{"ip":"87.192.41.180","data_as_of":"2026-10-26T11:43:24+00:00","observed":true,"total_events":203,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 145 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"81,806 bytes sent","bytes_sent":81806,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-16T23:07:11","last_seen":"2026-10-22T05:08:16","events_24h":0,"events_7d":88,"interactive_sessions":145,"interactive_sessions_24h":0,"interactive_sessions_7d":116,"interactive_protocols":[{"protocol":"http","sessions":145}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":218751,"org":"Fontaine, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":145,"first_seen":"2026-10-19T03:28:47","last_seen":"2026-10-21T23:38:40","verdicts":[{"verdict":"scan","sessions":145}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":65},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":44},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":36}],"services":[{"protocol":"http","port":8000,"sessions":94},{"protocol":"http","port":8080,"sessions":22},{"protocol":"http","port":80,"sessions":22},{"protocol":"http","port":4000,"sessions":7}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":145}]},"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":42,"sessions":94},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":50,"sessions":22},{"port":80,"proto":"tcp","label":"HTTP","count":24,"sessions":22},{"port":3000,"proto":"tcp","label":"Web-alt","count":21,"sessions":0},{"port":5000,"proto":"tcp","label":"Web-alt","count":14,"sessions":0},{"port":5173,"proto":"tcp","label":"","count":13,"sessions":0},{"port":8081,"proto":"tcp","label":"","count":12,"sessions":0},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":11,"sessions":0},{"port":4000,"proto":"tcp","label":"","count":4,"sessions":7},{"port":3001,"proto":"tcp","label":"","count":8,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i100900_61a7ad8aa9b6_f2fd57e44be6","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"16030100d9010000d50303f863525f7f4f8dec86a210c770446af4864a65613eab35a2c15243b277741994202a92044279f85bf5c058451994acfb7ffa93f0b908f6e79e615583e6b51601fe0014130213011303c02cc02bcca9c030c02fcca800ff01000078000500050100000000002d00020101000b00020100003300260024001d0020f2a2a2e3b2b5cac1955875db5c6aedace3cb50361d7ca977cc7cc64fc602e425002b000504030403030023000000170000000d0018001604010501060104030503060308040805080608070808000a00080006001d001700","tls_ja3":["e0ca3c709c39182fef96140bbdff8010","41bba11fbed185d5e337499688546196","ddbe0254f974429a9884e265c4b95339","2579234c5a92b478aa37a2e3d84b4be2"],"http_akin":["b11cun040_00040015_ccbfc00b","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040015_ccbfc00b":3,"b11cun030_00040011_c91eaf54":976,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":51,"t13i100900_61a7ad8aa9b6_f2fd57e44be6":2},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-16","count":8,"sessions":0},{"date":"2026-10-17","count":67,"sessions":0},{"date":"2026-10-18","count":23,"sessions":0},{"date":"2026-10-19","count":17,"sessions":29},{"date":"2026-10-21","count":62,"sessions":116},{"date":"2026-10-22","count":26,"sessions":0}],"recent_events":[{"timestamp":"2026-10-22T05:08:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/video","summary":"","payload_hex":"474554202f6170692f766964656f20485454502f312e310d0a636f6e6e656374696f6e3a20636c6f73650d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a333030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"5f27fea5-db1c-4dc2-bf37-f11ed1d486a2","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":78},{"timestamp":"2026-10-22T01:19:44","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../../../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e2e2f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"def2a6f5-faf3-4c9b-b9b7-c9b0f1419cce","seq":1,"duration_ms":100,"bytes_in":247,"bytes_out":78},{"timestamp":"2026-10-22T01:19:30","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"a38728b7-a45d-4407-a454-695b0e83057b","seq":1,"duration_ms":100,"bytes_in":244,"bytes_out":78},{"timestamp":"2026-10-22T01:19:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"93a0e0da-f748-49b7-bd6e-0d478cf2be77","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":78},{"timestamp":"2026-10-22T01:19:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a636f6e6e656374696f6e3a20636c6f73650d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a333030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"e3a257f4-2c8b-4317-9f23-18fa49c382e4","seq":1,"duration_ms":100,"bytes_in":251,"bytes_out":78},{"timestamp":"2026-10-22T01:10:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../../../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e2e2f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"23c78c9a-81b4-48aa-aa93-5174613b226e","seq":1,"duration_ms":100,"bytes_in":248,"bytes_out":78},{"timestamp":"2026-10-22T01:10:03","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"2f58b7ee-952e-4827-824a-385c3abfc69d","seq":1,"duration_ms":100,"bytes_in":245,"bytes_out":78},{"timestamp":"2026-10-22T01:09:49","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"5a78d4f7-e20d-4632-977d-d7d98e529745","seq":1,"duration_ms":100,"bytes_in":242,"bytes_out":78},{"timestamp":"2026-10-22T01:09:49","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a636f6e6e656374696f6e3a20636c6f73650d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a333030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"d033d0ed-c50f-4c4d-9a12-5ddd1cd7738d","seq":1,"duration_ms":100,"bytes_in":252,"bytes_out":78},{"timestamp":"2026-10-22T00:38:25","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/../../../.config/gcloud/application_default_credentials.json","summary":"","payload_hex":"474554202f2e2e2f2e2e2f2e2e2f2e636f6e6669672f67636c6f75642f6170706c69636174696f6e5f64656661756c745f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"3dc4a526-5a29-44e9-970f-4dc3c1a195ae","seq":1,"duration_ms":100,"bytes_in":248,"bytes_out":78}],"http_methods":[{"method":"GET","count":348}],"distinct_ports_total":11,"top_paths":[{"path":"/.claude/.credentials.json","count":42,"ports":11},{"path":"/../.claude/.credentials.json","count":42,"ports":11},{"path":"/../../.claude/.credentials.json","count":42,"ports":11},{"path":"/../../../.claude/.credentials.json","count":40,"ports":10},{"path":"/.config/gcloud/application_default_credentials.json","count":16,"ports":4},{"path":"/../../.config/gcloud/application_default_credentials.json","count":15,"ports":4},{"path":"/../.config/gcloud/application_default_credentials.json","count":15,"ports":4},{"path":"/../../../.config/gcloud/application_default_credentials.json","count":13,"ports":4},{"path":"/%2e%2e/.claude/.credentials.json","count":4,"ports":4},{"path":"/%2e%2e%2f.claude%2f.credentials.json","count":4,"ports":4},{"path":"/..%2f.claude%2f.credentials.json","count":4,"ports":4},{"path":"/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2froot%2f.claude%2f.credentials.json","count":3,"ports":3},{"path":"/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fhome%2fclaude%2f.claude%2f.credentials.json","count":3,"ports":3},{"path":"/..%2f..%2f..%2f..%2f..%2f..%2fhome%2fdebian%2f.claude%2f.credentials.json","count":3,"ports":3},{"path":"/../../../../../../home/ubuntu/.claude/.credentials.json","count":3,"ports":3}],"distinct_paths_total":60,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[]}