94af247","seq":1,"duration_ms":1088,"bytes_in":844,"bytes_out":14,"enriched":{"digest":"f1d544083d094ebd","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","aaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,a…","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}}],"http_methods":[{"method":"GET","count":28}],"distinct_ports_total":5,"top_paths":[{"path":"/favicon.ico","count":12,"ports":3},{"path":"/","count":8,"ports":3},{"path":"/.well-known/security.txt","count":3,"ports":3},{"path":"/d6iu0snkd2g","count":1,"ports":1},{"path":"/d4kq84n_1s0wh","count":1,"ports":1},{"path":"/sitemap.xml","count":1,"ports":1},{"path":"/0726jnopr8l672445d","count":1,"ports":1},{"path":"/v4k9ubic51_9opob","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2","count":4}],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:26257","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","notable":false}],"distinct_sets":3,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-15T04:51:14.311436+00:00"}