{"ip":"66.132.195.213","total_events":34,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"censys","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (censys).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,729 bytes sent","bytes_sent":4729,"session_seconds":5,"persistent":false}},"first_seen":"2026-10-08T02:45:42","last_seen":"2026-10-10T19:09:34","events_24h":8,"events_7d":34,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":398324,"org":"Censys, Inc."},"source_domain":"213.195.132.66.censys-scanner.com","known_scanners":["censys","Censys"],"scanner_tag":{"key":"censys","label":"Censys","category":"research","url":"https://about.censys.io/"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":7547,"proto":"tcp","label":"TR-069","count":9},{"port":8081,"proto":"tcp","label":"","count":8},{"port":2086,"proto":"tcp","label":"","count":8},{"port":5234,"proto":"tcp","label":"","count":7},{"port":7070,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ba010005b60303cc62d07cf9cbbb4b2e0eb9ab94d2f47f8b09721dd29f01c4555dcacd041936802084429e861f82a0acc09e5a540024b450f4386e3875aa9da56359154a7a12ecef0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a13031301130201000547000500050100000000000a0012001011ec11ed11eb0202001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003304ea04e811ec04c05dc7adb4b6857b33566076782489a7cb61a697e323d3ac1cadd0a4edc82cf6a774c445cc0ae64e6b65a68b616f790826ad82b5c70b6315653b6395540f26376a8a430086a3f1dc4b8c767e184cc4641222ce7c28046993354c3172a491c990ac8092c6a0173224e941e8654253a533bcf052d862bfdbe93d9853ca72a1bbf1022cc92595c6887dfc0a0a0b3257d8c32070e765a2f204de234281a10f1c5433a9db5a95d13ee0f915d6b720ffaa5108b04cd8550fe3a25a23c114a0d318d44b05c443cfea6b61b1d5c488489eeec538b42b3b002954fa4a855aeb034f697dcda98fba244217386cbd3483fff16e2fd0108edb953c9081d7d08f6be088a68c6b4ef95dba94485f8829631c8602e4c41608963b26cd20170f61dc26a31c098ed3146bd227b67c7a483177e0605f8a19872d4872a0545754e12f044223e6b171831375640ace7e477a5083aa55439feb053edfc8a415f5aebaf98584d518fd05250ca38686c9a0988a44264b84adc216c52c68a4ca7db7f0943b388166308408c88281f5b1ef7921e2d83770575ba0c8bac413b64ed495980a64504a6dda455a1aa2b417917ea91ca5a6e729d23777f0748e22040822fa9d8687a6e2928a2c7a095bd234b3a05153d173b44060a66a5a5a0bc5edb71a1b985a46d0c03ae2aca29662942a4a0599b58073b77cb3693e79180b1248b6b90e32477fd9e4a6e9c0b7dfd15f4bf515acdb069db31fa7fba81339b8bd1863b9cb8362e8be0e927738b015145c4f8ef30d7040789fc4043c176b120a717e9cb23df4b1110142523886e354230ba7bea086b596c20a60d9011e5764ae1501857745c24773a0996bbe8c455f3ba4ddecae311743f6718953151a35f592d1c74152a17b89ec5af379283e417137e54ac19513ecb92c7f4a347df28a5769ce56c55c2dc3927d6011337885b358a7d6945a9824141af20b836585f617581d1a3b673b649e3c7d8b84054302374c5ba567110edf7b316f5a60eef9263dd93190180db523b1b9d612bcb454d1f45bdcd89de380995c563d7925aacb07a8b2c17a8aea7b96710f7d42669f48bf268c655816837157c2f9307ec233b34567a3eb810474a91fc98679075363b0f295c2405174c297f2842eaf54193dc0ab8d31a5a7a426c7792909aa4c632b6bc46212a5362e113546a47cb4f057594dccb107e84226405510d0c52ac98aa010c38d116fb558cb558ca98ee8556517c10408cfba3b82524307d3499eafb37047a6c918f863b6f72031e570511315419c0e8837875ca8aa78052422922150866b2582242ee8a93bd44ddf1994749052ef4278f0fb48fb18a625030b178292cf8a38fc43254c170608297c7a1ca975a281d2579d0e99673d1696c6a69d403406f53804292c3f4d431378321c3713418c8c22e093b13678caba03934c937c8c867a26bc2d2cd301382400041518c441a1fff05eb7ec4253b3c517a313cecaa78c8b882794b9ce4a559e229e39a9514c94be481955021c0b0048ad61b2cac05697dd701d2a320f07825deab52d58781c3bf0b482e576b26b2e489a0eb18c30f71592aec60e4a77776325256fb7bff3972736f3666e7582c032a5a2aa33a9c79a9426ac20f453aa631546207ec502b422714242e97d9a6a584ec4efcf1c53c14882fdd4312ab60740ffb01113b34ba156aacf8864d106940a2ad4e94621640b09cb35ef8b8940001d002063f0f3a21e21686b20f08e656ecc19c460fd2f0555a24a5d8c77178aa53ee20b","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab","725543c78edf669194c11dc7a039b56e","7c1e207beb00684bbbe144f1b0abe1d5","e5c250b292fce278a62137836169e18f"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68","b11cun030_00040012_13ee3d34","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3062,"t13i1909h2_9dc949149365_97f8aa674fd9":694,"t13i131000_f57a46bbacb6_ab7e3b40a677":3083,"b11cun010_00040000_c4b2c4aa":772,"b11cun040_00040013_608dab68":4396,"b11cun030_00040012_13ee3d34":4964,"b11cun040_00040016_aa48e2c8":5745},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"],"timeline":[{"date":"2026-10-08","count":17},{"date":"2026-10-10","count":17}],"recent_events":[{"timestamp":"2026-10-10T19:09:34","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/627p312ph23o137nb1","summary":"","payload_hex":"474554202f36323770333132706832336f3133376e623120485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"9e8a74d4-203c-4cd5-9ccb-6ff6b8c755cf","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-10-10T19:09:34","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"0aa89f48-2c7e-4f56-822c-dd9bd05af470","seq":1,"duration_ms":167,"bytes_in":181,"bytes_out":79},{"timestamp":"2026-10-10T19:09:33","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ai/site-profile.json","summary":"","payload_hex":"474554202f61692f736974652d70726f66696c652e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"73469ea2-882a-4fe4-a5e8-720885e54115","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":79},{"timestamp":"2026-10-10T19:09:33","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"f6f7aeb2-3a4a-4b12-bfa8-fac2c5ff194c","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":79},{"timestamp":"2026-10-10T19:08:46","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"a07ba84d-2b7a-4a14-a89f-711e3f798062","seq":1,"duration_ms":170,"bytes_in":181,"bytes_out":79},{"timestamp":"2026-10-10T19:08:43","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0018\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000Bh\u0000\u0006\u0000\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\n","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00001804000000000000020000000000040000426800060004000000030000000a","method":"","user_agent":"","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"be0e1078-e811-4fbb-8cad-97ecff0f705d","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":14,"enriched":{"digest":"a89d180d93c3b6d2","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-10-10T19:08:38","port":8081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"eb67772b-4b39-4dd5-91d3-f408b29a8465","seq":1,"duration_ms":167,"bytes_in":164,"bytes_out":79},{"timestamp":"2026-10-10T19:08:30","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8081\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"63757d11-6833-489b-a5dd-de2784f19d35","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":79},{"timestamp":"2026-10-10T10:21:27","port":5234,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5234\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353233340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"725543c78edf669194c11dc7a039b56e","session":"9521dc66-96d6-4cfb-b2e9-44cf7c1f00e5","seq":1,"duration_ms":141,"bytes_in":181,"bytes_out":79},{"timestamp":"2026-10-10T10:21:26","port":5234,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5234\",\"user-agent\":\"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/klu2qxoqfjjz","summary":"","payload_hex":"474554202f6b6c753271786f71666a6a7a20485454502f312e310d0a486f73743a20<HONEYPOT>3a353233340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2043656e737973496e73706563742f312e313b202b68747470733a2f2f61626f75742e63656e7379732e696f2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","ja3":"e5c250b292fce278a62137836169e18f","session":"e150873e-0add-4e53-bebe-32d7e33fe51c","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":79}],"http_methods":[{"method":"GET","count":28}],"distinct_ports_total":5,"top_paths":[{"path":"/favicon.ico","count":11,"ports":4},{"path":"/","count":9,"ports":4},{"path":"/app-ads.txt","count":2,"ports":2},{"path":"/login","count":1,"ports":1},{"path":"/n4txwb2n9","count":1,"ports":1},{"path":"/klu2qxoqfjjz","count":1,"ports":1},{"path":"/uivbamn8mr74q1","count":1,"ports":1},{"path":"/ai/site-profile.json","count":1,"ports":1},{"path":"/627p312ph23o137nb1","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8081","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)","notable":false}],"distinct_sets":3,"events_with_headers":9},"tags":[],"data_as_of":"2026-10-11T17:27:14.762129+00:00"}