{"ip":"71.6.146.130","total_events":354,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shodan","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (shodan).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,488 bytes sent","bytes_sent":15488,"session_seconds":1,"persistent":false}},"first_seen":"2026-02-20T16:59:50","last_seen":"2026-10-02T14:09:06","events_24h":3,"events_7d":55,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":10439,"org":"CariNet, Inc."},"source_domain":"refrigerator.census.shodan.io","known_scanners":["shodan","Shodan"],"scanner_tag":{"key":"shodan","label":"Shodan","category":"commercial","url":"https://www.shodan.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":444,"proto":"tcp","label":"","count":36},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":14},{"port":4444,"proto":"tcp","label":"","count":12},{"port":7001,"proto":"tcp","label":"WebLogic","count":10},{"port":102,"proto":"tcp","label":"","count":8},{"port":5006,"proto":"tcp","label":"","count":8},{"port":4433,"proto":"tcp","label":"","count":8},{"port":9898,"proto":"tcp","label":"","count":8},{"port":16993,"proto":"tcp","label":"","count":8},{"port":10443,"proto":"tcp","label":"","count":8},{"port":9443,"proto":"tcp","label":"","count":7},{"port":135,"proto":"tcp","label":"MSRPC","count":6},{"port":11300,"proto":"tcp","label":"","count":6},{"port":8099,"proto":"tcp","label":"","count":6},{"port":80,"proto":"tcp","label":"HTTP","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i570500_2a2bed94251f_a1e935682795","t13d311100_e8f1e7e78f70_801c830e80cf","t12i880600_0f2e77409aed_4446390ac224","t13d311200_e8f1e7e78f70_83b0a02006cb"],"tls_client_hello":"1603010138010001340303fde0d0d5136a385e00285ac1d88f31bf8195485f02342415b2e584d0b30bc7c9201e2d8431ffc2acbea8b8d6657273630a6e99132d8737a08ee352b02f666e22740056130213031301c02cc030c02bc02fcca9cca8009f009eccaac0afc0adc0aec0acc024c028c023c027c00ac014c009c013c0a3c09fc0a2c09e006b006700390033009d009cc0a1c09dc0a0c09c003d003c0035002f00ff01000095000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003300260024001d0020a49887295b96d388db5179676aca6d44ff8a3fc9ba87f611d553b54002e63b3d","tls_ja3":["27aa226a438f84089010afba37b2351b","588552cc67787a99af4abff0d403246f","46bb4b3029ca544e39e1c0a2783e2de5","1b9c378b97d4de5734644c22fd22be53"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun020_00040002_5ff1c0a9","b11cun040_00040016_9e0aeda7","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t12i570500_2a2bed94251f_a1e935682795":24,"t13d311100_e8f1e7e78f70_801c830e80cf":24,"t12i880600_0f2e77409aed_4446390ac224":17,"t13d311200_e8f1e7e78f70_83b0a02006cb":24,"b11cun010_00040000_c4b2c4aa":653,"b11cun040_00040016_9e0aeda7":50,"b11cun050_00040017_976354f0":1271,"b11cun020_00040002_5ff1c0a9":121},"akin_families":{"b11cun020_00040002_5ff1c0a9":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":121},"b11cun040_00040016_9e0aeda7":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1272},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1272}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","python-requests/2.23.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"],"timeline":[{"date":"2026-07-19","count":1},{"date":"2026-08-14","count":3},{"date":"2026-08-20","count":4},{"date":"2026-08-24","count":3},{"date":"2026-09-06","count":3},{"date":"2026-09-19","count":1},{"date":"2026-09-23","count":2},{"date":"2026-09-25","count":5},{"date":"2026-09-26","count":3},{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":12},{"date":"2026-09-29","count":17},{"date":"2026-09-30","count":13},{"date":"2026-10-01","count":6},{"date":"2026-10-02","count":3}],"recent_events":[{"timestamp":"2026-10-02T14:09:06","port":1599,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LO_SERVER_CLIENT_PAIR\nFirefox OS\n0000\n\n","payload_hex":"4c4f5f5345525645525f434c49454e545f504149520a46697265666f78204f530a303030300a0a","method":"","user_agent":"","ja3":"","session":"a2b1ff53-1acb-4003-b2e9-3f1669ef58a4","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":12,"enriched":{"digest":"dd2e1e6523af34ce","strings":["LO_SERVER_CLIENT_PAIR","Firefox OS","0000"]}},{"timestamp":"2026-10-02T11:38:27","port":2082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2082\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038320d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"c36c98e1-e0a3-45a3-bea9-b59baf63516d","seq":1,"duration_ms":101,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-02T11:38:26","port":2082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232382e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","ja3":"","session":"4e604c7a-69b3-4a01-866c-c953c6367420","seq":1,"duration_ms":100,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-01T20:23:21","port":53805,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:53805\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35333830350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"7084d319-2126-4646-83c5-9d6ba29ac1af","seq":1,"duration_ms":100,"bytes_in":254,"bytes_out":77},{"timestamp":"2026-10-01T20:23:19","port":53805,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232382e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","ja3":"","session":"a84eba0a-96ed-458a-a337-7a94cf7be3bc","seq":1,"duration_ms":101,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-01T02:13:23","port":2090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2090\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"3bb8a5a6-bd46-416b-9a08-d45af1433591","seq":1,"duration_ms":100,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-01T02:13:13","port":2090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232382e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","ja3":"","session":"5ac990ae-1aa6-40c5-8104-879e388ff4a0","seq":1,"duration_ms":100,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-01T02:08:12","port":8144,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8144\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383134340d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"68302cd6-eb4c-4fa8-be72-3a1d7533a1cf","seq":1,"duration_ms":100,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-10-01T02:08:06","port":8144,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232382e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","ja3":"","session":"c20ef185-e2ef-4775-9db9-af159e73929a","seq":1,"duration_ms":101,"bytes_in":253,"bytes_out":77},{"timestamp":"2026-09-30T23:55:08","port":45039,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:45039\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34353033390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"29616aa0-2322-4f46-8cce-a730851401e8","seq":1,"duration_ms":100,"bytes_in":254,"bytes_out":77}],"http_methods":[{"method":"GET","count":145},{"method":"POST","count":2}],"distinct_ports_total":116,"top_paths":[{"path":"/","count":63,"ports":48},{"path":"/favicon.ico","count":56,"ports":43},{"path":"/robots.txt","count":9,"ports":4},{"path":"/sitemap.xml","count":9,"ports":4},{"path":"/.well-known/security.txt","count":9,"ports":4},{"path":"/crawl","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:2082","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-10-02T21:48:17.995530+00:00"}