{"ip":"89.248.171.24","total_events":9515,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"groupib","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (groupib).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,236,379 bytes sent","bytes_sent":1236379,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T02:42:23","last_seen":"2026-09-10T16:47:07","events_24h":47,"events_7d":9515,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":202425,"org":"IP Volume inc"},"source_domain":"rnd.group-ib.com","known_scanners":["groupib","Group-IB"],"scanner_tag":{"key":"group-ib","label":"Group-IB","category":"commercial","url":"https://www.group-ib.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":10259,"proto":"tcp","label":"","count":61},{"port":135,"proto":"tcp","label":"MSRPC","count":56},{"port":9042,"proto":"tcp","label":"Cassandra","count":56},{"port":9083,"proto":"tcp","label":"","count":55},{"port":9955,"proto":"tcp","label":"","count":55},{"port":58888,"proto":"tcp","label":"","count":55},{"port":9440,"proto":"tcp","label":"","count":55},{"port":84,"proto":"tcp","label":"","count":55},{"port":2525,"proto":"tcp","label":"","count":55},{"port":3365,"proto":"tcp","label":"","count":54},{"port":1500,"proto":"tcp","label":"","count":54},{"port":1197,"proto":"tcp","label":"","count":54},{"port":58846,"proto":"tcp","label":"","count":54},{"port":3460,"proto":"tcp","label":"","count":54},{"port":7895,"proto":"tcp","label":"","count":54}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1516h2_8daaf6152771_b1ff8ab2d16f","t13i191000_9dc949149365_be53661681a4","t13i191100_9dc949149365_3d9b77117d33","t13i190900_9dc949149365_e7c285222651","t13i1515h2_8daaf6152771_02713d6af862"],"tls_ja3":["3fd161239f5d11313d619d5c8ea68c6b","9f34e48f8ebb9ff1add2cf71c0a7550e","d6828e30ab66774a91a96ae93be4ae4c","920c2877a5926d9eae013ae9c663a398","c83d0f5a46af928a2e62c5641a4f19f5"],"ja4h":["ge11nn0200_fdb5000be5f4","ge11nn0400_9c3956fad5da","ge11nn0800_b66e4b549df6","ge11nn1200_3460fc11a216"]},"fingerprint_peers":{"t13i1516h2_8daaf6152771_b1ff8ab2d16f":6,"t13i191000_9dc949149365_be53661681a4":5,"t13i191100_9dc949149365_3d9b77117d33":3,"t13i190900_9dc949149365_e7c285222651":2425,"t13i1515h2_8daaf6152771_02713d6af862":63,"ge11nn0200_fdb5000be5f4":11,"ge11nn0400_9c3956fad5da":1586,"ge11nn0800_b66e4b549df6":8,"ge11nn1200_3460fc11a216":6},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","Python/3.10 aiohttp/3.8.4","fasthttp"],"timeline":[{"date":"2026-09-07","count":8090},{"date":"2026-09-08","count":1337},{"date":"2026-09-09","count":43},{"date":"2026-09-10","count":45}],"recent_events":[{"timestamp":"2026-09-10T16:47:07","port":45001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:45001\",\"pragma\":\"no-cache\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34353030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d557365723a203f310d0a5365632d46657463682d446573743a20646f63756d656e740d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","ja3":"469280c4f89a60bdd4fce85a8bdf8c3e","session":"91f31c21-9791-49b9-972c-8d8328eae4c1","seq":1,"duration_ms":100,"bytes_in":541,"bytes_out":78},{"timestamp":"2026-09-10T16:42:46","port":2095,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2095\",\"pragma\":\"no-cache\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d557365723a203f310d0a5365632d46657463682d446573743a20646f63756d656e740d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","ja3":"af6bb06706bfc4370464683b8ee7b946","session":"0c679236-79cf-4090-bb0f-71603829c6a8","seq":1,"duration_ms":101,"bytes_in":540,"bytes_out":78},{"timestamp":"2026-09-10T16:41:55","port":2095,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:2095\",\"user-agent\":\"fasthttp\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a2066617374687474700d0a486f73743a20<HONEYPOT>3a323039350d0a0d0a","method":"GET","user_agent":"fasthttp","ja3":"920c2877a5926d9eae013ae9c663a398","session":"9efcebb3-cfd0-4b42-95b7-77475b8d8775","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":78},{"timestamp":"2026-09-10T15:57:32","port":8022,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8022\",\"user-agent\":\"fasthttp\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a2066617374687474700d0a486f73743a20<HONEYPOT>3a383032320d0a0d0a","method":"GET","user_agent":"fasthttp","ja3":"920c2877a5926d9eae013ae9c663a398","session":"996dcffb-9b76-4376-b389-9f8fd92a3662","seq":1,"duration_ms":101,"bytes_in":65,"bytes_out":78},{"timestamp":"2026-09-10T15:54:40","port":58888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:58888\",\"pragma\":\"no-cache\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35383838380d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d557365723a203f310d0a5365632d46657463682d446573743a20646f63756d656e740d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","ja3":"cf4360694b4fc6a7f9095df90c9816e8","session":"2371941a-5f0a-4305-aa8b-c3feb612b8c4","seq":1,"duration_ms":100,"bytes_in":541,"bytes_out":78},{"timestamp":"2026-09-10T15:53:25","port":58888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:58888\",\"user-agent\":\"fasthttp\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a2066617374687474700d0a486f73743a20<HONEYPOT>3a35383838380d0a0d0a","method":"GET","user_agent":"fasthttp","ja3":"920c2877a5926d9eae013ae9c663a398","session":"26f17968-171e-4a6d-9c0e-6d05a0bbf51e","seq":1,"duration_ms":101,"bytes_in":66,"bytes_out":78},{"timestamp":"2026-09-10T15:48:14","port":11099,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11099\",\"pragma\":\"no-cache\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313039390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d557365723a203f310d0a5365632d46657463682d446573743a20646f63756d656e740d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","ja3":"828a67ad9922706c08166ed6588f532b","session":"f3603b0d-1d93-4ec4-bc84-1220152c76c4","seq":1,"duration_ms":101,"bytes_in":541,"bytes_out":78},{"timestamp":"2026-09-10T15:47:19","port":11099,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:11099\",\"user-agent\":\"fasthttp\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a2066617374687474700d0a486f73743a20<HONEYPOT>3a31313039390d0a0d0a","method":"GET","user_agent":"fasthttp","ja3":"920c2877a5926d9eae013ae9c663a398","session":"052c9889-996e-4ff9-bf30-77fcc2a4561d","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":78},{"timestamp":"2026-09-10T15:27:56","port":19527,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:19527\",\"user-agent\":\"fasthttp\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a2066617374687474700d0a486f73743a20<HONEYPOT>3a31393532370d0a0d0a","method":"GET","user_agent":"fasthttp","ja3":"920c2877a5926d9eae013ae9c663a398","session":"f487356f-b0da-4239-ba34-0250e09686a8","seq":1,"duration_ms":101,"bytes_in":67,"bytes_out":78},{"timestamp":"2026-09-10T14:37:57","port":9083,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9083\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a393038330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"0b4e580f-248a-4b1e-8b4b-333691942915","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":78}],"http_methods":[{"method":"GET","count":9510}],"distinct_ports_total":258,"top_paths":[{"path":"/","count":9356,"ports":257},{"path":"/aab9","count":77,"ports":63},{"path":"/aaa9","count":77,"ports":63}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":22}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Cache-Control","Connection","Host","Pragma","Sec-Fetch-Dest","Sec-Fetch-Mode","Sec-Fetch-Site","Sec-Fetch-User","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:45001","notable":false},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Fetch-Dest","value":"document","notable":false},{"name":"Sec-Fetch-Mode","value":"navigate","notable":false},{"name":"Sec-Fetch-Site","value":"none","notable":false},{"name":"Sec-Fetch-User","value":"?1","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-10T23:04:07.945426+00:00"}