{"ip":"77.91.71.5","total_events":59,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-11T15:28:18","last_seen":"2026-07-27T08:25:38","events_24h":0,"events_7d":43,"geo":{"country_code":"GE","country_name":"Georgia","region":"","city":"","lat":42.0,"lon":43.4999,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2020-2036","title":"Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/global-protect/login.esp"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":13},{"port":4433,"proto":"tcp","label":"","count":9},{"port":50443,"proto":"tcp","label":"","count":8},{"port":4333,"proto":"tcp","label":"","count":6},{"port":15443,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":5},{"port":11443,"proto":"tcp","label":"","count":2},{"port":17443,"proto":"tcp","label":"","count":2},{"port":30443,"proto":"tcp","label":"","count":2},{"port":16443,"proto":"tcp","label":"","count":2},{"port":14443,"proto":"tcp","label":"","count":2},{"port":13443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i280800_0df5e5c63df4_5c2ba2672724"],"tls_ja3":["ca39305c183742559eb9946bcb9dc220"],"ja4h":["ge10nr0400_0c3ee47b4d83"]},"fingerprint_peers":{"t12i280800_0df5e5c63df4_5c2ba2672724":22,"ge10nr0400_0c3ee47b4d83":25},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-07-11","count":3},{"date":"2026-07-12","count":7},{"date":"2026-07-18","count":4},{"date":"2026-07-19","count":2},{"date":"2026-07-25","count":16},{"date":"2026-07-26","count":26},{"date":"2026-07-27","count":1}],"recent_events":[{"timestamp":"2026-07-27T08:25:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:mEjrF01I3y2HCAWlyfbgW3+IHBE=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"86b0d6ba-e303-459d-99e7-043f3b34851f","seq":1,"duration_ms":109,"bytes_in":266,"bytes_out":75},{"timestamp":"2026-07-26T14:03:28","port":30443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:v3jPwO3ZPsWS3cznjHEqOUU3ET4=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"58581a8c-68f1-4ada-b3e2-d22688dee9d7","seq":1,"duration_ms":237,"bytes_in":241,"bytes_out":75},{"timestamp":"2026-07-26T14:03:27","port":30443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/api/sonicos/is-sslvpn-enabled","summary":"","payload_hex":"474554202f6170692f736f6e69636f732f69732d73736c76706e2d656e61626c656420485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:sV3MMwilOZ9bi3y2x5YVAp4SRPI=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"ba219b53-222d-444a-87ea-40a091962fa9","seq":1,"duration_ms":194,"bytes_in":270,"bytes_out":75},{"timestamp":"2026-07-26T14:02:20","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:ldfjS6XGOPa9u9jz4yA4czPeADY=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"fc5da3b0-fbc6-49ea-abcb-17d2ea56aecb","seq":1,"duration_ms":108,"bytes_in":242,"bytes_out":75},{"timestamp":"2026-07-26T14:02:20","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/api/sonicos/is-sslvpn-enabled","summary":"","payload_hex":"474554202f6170692f736f6e69636f732f69732d73736c76706e2d656e61626c656420485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:erGMQNm3/No0oYEEyX+pvw40DvM=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"b69d93f5-e3f7-449a-8a35-d7390f799bc8","seq":1,"duration_ms":108,"bytes_in":271,"bytes_out":75},{"timestamp":"2026-07-26T14:02:05","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:8mWdqu65tDAlqqWUrexZG18/cBY=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"c5ddb278-773b-4cd4-bb46-dec864a73538","seq":1,"duration_ms":195,"bytes_in":241,"bytes_out":75},{"timestamp":"2026-07-26T14:02:05","port":50443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/api/sonicos/is-sslvpn-enabled","summary":"","payload_hex":"474554202f6170692f736f6e69636f732f69732d73736c76706e2d656e61626c656420485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:Um5yaMyXs/KUHg75frl0yR2K4kc=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"1cd3ef8b-74a4-457d-8a55-12d11bd777f1","seq":1,"duration_ms":194,"bytes_in":270,"bytes_out":75},{"timestamp":"2026-07-26T14:01:09","port":15443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:LaQ3GrsaXIDbQS2IYxMGZFRhlEM=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"5007df21-4fd3-4bfd-aec0-a54a0efadec3","seq":1,"duration_ms":193,"bytes_in":241,"bytes_out":75},{"timestamp":"2026-07-26T14:01:08","port":15443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/api/sonicos/is-sslvpn-enabled","summary":"","payload_hex":"474554202f6170692f736f6e69636f732f69732d73736c76706e2d656e61626c656420485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:n4HSarT6noX49SvmxkEFXYux9wA=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"518bf08f-aed5-4b98-bed4-c2098f0b5bb3","seq":1,"duration_ms":192,"bytes_in":270,"bytes_out":75},{"timestamp":"2026-07-26T14:01:08","port":15443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip,deflate\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://www.google.com\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a526566657265723a2068747470733a2f2f7777772e676f6f676c652e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","community_id":"1:j0O9XPv1V/0yA7ytDEVWno0DeRE=","ja3":"ca39305c183742559eb9946bcb9dc220","session":"d54a8422-b546-43d1-b38f-18d6509a9c75","seq":1,"duration_ms":195,"bytes_in":241,"bytes_out":75}],"http_methods":[{"method":"GET","count":59}],"distinct_ports_total":12,"top_paths":[{"path":"/remote/login","count":14,"ports":10},{"path":"/login?redir=","count":14,"ports":10},{"path":"/","count":10,"ports":6},{"path":"/api/sonicos/is-sslvpn-enabled","count":8,"ports":6},{"path":"/sslvpn_logon.shtml","count":5,"ports":3},{"path":"/vpn","count":3,"ports":2},{"path":"/+CSCOE+/logon.html","count":2,"ports":2},{"path":"/RDWeb","count":1,"ports":1},{"path":"/owa","count":1,"ports":1},{"path":"/global-protect/login.esp","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","Referer","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip,deflate","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Referer","value":"https://www.google.com","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2036","tag_type":"cve","title":"Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/global-protect/login.esp","reference_urls":["https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/","https://security.paloaltonetworks.com/CVE-2020-2036","https://nvd.nist.gov/vuln/detail/CVE-2020-2036","https://github.com/404notf0und/CVE-Flow","https://github.com/ARPSyndicate/kenzer-templates"]}],"data_as_of":"2026-07-28T09:17:35.629339+00:00"}