{"ip":"80.82.70.133","total_events":1539,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"groupib","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (groupib).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"154,931 bytes sent","bytes_sent":154931,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T17:09:53","last_seen":"2026-08-06T22:03:34","events_24h":14,"events_7d":446,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":202425,"org":"IP Volume inc"},"source_domain":"rnd.group-ib.com","known_scanners":["groupib","Group-IB"],"scanner_tag":{"key":"group-ib","label":"Group-IB","category":"commercial","url":"https://www.group-ib.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":7777,"proto":"tcp","label":"Oracle","count":343},{"port":6379,"proto":"tcp","label":"Redis","count":51},{"port":3306,"proto":"tcp","label":"MySQL","count":46},{"port":5000,"proto":"tcp","label":"Web-alt","count":41},{"port":3000,"proto":"tcp","label":"Web-alt","count":41},{"port":9876,"proto":"tcp","label":"","count":40},{"port":9042,"proto":"tcp","label":"Cassandra","count":39},{"port":11211,"proto":"tcp","label":"Memcached","count":38},{"port":443,"proto":"tcp","label":"HTTPS","count":37},{"port":80,"proto":"tcp","label":"HTTP","count":36},{"port":9200,"proto":"tcp","label":"Elastic","count":36},{"port":6443,"proto":"tcp","label":"k8s API","count":36},{"port":2375,"proto":"tcp","label":"Docker","count":34},{"port":3389,"proto":"tcp","label":"RDP","count":33},{"port":64359,"proto":"tcp","label":"","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190900_9dc949149365_e7c285222651"],"tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c"],"ja4h":["ge10nn0200_5594a17e7e7e","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i190900_9dc949149365_e7c285222651":3449,"ge11nn0400_9c3956fad5da":1560,"ge10nn0200_5594a17e7e7e":1969},"user_agents":["Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.17) Gecko/20110123 (like Firefox/3.x) SeaMonkey/2.0.12","Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch; NOKIA; Lumia 920)","Mozilla/5.0 (Linux; Android 9; Redmi K20 Pro Build/PKQ1.181121.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/4406 MicroMessenger/7.0.6.1460(0x27000634) Process/tools NetType/WIFI Language/zh_CN","Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/527  (KHTML, like Gecko, Safari/419.3) Arora/0.6 (Change: )","Mozilla/5.0 Slackware/13.37 (X11; U; Linux x86_64; en-US) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41","Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0","Mozilla/5.0 (Linux; Android 9; Pixel 2 XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.18 Mobile Safari/537.36"],"timeline":[{"date":"2026-05-09","count":2},{"date":"2026-05-10","count":10},{"date":"2026-05-11","count":7},{"date":"2026-05-12","count":9},{"date":"2026-05-13","count":7},{"date":"2026-05-14","count":12},{"date":"2026-05-15","count":7},{"date":"2026-05-16","count":10},{"date":"2026-05-17","count":6},{"date":"2026-05-18","count":7},{"date":"2026-05-19","count":4},{"date":"2026-05-20","count":3},{"date":"2026-05-21","count":3},{"date":"2026-05-23","count":2},{"date":"2026-05-26","count":3},{"date":"2026-05-27","count":1},{"date":"2026-05-28","count":1},{"date":"2026-05-30","count":1},{"date":"2026-05-31","count":3},{"date":"2026-06-01","count":4},{"date":"2026-06-02","count":5},{"date":"2026-06-03","count":2},{"date":"2026-06-04","count":2},{"date":"2026-06-05","count":5},{"date":"2026-06-08","count":5},{"date":"2026-07-15","count":6},{"date":"2026-07-16","count":20},{"date":"2026-07-27","count":20},{"date":"2026-07-29","count":68},{"date":"2026-07-30","count":80},{"date":"2026-07-31","count":78},{"date":"2026-08-01","count":74},{"date":"2026-08-02","count":66},{"date":"2026-08-03","count":92},{"date":"2026-08-04","count":72},{"date":"2026-08-05","count":74},{"date":"2026-08-06","count":54}],"recent_events":[{"timestamp":"2026-08-06T22:03:34","port":500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a3530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"c9a6949e-03f9-4d4d-9d57-6bb2313aa3d5","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-08-06T22:03:33","port":500,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a3530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"2f0ed12a-ac71-4c2d-9dd5-f1d32f517642","seq":1,"duration_ms":101,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-08-06T21:29:01","port":135,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:135\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a3133350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"e12d705e-5848-4130-9d3f-14c992913691","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-08-06T21:29:01","port":135,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:135\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a3133350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"1eb23518-9c25-4295-b750-de8f7ee75c4f","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-08-06T20:30:55","port":1198,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1198\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a313139380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"7e6edf81-171a-4d98-b143-8e760ef655c0","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-08-06T20:30:55","port":1198,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1198\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a313139380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"cdc89c32-58ea-4d2f-8279-bf9b115684eb","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-08-06T20:06:27","port":9876,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9876\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a393837360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"a865c486-5a77-44f7-bfc4-1eed4dc132ee","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-08-06T20:06:27","port":9876,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9876\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a393837360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"6890419f-0ba1-4817-acda-75a9d533ae82","seq":1,"duration_ms":101,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-08-06T20:01:15","port":9445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a393434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"7030541a-64df-4350-ab81-0c5982c02211","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-08-06T20:01:15","port":9445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a393434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"08833c8c-e1c7-4554-96db-45d9301c83be","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77}],"http_methods":[{"method":"GET","count":879}],"distinct_ports_total":156,"top_paths":[{"path":"/aab9","count":352,"ports":153},{"path":"/aaa9","count":352,"ports":153},{"path":"/","count":175,"ports":17}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:500","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-07T17:44:57.966773+00:00"}