diff options
Diffstat (limited to '2026/2026-06-27-ornith/m5-9b-transcript.md')
| -rw-r--r-- | 2026/2026-06-27-ornith/m5-9b-transcript.md | 413 |
1 files changed, 413 insertions, 0 deletions
diff --git a/2026/2026-06-27-ornith/m5-9b-transcript.md b/2026/2026-06-27-ornith/m5-9b-transcript.md new file mode 100644 index 0000000..749374c --- /dev/null +++ b/2026/2026-06-27-ornith/m5-9b-transcript.md @@ -0,0 +1,413 @@ +# Honeylabs summary and Censys IP enrichment + +**Session ID:** ses_0f6375975ffeRO9RxoEpGcl6z5 +**Created:** 6/27/2026, 11:52:52 AM +**Updated:** 6/27/2026, 11:53:35 AM + +--- + +## User + +give me a summary of what's going on at honeylabs and enrich key IPs with Censys + +--- + +## Assistant (Sisyphus - Ultraworker · DeepSeek V4 Flash · 9.7s) + +_Thinking:_ + +The user wants two things: +1. A summary of what's going on at Honeylabs (honeypot data) +2. Enrich key IPs with Censys + +Let me start by getting a broad view of Honeylabs data - recent activity, top attackers, etc. I'll also check the Arkime data since that seems to be related. + +I detect an investigation/research intent - the user wants a situational awareness report from Honeylabs data with Censys enrichment. + +Let me launch parallel queries to get the big picture: +1. Honeylabs: attack timeline (recent activity) +2. Honeylabs: top attackers by IP +3. Honeylabs: top attackers by country +4. Honeylabs: top targeted ports +5. Honeylabs: top attackers by ASN + +Then I'll use the results to identify key IPs to enrich with Censys. + +Let me start with the broad queries. I'll use the last 24h or 7d for a good overview. + +Actually, let me think about what "summary of what's going on" means - attack trends, top attackers, most targeted ports, etc. Let me fire parallel queries. + +I detect investigation/research intent - synthesizing a threat landscape from Honeylabs then enriching key IPs with Censys. Approach: parallel Honeylabs queries for broad view, then cross-reference top IPs with Censys. + +Let me start by gathering the landscape in parallel. + +**Tool: honeylabs_attack_timeline_tool** + +**Input:** +```json +{ + "since": "2026-06-26T00:00:00Z", + "until": "2026-06-27T23:59:59Z", + "bucket": "hour" +} +``` + +**Output:** +``` +{"result":[{"bucket":"2026-06-26T00:00:00","event_count":9789,"unique_sources":1285},{"bucket":"2026-06-26T01:00:00","event_count":9340,"unique_sources":1873},{"bucket":"2026-06-26T02:00:00","event_count":15119,"unique_sources":1108},{"bucket":"2026-06-26T03:00:00","event_count":7705,"unique_sources":916},{"bucket":"2026-06-26T04:00:00","event_count":8539,"unique_sources":1069},{"bucket":"2026-06-26T05:00:00","event_count":16574,"unique_sources":1937},{"bucket":"2026-06-26T06:00:00","event_count":8354,"unique_sources":1015},{"bucket":"2026-06-26T07:00:00","event_count":7686,"unique_sources":968},{"bucket":"2026-06-26T08:00:00","event_count":9245,"unique_sources":909},{"bucket":"2026-06-26T09:00:00","event_count":8311,"unique_sources":1812},{"bucket":"2026-06-26T10:00:00","event_count":8205,"unique_sources":1048},{"bucket":"2026-06-26T11:00:00","event_count":12228,"unique_sources":976},{"bucket":"2026-06-26T12:00:00","event_count":7658,"unique_sources":921},{"bucket":"2026-06-26T13:00:00","event_count":8329,"unique_sources":1303},{"bucket":"2026-06-26T14:00:00","event_count":7889,"unique_sources":1010},{"bucket":"2026-06-26T15:00:00","event_count":8179,"unique_sources":850},{"bucket":"2026-06-26T16:00:00","event_count":9415,"unique_sources":809},{"bucket":"2026-06-26T17:00:00","event_count":10454,"unique_sources":1762},{"bucket":"2026-06-26T18:00:00","event_count":8429,"unique_sources":1186},{"bucket":"2026-06-26T19:00:00","event_count":8514,"unique_sources":943},{"bucket":"2026-06-26T20:00:00","event_count":9977,"unique_sources":938},{"bucket":"2026-06-26T21:00:00","event_count":10529,"unique_sources":1706},{"bucket":"2026-06-26T22:00:00","event_count":8692,"unique_sources":814},{"bucket":"2026-06-26T23:00:00","event_count":10300,"unique_sources":869},{"bucket":"2026-06-27T00:00:00","event_count":9349,"unique_sources":930},{"bucket":"2026-06-27T01:00:00","event_count":9506,"unique_sources":1688},{"bucket":"2026-06-27T02:00:00","event_count":9265,"unique_sources":1031},{"bucket":"2026-06-27T03:00:00","event_count":32234,"unique_sources":850},{"bucket":"2026-06-27T04:00:00","event_count":13212,"unique_sources":946},{"bucket":"2026-06-27T05:00:00","event_count":10216,"unique_sources":1803},{"bucket":"2026-06-27T06:00:00","event_count":11082,"unique_sources":910},{"bucket":"2026-06-27T07:00:00","event_count":6639,"unique_sources":842},{"bucket":"2026-06-27T08:00:00","event_count":8306,"unique_sources":896},{"bucket":"2026-06-27T09:00:00","event_count":9062,"unique_sources":1741},{"bucket":"2026-06-27T10:00:00","event_count":8317,"unique_sources":1516},{"bucket":"2026-06-27T11:00:00","event_count":8409,"unique_sources":826},{"bucket":"2026-06-27T12:00:00","event_count":7735,"unique_sources":772},{"bucket":"2026-06-27T13:00:00","event_count":8496,"unique_sources":1623},{"bucket":"2026-06-27T14:00:00","event_count":12525,"unique_sources":786},{"bucket":"2026-06-27T15:00:00","event_count":15248,"unique_sources":869}]} +``` + +**Tool: honeylabs_top_attackers_tool** + +**Input:** +```json +{ + "since": "2026-06-26T00:00:00Z", + "until": "2026-06-27T23:59:59Z", + "by": "ip", + "limit": 20 +} +``` + +**Output:** +``` +{"result":[{"value":"::ffff:79.124.58.126","event_count":21148,"unique_ips":1,"first_seen":"2026-06-26T00:00:05","last_seen":"2026-06-27T15:49:18","top_ports":[26224,46925,54537,44559,32375],"countries":["BG"],"asn_org":"Tamatiya EOOD","asn_number":50360,"country_name":"Bulgaria"},{"value":"::ffff:179.111.21.60","event_count":11594,"unique_ips":1,"first_seen":"2026-06-27T03:01:06","last_seen":"2026-06-27T03:28:37","top_ports":[53],"countries":["BR"],"asn_org":"TELEFONICA BRASIL S.A","asn_number":27699,"country_name":"Brazil"},{"value":"::ffff:185.177.72.38","event_count":6021,"unique_ips":1,"first_seen":"2026-06-27T03:10:29","last_seen":"2026-06-27T03:35:41","top_ports":[50050],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:185.177.72.205","event_count":6000,"unique_ips":1,"first_seen":"2026-06-27T04:01:22","last_seen":"2026-06-27T15:11:04","top_ports":[50050,8417],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:62.164.177.41","event_count":3522,"unique_ips":1,"first_seen":"2026-06-26T04:18:15","last_seen":"2026-06-27T15:51:28","top_ports":[59352,6981,60715,16613,50040],"countries":["NL"],"asn_org":"Data Campus Limited","asn_number":215929,"country_name":"The Netherlands"},{"value":"::ffff:185.177.72.24","event_count":3015,"unique_ips":1,"first_seen":"2026-06-27T14:10:49","last_seen":"2026-06-27T14:16:22","top_ports":[8417],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:185.177.72.68","event_count":3006,"unique_ips":1,"first_seen":"2026-06-27T14:28:03","last_seen":"2026-06-27T14:33:36","top_ports":[8417],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:185.177.72.54","event_count":3000,"unique_ips":1,"first_seen":"2026-06-27T15:11:36","last_seen":"2026-06-27T15:17:36","top_ports":[50050],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:85.217.140.10","event_count":2454,"unique_ips":1,"first_seen":"2026-06-26T05:12:32","last_seen":"2026-06-27T09:18:06","top_ports":[58185,7684,44965,54078,37256],"countries":["FR"],"asn_org":"Modat B.V.","asn_number":209334,"country_name":"France"},{"value":"::ffff:80.82.77.202","event_count":2368,"unique_ips":1,"first_seen":"2026-06-26T00:04:45","last_seen":"2026-06-27T15:22:18","top_ports":[7777,9955,7895,5000,6443],"countries":["NL"],"asn_org":"IP Volume inc","asn_number":202425,"country_name":"The Netherlands"},{"value":"::ffff:85.217.140.19","event_count":2368,"unique_ips":1,"first_seen":"2026-06-26T05:44:36","last_seen":"2026-06-27T12:37:21","top_ports":[31782,27756,994,29501,50095],"countries":["FR"],"asn_org":"Modat B.V.","asn_number":209334,"country_name":"France"},{"value":"::ffff:185.93.89.121","event_count":2112,"unique_ips":1,"first_seen":"2026-06-26T09:41:31","last_seen":"2026-06-26T14:45:52","top_ports":[26915,60470,5110,44743,27835],"countries":["IR"],"asn_org":"Limited Network LTD","asn_number":213790,"country_name":"Iran"},{"value":"::ffff:185.177.72.51","event_count":1789,"unique_ips":1,"first_seen":"2026-06-27T04:43:35","last_seen":"2026-06-27T04:50:30","top_ports":[443],"countries":["FR"],"asn_org":"Bucklog SARL","asn_number":211590,"country_name":"France"},{"value":"::ffff:74.195.44.207","event_count":1776,"unique_ips":1,"first_seen":"2026-06-26T00:01:31","last_seen":"2026-06-26T17:01:32","top_ports":[25565,9130,25696,28000,9090],"countries":["US"],"asn_org":"Optimum","asn_number":19108,"country_name":"United States"},{"value":"::ffff:31.14.32.6","event_count":1637,"unique_ips":1,"first_seen":"2026-06-26T11:21:36","last_seen":"2026-06-27T09:16:27","top_ports":[37561,16215,57262,17303,27810],"countries":["NL"],"asn_org":"NewVM B.V.","asn_number":201401,"country_name":"The Netherlands"},{"value":"::ffff:77.83.36.160","event_count":1626,"unique_ips":1,"first_seen":"2026-06-26T19:30:54","last_seen":"2026-06-27T14:09:56","top_ports":[3389,3400,3396,3381,3399],"countries":["UA"],"asn_org":"Layer7 Networks GmbH","asn_number":214403,"country_name":"Ukraine"},{"value":"::ffff:85.217.140.12","event_count":1600,"unique_ips":1,"first_seen":"2026-06-26T05:41:23","last_seen":"2026-06-27T14:55:04","top_ports":[6042,9653,44171,5899,50103],"countries":["FR"],"asn_org":"Modat B.V.","asn_number":209334,"country_name":"France"},{"value":"::ffff:85.217.140.11","event_count":1566,"unique_ips":1,"first_seen":"2026-06-26T02:35:24","last_seen":"2026-06-27T06:24:50","top_ports":[16379,21176,48874,23788,54550],"countries":["FR"],"asn_org":"Modat B.V.","asn_number":209334,"country_name":"France"},{"value":"::ffff:45.198.224.18","event_count":1255,"unique_ips":1,"first_seen":"2026-06-26T00:01:11","last_seen":"2026-06-27T15:36:47","top_ports":[8728],"countries":["US"],"asn_org":"Vpsvault.host Ltd","asn_number":215925,"country_name":"United States"},{"value":"::ffff:160.119.71.136","event_count":1252,"unique_ips":1,"first_seen":"2026-06-26T00:03:32","last_seen":"2026-06-27T15:52:43","top_ports":[30002,4100,3443,8098,30023],"countries":["SC"],"asn_org":"Alsycon B.V.","asn_number":49870,"country_name":"Seychelles"}]} +``` + +**Tool: honeylabs_top_attackers_tool** + +**Input:** +```json +{ + "since": "2026-06-26T00:00:00Z", + "until": "2026-06-27T23:59:59Z", + "by": "country", + "limit": 20 +} +``` + +**Output:** +``` +{"result":[{"value":"US","event_count":179583,"unique_ips":5688,"first_seen":"2026-06-26T00:00:01","last_seen":"2026-06-27T15:52:52","top_ports":[80,443,40261,9090,27017],"countries":["US"],"country_name":"United States"},{"value":"GB","event_count":60157,"unique_ips":600,"first_seen":"2026-06-26T00:00:00","last_seen":"2026-06-27T15:50:24","top_ports":[23388,3387,23389,1001,63389],"countries":["GB"],"country_name":"United Kingdom"},{"value":"FR","event_count":58256,"unique_ips":490,"first_seen":"2026-06-26T00:00:29","last_seen":"2026-06-27T15:52:39","top_ports":[50050,8417,443,5173,80],"countries":["FR"],"country_name":"France"},{"value":"BG","event_count":24086,"unique_ips":15,"first_seen":"2026-06-26T00:00:05","last_seen":"2026-06-27T15:49:40","top_ports":[9652,8394,26224,9927,46925],"countries":["BG"],"country_name":"Bulgaria"},{"value":"NL","event_count":16736,"unique_ips":137,"first_seen":"2026-06-26T00:00:05","last_seen":"2026-06-27T15:52:39","top_ports":[22,443,5432,8080,23],"countries":["NL"],"country_name":"The Netherlands"},{"value":"BR","event_count":13836,"unique_ips":77,"first_seen":"2026-06-26T00:01:18","last_seen":"2026-06-27T15:49:15","top_ports":[53,135,8728,445,52869],"countries":["BR"],"country_name":"Brazil"},{"value":"CA","event_count":6837,"unique_ips":82,"first_seen":"2026-06-26T00:56:08","last_seen":"2026-06-27T15:46:38","top_ports":[445,443,102,21230,10026],"countries":["CA"],"country_name":"Canada"},{"value":"CN","event_count":5638,"unique_ips":942,"first_seen":"2026-06-26T00:02:58","last_seen":"2026-06-27T15:51:47","top_ports":[22,135,445,1433,443],"countries":["CN"],"country_name":"China"},{"value":"DE","event_count":4213,"unique_ips":444,"first_seen":"2026-06-26T00:00:39","last_seen":"2026-06-27T15:50:51","top_ports":[443,80,8080,8443,9092],"countries":["DE"],"country_name":"Germany"},{"value":"SG","event_count":3991,"unique_ips":332,"first_seen":"2026-06-26T00:01:17","last_seen":"2026-06-27T15:52:55","top_ports":[80,3333,443,22,7676],"countries":["SG"],"country_name":"Singapore"},{"value":"IR","event_count":3183,"unique_ips":39,"first_seen":"2026-06-26T00:00:03","last_seen":"2026-06-27T15:47:32","top_ports":[445,22,1433,8545,26915],"countries":["IR"],"country_name":"Iran"},{"value":"HK","event_count":3163,"unique_ips":323,"first_seen":"2026-06-26T00:06:29","last_seen":"2026-06-27T15:48:51","top_ports":[9200,445,587,5601,8766],"countries":["HK"],"country_name":"Hong Kong"},{"value":"RO","event_count":2523,"unique_ips":16,"first_seen":"2026-06-26T00:02:15","last_seen":"2026-06-27T15:45:50","top_ports":[22,443,3389,80,3128],"countries":["RO"],"country_name":"Romania"},{"value":"RU","event_count":2437,"unique_ips":73,"first_seen":"2026-06-26T00:44:22","last_seen":"2026-06-27T15:29:59","top_ports":[135,554,445,443,9443],"countries":["RU"],"country_name":"Russia"},{"value":"TW","event_count":2341,"unique_ips":31,"first_seen":"2026-06-26T00:00:11","last_seen":"2026-06-27T15:29:05","top_ports":[80,445,11095,6379,22],"countries":["TW"],"country_name":"Taiwan"},{"value":"ID","event_count":1828,"unique_ips":87,"first_seen":"2026-06-26T00:03:53","last_seen":"2026-06-27T15:42:35","top_ports":[135,445,443,1433,31099],"countries":["ID"],"country_name":"Indonesia"},{"value":"SC","event_count":1708,"unique_ips":17,"first_seen":"2026-06-26T00:03:32","last_seen":"2026-06-27T15:52:43","top_ports":[83,90,84,30002,30023],"countries":["SC"],"country_name":"Seychelles"},{"value":"UA","event_count":1680,"unique_ips":12,"first_seen":"2026-06-26T01:00:21","last_seen":"2026-06-27T14:09:56","top_ports":[443,445,2053,8080,3397],"countries":["UA"],"country_name":"Ukraine"},{"value":"BE","event_count":1347,"unique_ips":140,"first_seen":"2026-06-26T00:26:04","last_seen":"2026-06-27T15:46:06","top_ports":[23,143,990,21,110],"countries":["BE"],"country_name":"Belgium"},{"value":"TH","event_count":1278,"unique_ips":72,"first_seen":"2026-06-26T00:00:20","last_seen":"2026-06-27T15:35:51","top_ports":[445,102,82,10291,1688],"countries":["TH"],"country_name":"Thailand"}]} +``` + +**Tool: honeylabs_top_attackers_tool** + +**Input:** +```json +{ + "since": "2026-06-26T00:00:00Z", + "until": "2026-06-27T23:59:59Z", + "by": "port", + "limit": 20 +} +``` + +**Output:** +``` +{"result":[{"value":50050,"event_count":12126,"unique_ips":15,"first_seen":"2026-06-26T00:05:09","last_seen":"2026-06-27T15:46:38","top_ports":[50050],"countries":["FR","NL","US"]},{"value":53,"event_count":11810,"unique_ips":52,"first_seen":"2026-06-26T00:09:51","last_seen":"2026-06-27T15:33:58","top_ports":[53],"countries":["BR","NL","BE"]},{"value":8417,"event_count":9023,"unique_ips":5,"first_seen":"2026-06-26T10:09:10","last_seen":"2026-06-27T15:11:04","top_ports":[8417],"countries":["FR","US"]},{"value":445,"event_count":5859,"unique_ips":603,"first_seen":"2026-06-26T00:03:53","last_seen":"2026-06-27T15:44:02","top_ports":[445],"countries":["ID","IN","IR"]},{"value":443,"event_count":4720,"unique_ips":339,"first_seen":"2026-06-26T00:08:49","last_seen":"2026-06-27T15:46:06","top_ports":[443],"countries":["FR","DE","US"]},{"value":80,"event_count":4049,"unique_ips":289,"first_seen":"2026-06-26T00:01:18","last_seen":"2026-06-27T15:49:15","top_ports":[80],"countries":["US","TW","DE"]},{"value":22,"event_count":3866,"unique_ips":239,"first_seen":"2026-06-26T00:00:05","last_seen":"2026-06-27T15:51:37","top_ports":[22],"countries":["CN","NL","PA"]},{"value":135,"event_count":3059,"unique_ips":56,"first_seen":"2026-06-26T01:59:48","last_seen":"2026-06-27T15:21:07","top_ports":[135],"countries":["ID","BR","RU"]},{"value":8728,"event_count":1693,"unique_ips":8,"first_seen":"2026-06-26T00:01:11","last_seen":"2026-06-27T15:36:47","top_ports":[8728],"countries":["US","BR","BG"]},{"value":555,"event_count":1119,"unique_ips":16,"first_seen":"2026-06-26T07:19:34","last_seen":"2026-06-27T15:05:05","top_ports":[555],"countries":["HR","US","HK"]},{"value":8080,"event_count":1069,"unique_ips":208,"first_seen":"2026-06-26T00:00:24","last_seen":"2026-06-27T15:51:56","top_ports":[8080],"countries":["US","NL","DE"]},{"value":1433,"event_count":907,"unique_ips":221,"first_seen":"2026-06-26T00:43:25","last_seen":"2026-06-27T15:46:53","top_ports":[1433],"countries":["US","CN","NL"]},{"value":1723,"event_count":831,"unique_ips":32,"first_seen":"2026-06-26T00:00:12","last_seen":"2026-06-27T15:52:08","top_ports":[1723],"countries":["PL","US","CH"]},{"value":3389,"event_count":730,"unique_ips":172,"first_seen":"2026-06-26T00:12:30","last_seen":"2026-06-27T15:45:12","top_ports":[3389],"countries":["US","NL","RO"]},{"value":554,"event_count":585,"unique_ips":76,"first_seen":"2026-06-26T00:17:44","last_seen":"2026-06-27T15:52:52","top_ports":[554],"countries":["RU","US","HK"]},{"value":8000,"event_count":550,"unique_ips":130,"first_seen":"2026-06-26T00:02:54","last_seen":"2026-06-27T15:45:23","top_ports":[8000],"countries":["IL","US","RU"]},{"value":8443,"event_count":538,"unique_ips":127,"first_seen":"2026-06-26T00:03:46","last_seen":"2026-06-27T15:51:22","top_ports":[8443],"countries":["US","NL","DE"]},{"value":5432,"event_count":506,"unique_ips":72,"first_seen":"2026-06-26T00:05:01","last_seen":"2026-06-27T15:49:55","top_ports":[5432],"countries":["NL","US","SE"]},{"value":23,"event_count":498,"unique_ips":59,"first_seen":"2026-06-26T00:10:29","last_seen":"2026-06-27T15:16:38","top_ports":[23],"countries":["NL","BE","US"]},{"value":40261,"event_count":453,"unique_ips":1,"first_seen":"2026-06-26T20:06:22","last_seen":"2026-06-26T20:06:32","top_ports":[40261],"countries":["US"]}]} +``` + +**Tool: honeylabs_top_attackers_tool** + +**Input:** +```json +{ + "since": "2026-06-26T00:00:00Z", + "until": "2026-06-27T23:59:59Z", + "by": "asn", + "limit": 20 +} +``` + +**Output:** +``` +{"result":[{"value":396982,"event_count":176485,"unique_ips":2278,"first_seen":"2026-06-26T00:00:04","last_seen":"2026-06-27T15:52:50","top_ports":[443,8080,3389,8443,21],"countries":["US","GB","BE"],"asn_org":"Google LLC"},{"value":209334,"event_count":36510,"unique_ips":115,"first_seen":"2026-06-26T02:04:27","last_seen":"2026-06-27T15:47:12","top_ports":[16379,49791,49543,9204,49699],"countries":["FR","CA"],"asn_org":"Modat B.V."},{"value":211590,"event_count":22831,"unique_ips":6,"first_seen":"2026-06-27T03:10:29","last_seen":"2026-06-27T15:17:36","top_ports":[50050,8417,443],"countries":["FR"],"asn_org":"Bucklog SARL"},{"value":50360,"event_count":21332,"unique_ips":2,"first_seen":"2026-06-26T00:00:05","last_seen":"2026-06-27T15:49:40","top_ports":[26224,46925,54537,44559,32375],"countries":["BG"],"asn_org":"Tamatiya EOOD"},{"value":398324,"event_count":14485,"unique_ips":256,"first_seen":"2026-06-26T00:00:01","last_seen":"2026-06-27T15:52:07","top_ports":[9090,18244,1433,5060,554],"countries":["US"],"asn_org":"Censys, Inc."},{"value":135377,"event_count":11770,"unique_ips":554,"first_seen":"2026-06-26T00:00:00","last_seen":"2026-06-27T15:46:22","top_ports":[587,50777,85,51000,90],"countries":["US","HK","TH"],"asn_org":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED"},{"value":27699,"event_count":11596,"unique_ips":2,"first_seen":"2026-06-26T17:40:06","last_seen":"2026-06-27T03:28:37","top_ports":[53,445],"countries":["BR"],"asn_org":"TELEFONICA BRASIL S.A"},{"value":398705,"event_count":10110,"unique_ips":16,"first_seen":"2026-06-26T00:02:23","last_seen":"2026-06-27T15:51:13","top_ports":[4840,102,4369,20546,2281],"countries":["US"],"asn_org":"Censys, Inc."},{"value":6939,"event_count":6838,"unique_ips":705,"first_seen":"2026-06-26T00:08:53","last_seen":"2026-06-27T15:45:17","top_ports":[9060,8081,14443,444,9443],"countries":["US"],"asn_org":"Hurricane Electric LLC"},{"value":16509,"event_count":6262,"unique_ips":160,"first_seen":"2026-06-26T00:10:42","last_seen":"2026-06-27T15:52:52","top_ports":[4449,9443,8010,22225,9500],"countries":["US","DE","GB"],"asn_org":"Amazon.com, Inc."},{"value":213412,"event_count":5551,"unique_ips":860,"first_seen":"2026-06-26T00:00:09","last_seen":"2026-06-27T15:52:39","top_ports":[5985,139,8015,58603,8000],"countries":["US","FR","CN"],"asn_org":"ONYPHE SAS"},{"value":202425,"event_count":3874,"unique_ips":33,"first_seen":"2026-06-26T00:00:19","last_seen":"2026-06-27T15:46:23","top_ports":[9955,7777,7895,5000,6443],"countries":["NL","US"],"asn_org":"IP Volume inc"},{"value":45102,"event_count":3818,"unique_ips":886,"first_seen":"2026-06-26T00:05:37","last_seen":"2026-06-27T15:52:55","top_ports":[443,8081,18789,9443,9999],"countries":["SG","US","JP"],"asn_org":"Alibaba (US) Technology Co., Ltd."},{"value":14061,"event_count":3729,"unique_ips":234,"first_seen":"2026-06-26T00:10:39","last_seen":"2026-06-27T15:48:01","top_ports":[40261,80,3333,27017,11211],"countries":["US","SG","DE"],"asn_org":"DigitalOcean, LLC"},{"value":201401,"event_count":3584,"unique_ips":5,"first_seen":"2026-06-26T08:31:52","last_seen":"2026-06-27T15:38:23","top_ports":[21744,65480,17303,26499,26807],"countries":["NL"],"asn_org":"NewVM B.V."},{"value":215929,"event_count":3528,"unique_ips":2,"first_seen":"2026-06-26T04:18:15","last_seen":"2026-06-27T15:51:28","top_ports":[59352,16613,17422,60715,2340],"countries":["NL","DE"],"asn_org":"Data Campus Limited"},{"value":215925,"event_count":2886,"unique_ips":26,"first_seen":"2026-06-26T00:00:26","last_seen":"2026-06-27T15:49:15","top_ports":[8728,8080,52869,8081,8801],"countries":["US","BR"],"asn_org":"Vpsvault.host Ltd"},{"value":398722,"event_count":2761,"unique_ips":96,"first_seen":"2026-06-26T00:33:41","last_seen":"2026-06-27T15:44:12","top_ports":[4840,8883,2443,4839,20547],"countries":["US"],"asn_org":"Censys, Inc."},{"value":8075,"event_count":2731,"unique_ips":1226,"first_seen":"2026-06-26T00:01:15","last_seen":"2026-06-27T15:49:55","top_ports":[443,80,25565,2087,9200],"countries":["US","NL","IN"],"asn_org":"Microsoft Corporation"},{"value":211486,"event_count":2626,"unique_ips":3,"first_seen":"2026-06-26T00:05:34","last_seen":"2026-06-27T12:24:31","top_ports":[9037,9664,6785,9814,9044],"countries":["BG"],"asn_org":"Alferov Aleksey Aleksandrovich"}]} +``` + +--- + +## Assistant (Sisyphus - Ultraworker · DeepSeek V4 Flash · 9.2s) + +_Thinking:_ + +Great, I have a broad view. Now let me identify the key IPs that need Censys enrichment. The top attackers by event count are: + +1. **79.124.58.126** (Bulgaria, Tamatiya EOOD) - 21,148 events - by far the most active single IP +2. **179.111.21.60** (Brazil, TELEFONICA BRASIL) - 11,594 events - all hitting port 53 (DNS) +3. **185.177.72.38** (France, Bucklog SARL) - 6,021 events - hitting port 50050 +4. **185.177.72.205** (France, Bucklog SARL) - 6,000 events - hitting port 50050, 8417 +5. **62.164.177.41** (Netherlands, Data Campus Limited) - 3,522 events +6. **80.82.77.202** (Netherlands, IP Volume inc) - 2,368 events - hitting ports 7777, 9955, 7895, etc. +7. **185.93.89.121** (Iran, Limited Network LTD) - 2,112 events +8. **74.195.44.207** (US, Optimum) - 1,776 events - hitting port 25565 (Minecraft!) +9. **31.14.32.6** (Netherlands, NewVM B.V.) - 1,637 events +10. **77.83.36.160** (Ukraine, Layer7 Networks) - 1,626 events - hitting RDP ports (3389, 3400, etc.) +11. **45.198.224.18** (US, Vpsvault.host Ltd) - 1,255 events - hitting port 8728 (MikroTik?) +12. **160.119.71.136** (Seychelles, Alsycon B.V.) - 1,252 events + +For enrichment, I'll pick the most interesting ones - the top attackers and the ones with unusual profiles. Let me pick: +- 79.124.58.126 - #1 attacker by event count +- 179.111.21.60 - intense DNS scan burst +- 185.177.72.38 and .205 - Bucklog SARL (French VPS) +- 80.82.77.202 - IP Volume inc (known abuse host) +- 185.93.89.121 - Iranian attacker +- 77.83.36.160 - RDP scanner from Ukraine +- 45.198.224.18 - MikroTik port scanning +- 160.119.71.136 - Seychelles hosting + +Let me look them all up in Censys. + +Good data coming in. Now let me enrich the top attacker IPs with Censys to see what services they're actually running. I'll also check a few notable ones in Honeylabs for more detail. + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "79.124.58.126" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":50360,"bgp_prefix":"79.124.58.0/24","country_code":"BG","description":"TAMATIYA-AS - Tamatiya EOOD","name":"TAMATIYA-AS - Tamatiya EOOD"},"dns":{"forward_dns":{"hostikslu.is":{"name":"hostikslu.is","record_type":"a","resolve_time":"2026-05-24T14:40:37Z"}},"names":["hostikslu.is"],"reverse_dns":{"resolve_time":"2026-06-21T08:44:46Z"}},"greynoise":{"actor":"unknown","classification":"suspicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"Web Crawler"},{"name":"Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"},{"name":"Cisco ASA Scanner"},{"name":"TLS/SSL Crawler"}]},"ip":"79.124.58.126","location":{"city":"Sofia","continent":"Europe","coordinates":{"latitude":42.69751,"longitude":23.32415},"country":"Bulgaria","country_code":"BG","postal_code":"1000","province":"Sofia-Capital","timezone":"Europe/Sofia"},"network":[{"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_9.9","banner_hash_sha256":"607685352506d4de6404d09cb1ff43b3304d3845dbe6c3b04c291a88ae21fb8b","banner_hex":"5353482d322e302d4f70656e5353485f392e39","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"79.124.58.126","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_11_1-2-4-8-16","scan_time":"2026-06-26T20:25:03Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":22,"protocol":"SSH","scan_time":"2026-06-27T15:17:31Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"9.9"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_9.9","software_version":"OpenSSH_9.9"},"hassh_fingerprint":"b1bff636ebbdbaa9dd2ad97fd173c956","kex_init_message":{"client_to_server_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","ext-info-s","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"MvYiGQKW5seJAKybfnkClOYNr70B+QBtcBAFG6faO5Y=","y":"tM33LVlZ4TLjCHNNlGrC91NXGWHjPAg7cVjkccUF8JY="},"fingerprint_sha256":"bbfef3c288e1ffa924e6073374b8aa25e8c56f1159621797753305e0fa901e15"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003e=6.8p1 \u0026\u0026 \u003c=9.9p1"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.933,"score":0.07}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003e=9.5p1 \u0026\u0026 \u003c=9.9p1"}],"id":"CVE-2025-26466","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"percentile":0.984,"score":0.385}},"name":"CVE-2025-26466","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003e=7.4 \u0026\u0026 \u003c10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.044,"score":0.001}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.205,"score":0.003}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.158,"score":0.002}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.073,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026}]}],"whois":{"network":{"cidrs":["79.124.58.0/24"],"created":"2014-02-04T00:00:00Z","handle":"TAMATIYA-EOOD","name":"Tamatiya EOOD","updated":"2017-08-23T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"hostmaster@4vendeta.com","handle":"AR40280-RIPE","name":"Abuse-C Role"}],"address":"35, Ivan Vazov str., Sopot, Bulgaria","handle":"ORG-IPTL2-RIPE","name":"Tamatiya EOOD"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "179.111.21.60" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":27699,"bgp_prefix":"179.110.0.0/15","country_code":"BR","description":"AS27699 - TELEFONICA BRASIL S.A","name":"AS27699 - TELEFONICA BRASIL S.A"},"dns":{"reverse_dns":{"names":["179-111-21-60.dsl.telesp.net.br"],"resolve_time":"2026-06-23T15:28:40Z"}},"greynoise":{"actor":"unknown","classification":"unknown","last_observed_time":"2026-06-27T00:00:00Z"},"ip":"179.111.21.60","location":{"city":"Atibaia","continent":"South America","coordinates":{"latitude":-23.11694,"longitude":-46.55028},"country":"Brazil","country_code":"BR","postal_code":"12940-000","province":"São Paulo","timezone":"America/Sao_Paulo"},"network":[{"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"whois":{"network":{"cidrs":["179.110.0.0/15"],"created":"2013-08-02T00:00:00Z","handle":"ART8","name":"TELEFÔNICA BRASIL S.A","updated":"2013-08-02T00:00:00Z"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "185.177.72.38" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":211590,"bgp_prefix":"185.177.72.0/24","country_code":"FR","description":"BUCKLOG - Bucklog SARL","name":"BUCKLOG - Bucklog SARL"},"dns":{"reverse_dns":{"resolve_time":"2026-06-20T07:46:21Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"Web Crawler"},{"name":"ENV Crawler"},{"name":"Generic Sensitive File Access Attempt"},{"name":"AWS Configuration Scanner"},{"name":"Git Config Crawler"},{"name":"Wordpress Enumeration"},{"name":"Generic PHPInfo Access Attempt"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"Spring Boot Actuator Crawler"},{"name":"Laravel Framework Credential Leak CVE-2024-29291 Attempt"},{"name":"Well-Known Scanner"},{"name":"Generic Path Traversal Attempt"},{"name":"CGI Script Scanner"},{"name":".md Crawler"},{"name":"Double URL Encoding"},{"name":"SCP|SFTP|FTP Sensitive Data Exposure Scanner"},{"name":"Svn Config Crawler"},{"name":"TeleMessage TM SGNL Spring Boot Actuator /heapdump Disclosure CVE-2025-48927 Attempt"},{"name":"Generic phpMyAdmin Access Attempt"},{"name":"Composer PHP Dependency Manager Scanner"},{"name":"WordPress LiteSpeed Cache Plugin CVE-2024-44000 Debug Log Access Attempt"},{"name":"Sitemap Crawler"},{"name":"PHP DebugBar Information Disclosure Attempt"},{"name":"PHPUnit CVE-2017-9841 RCE Attempt"},{"name":"Generic Login Attempt"},{"name":"Web.xml Access Attempt"},{"name":"Symfony Profiler Debug Mode RCE Attempt"},{"name":"Spring Boot Actuator Health Scanner"},{"name":"Kubernetes Crawler"},{"name":"Oracle Weblogic Server Proxy Plug-in Access Control Bypass CVE-2026-21962 Attempt"},{"name":"Sendgrid v2 API Crawler"},{"name":"Nginx UI Unauthenticated Backup Disclosure CVE-2026-27944 Attempt"},{"name":"Gravity SMTP Sensitive Information Exposure CVE-2026-4020 Attempt"},{"name":"Sharepoint Scanner"},{"name":"Generic /proc Enumeration Attempt"},{"name":"Tomcat Manager Scanner"},{"name":"Apache HTTP Server Path Traversal Attempt"},{"name":"F5 BIG-IP Crawler"},{"name":"Mercurial Crawler"},{"name":"BIG-IP TMUI Remote Code Execution CVE-2020-5902 RCE Attempt"},{"name":"Docker Scanner"},{"name":"Cisco RV320/325 Info Disclosure"},{"name":"Portainer Crawler"},{"name":"Grafana Query Endpoint Enumeration Attempt"},{"name":"WebDAV Scanner"},{"name":"MySQL Protocol"},{"name":"Next.js Directory Traversal CVE-2020-5284 Attempt"},{"name":"security.txt Scanner"},{"name":"robots.txt Scanner"},{"name":"sitemap.xml Crawler"},{"name":"Laravel Telescope Scanner"},{"name":"Favicon Scanner"},{"name":"WordPress Core User Enumeration Attempt"},{"name":"Readme Scanner"},{"name":"Generic Brute Force Attempt"},{"name":"Yii Framework Information Disclosure Scanner"},{"name":"CrushFTP Scanner"},{"name":"WordPress Plugin Scanner"},{"name":"Telnet Protocol"},{"name":"TLS/SSL Crawler"},{"name":"Generic IoT Default Password Attempt"},{"name":"Generic XSS Commands in Request"},{"name":".DS_Store Scanner"},{"name":"Next.js Directory Traversal CVE-2018-6184 LFI Attempt"},{"name":"Sophos XG Firewall User Portal Scanner"},{"name":"Pulse Secure VPN Scanner"},{"name":"LuCI Crawler"},{"name":"DWR Test Page Scanner"},{"name":"ads.txt Scanner"},{"name":"EC2 IAM Credential Access Attempt"},{"name":"Ivanti Connect Secure (ICS) Scanner"},{"name":"Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"}]},"ip":"185.177.72.38","location":{"city":"Paris","continent":"Europe","coordinates":{"latitude":48.85341,"longitude":2.3488},"country":"France","country_code":"FR","postal_code":"75000","province":"Île-de-France","timezone":"Europe/Paris"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":9,"services":[{"banner":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7","banner_hash_sha256":"24b76e02b35733fa6bac4d5d40b42acf3d28493e91b8f0afd4b77d855ceaff39","banner_hex":"5353482d322e302d4f70656e5353485f392e3270312044656269616e2d322b64656231327537","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_12_1-2-4-24","scan_time":"2026-06-25T11:52:33Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":22,"protocol":"SSH","scan_time":"2026-06-26T17:05:15Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Debian-2+deb12u7","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7","software_version":"OpenSSH_9.2p1"},"hassh_fingerprint":"425d29fe50d8e4f5e37efb6e24bcf660","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"/axzD8LvN87WOeFh89MO2h4RhzUivGw42FsabqtMDUM=","y":"WTFEUXCS1EaWqS3MmG6QBTFld1D0GcDBSguy86ZB18g="},"fingerprint_sha256":"29b37cd7220f83500f69a0f315fafb557bdf4f5d09d93ab5f21ccd5e0988f75f"}},"transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NTP","literal_match":"NTP"}],"id":"CENSYS-2022-1049","metrics":{},"name":"Exposed NTP Service","risk_source":"censys","severity":"low","source":"censys","year":2022}],"ip":"185.177.72.38","ntp":{"get_time_header":{"mode":4,"precision":-22,"reference_id":"6dbeb1cb","stratum":2,"version":3}},"port":123,"protocol":"NTP","scan_time":"2026-06-27T07:30:59Z","transport_protocol":"udp"},{"banner":"HTTP/1.1 404 Not Found\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 0\r\n","banner_hash_sha256":"d76dbc1e221f7c00e2f5190965ddb801cb39a366df34050d6832142690cf5e67","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 0\r\n","banner_hash_sha256":"d76dbc1e221f7c00e2f5190965ddb801cb39a366df34050d6832142690cf5e67","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"headers":{"Content-Length":{"headers":["0"]},"Date":{"headers":["\u003cREDACTED\u003e"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.38:4240/"},"ip":"185.177.72.38","path":"/","port":4240,"scan_time":"2026-06-27T08:23:53Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T21:37:22Z"},"port":4240,"protocol":"HTTP","scan_time":"2026-06-27T08:23:53Z","transport_protocol":"tcp"},{"cert":{"added_at":"2025-01-15T03:26:50Z","ever_seen_in_scan":true,"fingerprint_md5":"54be1405acfe91e6c530062b08058eff","fingerprint_sha1":"724b6983f91e1b188c31d58ab3e88769c3822946","fingerprint_sha256":"a3696c00242f7b4299a8616e3f1cf2b4b4d59fa748004f3b9d3e60c917674340","modified_at":"2026-01-05T20:46:58Z","names":["*.kubernetes.hubble-grpc.cilium.io"],"parse_status":"success","parsed":{"extensions":{"authority_key_id":"cfa9e386186fd75bc81e5d881c9c5a5351a8cac9","basic_constraints":{},"extended_key_usage":{"client_auth":true,"server_auth":true},"key_usage":{"digital_signature":true,"key_encipherment":true,"value":5},"subject_alt_name":{"dns_names":["*.kubernetes.hubble-grpc.cilium.io"]}},"issuer":{"common_name":["Cilium CA"]},"issuer_dn":"CN=Cilium CA","ja4x":"7022c563de38_7022c563de38_52a6c7204f7c","serial_number":"7765355678350399928850278651388109914","serial_number_hex":"05d78d98281603fbabad0eebc3f6245a","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"82311c458e5eba79f9c20b2cf691892c9a5a456790eb3297347d9b7399f236bba6b373c29c7efac946f65b614e6a4994dd2c4f082948739564a4f46862646bb6535f13496c09912a1a43924b711793bde56c1b0ea4ab84a65bce69fe7f398a73306d7c2b27fec30886b046bc878475d96b97b5bd1940268e65035a9d0d90fc813d4fb9ed962c2ed1973da6232b7d138e8f106b4f1a89f752dbd96cd404167d9b813b87b33ea2c86216d7e8b0731cdaab950f2c9fa25273fc2e1383f2bdb729b6a7b389d5fddd8a4e354539febf52a7a44a6121c7bc697db493321b4ed4d16be784872af30bef7245de4e8efaf119dad9a5a3d123b08af48115834ef4a4c781c7"},"subject":{"common_name":["*.kubernetes.hubble-grpc.cilium.io"]},"subject_dn":"CN=*.kubernetes.hubble-grpc.cilium.io","subject_key_info":{"fingerprint_sha256":"f41f62d650b085b61fc6e2daa8a8a6cc6ce6416cbd4fefecc899b0efff56dabb","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"b7a077a8c068b73e6463ee1a7ef9ae25fef7a9f397a81b0d90350ed77e524da6c9ef05532a088cc617397ff8e37456f26119a7bd890a6caffde9a967f97f1bfd4175f542942715dbbfb6180913a664c67696b0d1da833119a1c774473370781396cc9091dc0e0a8b1a8dbf10720684e55148226e13ee7aba5da3bbf8c07464efd6f209a5d5706c468e2216102e26205b38409511c2150ecab375aa0c989b07f9cbaf72241c7a67981a8b5039705f53b836463c4170f871e6257a41d74bc9c9c33c5b921d769e8b9c5fb028612c3ce9c4d2ef466c721a5a86ef0904055dfb5eab55aeb0a427b7c37896ae3992442dc9708740781066abcf8f5c0877b53106a201"}},"validity_period":{"length_seconds":31536001,"not_after":"2026-01-04T23:45:03Z","not_before":"2025-01-04T23:45:03Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"3fd6b596380a7a886cd55fd1a641d22331f257b616afc67c920b28a48d63cfb7","spki_subject_fingerprint_sha256":"3fd6b596380a7a886cd55fd1a641d22331f257b616afc67c920b28a48d63cfb7","tbs_fingerprint_sha256":"77554b9a372c52ff39bf5a327cd90a1d65762de435f4098e4a04a6dc0132ddb1","tbs_no_ct_fingerprint_sha256":"77554b9a372c52ff39bf5a327cd90a1d65762de435f4098e4a04a6dc0132ddb1","validated_at":"2026-01-05T20:46:58Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2025-01-15T03:26:50Z","version":3,"warnings_present":true}},"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T04:56:19Z"},"jarm":{"cipher_and_version_fingerprint":"00000000000000000043d43d00043d","fingerprint":"00000000000000000043d43d00043de2a97eabb398317329f027c66e4c1b01","ip":"185.177.72.38","is_success":true,"port":4244,"scan_time":"2026-06-21T00:17:58Z","tls_extensions_sha256":"e2a97eabb398317329f027c66e4c1b01","transport_protocol":"tcp"},"misconfigs":[{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024},{"confidence":1,"evidence":[{"data_path":"certificate.names","found_value":"*."}],"id":"CENSYS-2024-1028","metrics":{},"name":"Wildcard Certificate","risk_source":"censys","severity":"low","source":"censys","year":2024}],"port":4244,"protocol":"UNKNOWN","scan_time":"2026-06-27T07:58:19Z","tls":{"cipher_selected":"TLS_CHACHA20_POLY1305_SHA256","fingerprint_sha256":"a3696c00242f7b4299a8616e3f1cf2b4b4d59fa748004f3b9d3e60c917674340","ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version_selected":"tlsv1_3","versions":[{"ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version":"tlsv1_3"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\ndate: \u003cREDACTED\u003e\r\nserver: envoy\r\ncontent-length: 0\r\n","banner_hash_sha256":"98e0388e3314c9af73bf470c49c5278bd6ad0b6c759a13664a9bfd9405387f34","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\ndate: \u003cREDACTED\u003e\r\nserver: envoy\r\ncontent-length: 0\r\n","banner_hash_sha256":"98e0388e3314c9af73bf470c49c5278bd6ad0b6c759a13664a9bfd9405387f34","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"headers":{"content-length":{"headers":["0"]},"date":{"headers":["\u003cREDACTED\u003e"]},"server":{"headers":["envoy"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1","HTTP/2"],"uri":"http://185.177.72.38:9964/"},"ip":"185.177.72.38","path":"/","port":9964,"scan_time":"2026-06-27T08:24:25Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-27T03:50:45Z"},"port":9964,"protocol":"HTTP","scan_time":"2026-06-27T08:24:25Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:envoy_proxy:envoy:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"envoy","source":"recog","vendor":"envoy_proxy"}],"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","cert":{"added_at":"2026-01-07T02:16:45Z","ever_seen_in_scan":true,"fingerprint_md5":"8f516876517eb3687d3f2ca61b406d53","fingerprint_sha1":"57e9d9aa0b0b4ddba584d04c6319d9902cde6c54","fingerprint_sha256":"194d6b7c6e09fad576e41b7bbb0905b2338b4f8343484a84c47d408c59b99b73","modified_at":"2026-01-07T02:16:45Z","names":["pk17","pk17@1767737335"],"parse_status":"success","parsed":{"extensions":{"authority_key_id":"ac69751b3a841cc4affbac7d42c34bbf99034527","basic_constraints":{},"extended_key_usage":{"server_auth":true},"key_usage":{"digital_signature":true,"key_encipherment":true,"value":5},"subject_alt_name":{"dns_names":["pk17"]}},"issuer":{"common_name":["pk17-ca@1767737334"]},"issuer_dn":"CN=pk17-ca@1767737334","ja4x":"7022c563de38_7022c563de38_52a6c7204f7c","serial_number":"6159879346675106919","serial_number_hex":"557c49a11dd5c467","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"079d04d94a9b85fb188e4f5f1ec10e0fbf5ed2b00be7faccf07973e23f2795d6cf18d00aa2aef396c119f914b39f90afd238fa3a143426ed51ede88ba4b00d44f1d2e8102fa4eff8d9f5ea4a47241d6f14f4384b4f8fa6b19aaeae50ccd3f573f5c31d5d0b01c7c17a537c26ee91808158b008261843ff39c68a77be63bf1f2b1d0e9222f19dafe799332c8012adfb29db7fcb1c90c4bf5e460323fff3d4843fe6d9593d2f75b8c558c6861b51996b790472715c384a65ed6cb4aeab0fad10ccd075825c89a652181ab7851453b51025b7757ac10d0d32ccc0cb5189b0f72dc8effa1744a5d9b28bd9368cb18a1e2fd69e6a11a0819337c6213015ab8ef29d86"},"subject":{"common_name":["pk17@1767737335"]},"subject_dn":"CN=pk17@1767737335","subject_key_info":{"fingerprint_sha256":"ba50c1054b1c030a0938d59988578898049f782a4ba6b5511d8c7fb4362c5fd8","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"a482889ae908ce3b59648a1e4e9394cd5709a52afa8dfe5c658c65a5eb7852ee69d5ead1d71fb3f4d2dc2c8a7125e760a39f35246d6554656a920aa8ba2bbd3e13c53fc1b190298b497f6c2309c54ab0ccca3ed936943fc39a41bc6b3399ec32d7eff7da48c5c76bc8aae37f67642aae672de6b237f63eca073229d2e8c3b20f10a3f3283bc65e04cd047dfba04f0afe9e6e5606664f25113825a63e3bee8d4cf5be2eea88049f9e446222f19f76a6e7a06441212edf6de61c71b432ca632dfa83bd89b0edd963397f6c5439c9ebc71d2de3f00f7ec08c78122d4af2d8d0c09154a3fa148e9798fd262955a2fb5109a7ceeab367d3acbead75ce06809b765505"}},"validity_period":{"length_seconds":31536001,"not_after":"2027-01-06T21:08:54Z","not_before":"2026-01-06T21:08:54Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"e6659f74ef20f4a18bebe344b4e6f11ae6aa3c39e68945a0174304efe2aadbf2","spki_subject_fingerprint_sha256":"e6659f74ef20f4a18bebe344b4e6f11ae6aa3c39e68945a0174304efe2aadbf2","tbs_fingerprint_sha256":"91ff06825fa86e9645be974d660ae7438325849a88e6b32abba335eb2b696dd6","tbs_no_ct_fingerprint_sha256":"91ff06825fa86e9645be974d660ae7438325849a88e6b32abba335eb2b696dd6","validated_at":"2026-06-27T01:50:03Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_dnsname_bad_character_in_label","e_dnsname_not_valid_tld","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_subject_common_name_not_exactly_from_san","n_san_iana_pub_suffix_empty","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2026-01-07T02:16:45Z","version":3,"warnings_present":true}},"endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"body":"404 page not found\n","body_hash_sha1":"da3968197e7bf67aa45a77515b52ba2710c5fc34","body_hash_sha256":"b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793","body_size":19,"headers":{"Content-Length":{"headers":["19"]},"Content-Type":{"headers":["text/plain; charset=utf-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1","HTTP/2"],"uri":"https://185.177.72.38:10250/"},"ip":"185.177.72.38","path":"/","port":10250,"scan_time":"2026-06-27T08:49:32Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-24T19:05:02Z"},"jarm":{"cipher_and_version_fingerprint":"3fd3fd20d00000000043d3fd3fd43d","fingerprint":"3fd3fd20d00000000043d3fd3fd43d684d61a135bd962c8dd9c541ddbaefa8","ip":"185.177.72.38","is_success":true,"port":10250,"scan_time":"2026-06-26T00:21:14Z","tls_extensions_sha256":"684d61a135bd962c8dd9c541ddbaefa8","transport_protocol":"tcp"},"misconfigs":[{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024}],"port":10250,"protocol":"HTTP","scan_time":"2026-06-27T08:49:32Z","tls":{"cipher_selected":"TLS_CHACHA20_POLY1305_SHA256","fingerprint_sha256":"194d6b7c6e09fad576e41b7bbb0905b2338b4f8343484a84c47d408c59b99b73","ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","presented_chain":[{"fingerprint_sha256":"610a69fb368d755cdff92ac8392309c91d40c35fcfee856e8ebc126ed8b62752","issuer_dn":"CN=pk17-ca@1767737334","subject_dn":"CN=pk17-ca@1767737334"}],"version_selected":"tlsv1_3","versions":[{"ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version":"tlsv1_3"},{"ja3s":"d25619cb77d3219fc9fc14cb6b35eacc","ja4s":"t120200_cca8_344b4dce5a52","version":"tlsv1_2"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"body":"404 page not found\n","body_hash_sha1":"da3968197e7bf67aa45a77515b52ba2710c5fc34","body_hash_sha256":"b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793","body_size":19,"headers":{"Content-Length":{"headers":["19"]},"Content-Type":{"headers":["text/plain; charset=utf-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.38:10256/"},"ip":"185.177.72.38","path":"/","port":10256,"scan_time":"2026-06-27T08:48:35Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-27T03:45:24Z"},"port":10256,"protocol":"HTTP","scan_time":"2026-06-27T08:48:35Z","transport_protocol":"tcp"},{"banner":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Fri, 12 Jun 2026 12:27:51 GMT\r\nETag: W/\"190-19ebbcd8d58\"\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 400\r\nDate: \u003cREDACTED\u003e\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n","banner_hash_sha256":"e532ac9f5eec860a26dd9169de0b989f4535b0041ed960a2d8522dde3cf8db31","endpoints":[{"banner":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Fri, 12 Jun 2026 12:27:51 GMT\r\nETag: W/\"190-19ebbcd8d58\"\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 400\r\nDate: \u003cREDACTED\u003e\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n","banner_hash_sha256":"e532ac9f5eec860a26dd9169de0b989f4535b0041ed960a2d8522dde3cf8db31","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"body":"\u003c!DOCTYPE html\u003e\n\u003chtml lang=\"en\"\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\" /\u003e\n \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" /\u003e\n \u003ctitle\u003eCluster Monitor\u003c/title\u003e\n \u003cscript type=\"module\" crossorigin src=\"/assets/index-DeQ1aIDZ.js\"\u003e\u003c/script\u003e\n \u003clink rel=\"stylesheet\" crossorigin href=\"/assets/index-CH-e-uDD.css\"\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n \u003cdiv id=\"root\"\u003e\u003c/div\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n","body_hash_sha1":"dabe0f8291413e863987d07aac8a57762bcdf7bf","body_hash_sha256":"f3acfdd97b3dee85f45abf500147c940cec695d10235e8bf1bf825736279f412","body_hash_tlsh":"2fe02b05d8e14915422462545dc0f5545a86d787938a9a4426fba07c5f85786cecf878","body_size":400,"headers":{"Accept-Ranges":{"headers":["bytes"]},"Access-Control-Allow-Origin":{"headers":["*"]},"Cache-Control":{"headers":["public, max-age=0"]},"Connection":{"headers":["keep-alive"]},"Content-Length":{"headers":["400"]},"Content-Type":{"headers":["text/html; charset=UTF-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"ETag":{"headers":["W/\"190-19ebbcd8d58\""]},"Keep-Alive":{"headers":["timeout=5"]},"Last-Modified":{"headers":["Fri, 12 Jun 2026 12:27:51 GMT"]},"X-Powered-By":{"headers":["Express"]}},"html_tags":["\u003ctitle\u003eCluster Monitor\u003c/title\u003e","\u003cmeta charset=\"UTF-8\" /\u003e","\u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" /\u003e"],"html_title":"Cluster Monitor","protocol":"HTTP/1.1","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.38:30010/"},"ip":"185.177.72.38","path":"/","port":30010,"scan_time":"2026-06-27T08:52:21Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43338_2-4-8-1-3_1410_12_1-2-4-8-16","scan_time":"2026-06-25T07:31:05Z"},"port":30010,"protocol":"HTTP","scan_time":"2026-06-27T08:52:21Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:express:express:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.x-powered-by"}],"part":"a","product":"express","source":"recog","vendor":"express"}],"transport_protocol":"tcp"},{"banner":"HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/json\r\nX-Content-Type-Options: nosniff\r\nX-Load-Balancing-Endpoint-Weight: 0\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 141\r\n","banner_hash_sha256":"4b04b502956552b48e3de46cbf5d885d804a8b39573ed3b3e684a35387c3a3ab","endpoints":[{"banner":"HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/json\r\nX-Content-Type-Options: nosniff\r\nX-Load-Balancing-Endpoint-Weight: 0\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 141\r\n","banner_hash_sha256":"4b04b502956552b48e3de46cbf5d885d804a8b39573ed3b3e684a35387c3a3ab","endpoint_type":"HTTP","hostname":"185.177.72.38","http":{"body":"{\n\t\"service\": {\n\t\t\"namespace\": \"ingress-nginx\",\n\t\t\"name\": \"ingress-nginx-controller\"\n\t},\n\t\"localEndpoints\": 0,\n\t\"serviceProxyHealthy\": true\n}","body_hash_sha1":"a519902d89d086532839d830e6c70643dcb7ca8d","body_hash_sha256":"2ae1107e057e7f0fd621c7a161c9167cb02f391d536149c9335974cc20a5f550","body_hash_tlsh":"2fc02bd50747423203bc4e3c2dcdb94002390014100fe68f4ee43422c3efd1c1823c01","body_size":141,"headers":{"Content-Length":{"headers":["141"]},"Content-Type":{"headers":["application/json"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]},"X-Load-Balancing-Endpoint-Weight":{"headers":["0"]}},"protocol":"HTTP/1.1","status_code":503,"status_reason":"Service Unavailable","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.38:32697/"},"ip":"185.177.72.38","path":"/","port":32697,"scan_time":"2026-06-27T08:54:41Z","transport_protocol":"tcp"}],"ip":"185.177.72.38","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-27T05:21:22Z"},"port":32697,"protocol":"HTTP","scan_time":"2026-06-27T08:54:41Z","transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["185.177.72.0/24"],"created":"2025-05-27T00:00:00Z","handle":"FR-FBW-NETWORKS-20161110","name":"FBW NETWORKS SAS","updated":"2025-05-30T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@fiberway.fr","handle":"AR65110-RIPE","name":"Abuse-C Role"}],"address":"10 Allée Latécoère\\n78140\\nVélizy Villacoublay\\nFRANCE","admin_contacts":[{"email":"gautier@fiberway.fr","handle":"GML75-RIPE","name":"Gautier MARSOT LEMAIRE"}],"handle":"ORG-FNS23-RIPE","name":"FBW NETWORKS SAS"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "185.177.72.205" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":211590,"bgp_prefix":"185.177.72.0/24","country_code":"FR","description":"BUCKLOG - Bucklog SARL","name":"BUCKLOG - Bucklog SARL"},"dns":{"reverse_dns":{"resolve_time":"2026-06-22T01:20:26Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"Web Crawler"},{"name":"ENV Crawler"},{"name":"Generic Sensitive File Access Attempt"},{"name":"AWS Configuration Scanner"},{"name":"Generic PHPInfo Access Attempt"},{"name":"Git Config Crawler"},{"name":"Wordpress Enumeration"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"Spring Boot Actuator Crawler"},{"name":"Laravel Framework Credential Leak CVE-2024-29291 Attempt"},{"name":"Well-Known Scanner"},{"name":"Generic Path Traversal Attempt"},{"name":".md Crawler"},{"name":"CGI Script Scanner"},{"name":"Double URL Encoding"},{"name":"SCP|SFTP|FTP Sensitive Data Exposure Scanner"},{"name":"Generic phpMyAdmin Access Attempt"},{"name":"TeleMessage TM SGNL Spring Boot Actuator /heapdump Disclosure CVE-2025-48927 Attempt"},{"name":"Svn Config Crawler"},{"name":"Composer PHP Dependency Manager Scanner"},{"name":"Sitemap Crawler"},{"name":"WordPress LiteSpeed Cache Plugin CVE-2024-44000 Debug Log Access Attempt"},{"name":"PHPUnit CVE-2017-9841 RCE Attempt"},{"name":"Oracle Weblogic Server Proxy Plug-in Access Control Bypass CVE-2026-21962 Attempt"},{"name":"PHP DebugBar Information Disclosure Attempt"},{"name":"Web.xml Access Attempt"},{"name":"Generic Login Attempt"},{"name":"Sendgrid v2 API Crawler"},{"name":"Spring Boot Actuator Health Scanner"},{"name":"Symfony Profiler Debug Mode RCE Attempt"},{"name":"Nginx UI Unauthenticated Backup Disclosure CVE-2026-27944 Attempt"},{"name":"Kubernetes Crawler"},{"name":"Sharepoint Scanner"},{"name":"MySQL Protocol"},{"name":"Gravity SMTP Sensitive Information Exposure CVE-2026-4020 Attempt"},{"name":"Mercurial Crawler"},{"name":"Tomcat Manager Scanner"},{"name":"Generic /proc Enumeration Attempt"},{"name":"Next.js Directory Traversal CVE-2020-5284 Attempt"},{"name":"F5 BIG-IP Crawler"},{"name":"Apache HTTP Server Path Traversal Attempt"},{"name":"Readme Scanner"},{"name":"Docker Scanner"},{"name":"WordPress Core User Enumeration Attempt"},{"name":"BIG-IP TMUI Remote Code Execution CVE-2020-5902 RCE Attempt"},{"name":"Cisco RV320/325 Info Disclosure"},{"name":"Portainer Crawler"},{"name":"WebDAV Scanner"},{"name":"Grafana Query Endpoint Enumeration Attempt"},{"name":"robots.txt Scanner"},{"name":"security.txt Scanner"},{"name":"sitemap.xml Crawler"},{"name":"Generic Brute Force Attempt"},{"name":"Yii Framework Information Disclosure Scanner"},{"name":"Laravel Telescope Scanner"},{"name":"Favicon Scanner"},{"name":"TLS/SSL Crawler"},{"name":".DS_Store Scanner"},{"name":"CrushFTP Scanner"},{"name":"WordPress Plugin Scanner"},{"name":"Outlook Web Access Crawler"},{"name":"Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"},{"name":"Generic IoT Default Password Attempt"},{"name":"Telnet Protocol"},{"name":"EC2 IAM Credential Access Attempt"},{"name":"Next.js Directory Traversal CVE-2018-6184 LFI Attempt"},{"name":"Generic XSS Commands in Request"},{"name":"DWR Test Page Scanner"},{"name":"ads.txt Scanner"},{"name":"Outlook Web Access Login Crawler"}]},"ip":"185.177.72.205","location":{"city":"Paris","continent":"Europe","coordinates":{"latitude":48.85341,"longitude":2.3488},"country":"France","country_code":"FR","postal_code":"75000","province":"Île-de-France","timezone":"Europe/Paris"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":9,"services":[{"banner":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7","banner_hash_sha256":"24b76e02b35733fa6bac4d5d40b42acf3d28493e91b8f0afd4b77d855ceaff39","banner_hex":"5353482d322e302d4f70656e5353485f392e3270312044656269616e2d322b64656231327537","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T00:30:36Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":22,"protocol":"SSH","scan_time":"2026-06-27T12:34:19Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Debian-2+deb12u7","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7","software_version":"OpenSSH_9.2p1"},"hassh_fingerprint":"425d29fe50d8e4f5e37efb6e24bcf660","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"c71dX8sjqInSIYvO1DAarQyah/vQ82N3tbQGZiI/GvQ=","y":"KISMz9EJ5W0WM8NjSkIeK16A9nkO7EWU+J1jprUXUWg="},"fingerprint_sha256":"b340576a1f07f2fd1dba1f1b1fa7c6d1f7b45fd7ae2bbe6982f71e7b00107233"}},"transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NTP","literal_match":"NTP"}],"id":"CENSYS-2022-1049","metrics":{},"name":"Exposed NTP Service","risk_source":"censys","severity":"low","source":"censys","year":2022}],"ip":"185.177.72.205","ntp":{"get_time_header":{"mode":4,"precision":-23,"reference_id":"52402d32","stratum":2,"version":3}},"port":123,"protocol":"NTP","scan_time":"2026-06-26T17:37:00Z","transport_protocol":"udp"},{"banner":"HTTP/1.1 404 Not Found\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 0\r\n","banner_hash_sha256":"d76dbc1e221f7c00e2f5190965ddb801cb39a366df34050d6832142690cf5e67","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 0\r\n","banner_hash_sha256":"d76dbc1e221f7c00e2f5190965ddb801cb39a366df34050d6832142690cf5e67","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"headers":{"Content-Length":{"headers":["0"]},"Date":{"headers":["\u003cREDACTED\u003e"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.205:4240/"},"ip":"185.177.72.205","path":"/","port":4240,"scan_time":"2026-06-27T08:47:29Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-27T02:49:35Z"},"port":4240,"protocol":"HTTP","scan_time":"2026-06-27T08:47:29Z","transport_protocol":"tcp"},{"cert":{"added_at":"2025-01-15T03:26:50Z","ever_seen_in_scan":true,"fingerprint_md5":"54be1405acfe91e6c530062b08058eff","fingerprint_sha1":"724b6983f91e1b188c31d58ab3e88769c3822946","fingerprint_sha256":"a3696c00242f7b4299a8616e3f1cf2b4b4d59fa748004f3b9d3e60c917674340","modified_at":"2026-01-05T20:46:58Z","names":["*.kubernetes.hubble-grpc.cilium.io"],"parse_status":"success","parsed":{"extensions":{"authority_key_id":"cfa9e386186fd75bc81e5d881c9c5a5351a8cac9","basic_constraints":{},"extended_key_usage":{"client_auth":true,"server_auth":true},"key_usage":{"digital_signature":true,"key_encipherment":true,"value":5},"subject_alt_name":{"dns_names":["*.kubernetes.hubble-grpc.cilium.io"]}},"issuer":{"common_name":["Cilium CA"]},"issuer_dn":"CN=Cilium CA","ja4x":"7022c563de38_7022c563de38_52a6c7204f7c","serial_number":"7765355678350399928850278651388109914","serial_number_hex":"05d78d98281603fbabad0eebc3f6245a","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"82311c458e5eba79f9c20b2cf691892c9a5a456790eb3297347d9b7399f236bba6b373c29c7efac946f65b614e6a4994dd2c4f082948739564a4f46862646bb6535f13496c09912a1a43924b711793bde56c1b0ea4ab84a65bce69fe7f398a73306d7c2b27fec30886b046bc878475d96b97b5bd1940268e65035a9d0d90fc813d4fb9ed962c2ed1973da6232b7d138e8f106b4f1a89f752dbd96cd404167d9b813b87b33ea2c86216d7e8b0731cdaab950f2c9fa25273fc2e1383f2bdb729b6a7b389d5fddd8a4e354539febf52a7a44a6121c7bc697db493321b4ed4d16be784872af30bef7245de4e8efaf119dad9a5a3d123b08af48115834ef4a4c781c7"},"subject":{"common_name":["*.kubernetes.hubble-grpc.cilium.io"]},"subject_dn":"CN=*.kubernetes.hubble-grpc.cilium.io","subject_key_info":{"fingerprint_sha256":"f41f62d650b085b61fc6e2daa8a8a6cc6ce6416cbd4fefecc899b0efff56dabb","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"b7a077a8c068b73e6463ee1a7ef9ae25fef7a9f397a81b0d90350ed77e524da6c9ef05532a088cc617397ff8e37456f26119a7bd890a6caffde9a967f97f1bfd4175f542942715dbbfb6180913a664c67696b0d1da833119a1c774473370781396cc9091dc0e0a8b1a8dbf10720684e55148226e13ee7aba5da3bbf8c07464efd6f209a5d5706c468e2216102e26205b38409511c2150ecab375aa0c989b07f9cbaf72241c7a67981a8b5039705f53b836463c4170f871e6257a41d74bc9c9c33c5b921d769e8b9c5fb028612c3ce9c4d2ef466c721a5a86ef0904055dfb5eab55aeb0a427b7c37896ae3992442dc9708740781066abcf8f5c0877b53106a201"}},"validity_period":{"length_seconds":31536001,"not_after":"2026-01-04T23:45:03Z","not_before":"2025-01-04T23:45:03Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"3fd6b596380a7a886cd55fd1a641d22331f257b616afc67c920b28a48d63cfb7","spki_subject_fingerprint_sha256":"3fd6b596380a7a886cd55fd1a641d22331f257b616afc67c920b28a48d63cfb7","tbs_fingerprint_sha256":"77554b9a372c52ff39bf5a327cd90a1d65762de435f4098e4a04a6dc0132ddb1","tbs_no_ct_fingerprint_sha256":"77554b9a372c52ff39bf5a327cd90a1d65762de435f4098e4a04a6dc0132ddb1","validated_at":"2026-01-05T20:46:58Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2025-01-15T03:26:50Z","version":3,"warnings_present":true}},"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T05:48:25Z"},"jarm":{"cipher_and_version_fingerprint":"00000000000000000043d43d00043d","fingerprint":"00000000000000000043d43d00043de2a97eabb398317329f027c66e4c1b01","ip":"185.177.72.205","is_success":true,"port":4244,"scan_time":"2026-06-21T01:17:29Z","tls_extensions_sha256":"e2a97eabb398317329f027c66e4c1b01","transport_protocol":"tcp"},"misconfigs":[{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024},{"confidence":1,"evidence":[{"data_path":"certificate.names","found_value":"*."}],"id":"CENSYS-2024-1028","metrics":{},"name":"Wildcard Certificate","risk_source":"censys","severity":"low","source":"censys","year":2024}],"port":4244,"protocol":"UNKNOWN","scan_time":"2026-06-27T08:36:43Z","tls":{"cipher_selected":"TLS_CHACHA20_POLY1305_SHA256","fingerprint_sha256":"a3696c00242f7b4299a8616e3f1cf2b4b4d59fa748004f3b9d3e60c917674340","ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version_selected":"tlsv1_3","versions":[{"ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version":"tlsv1_3"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\ndate: \u003cREDACTED\u003e\r\nserver: envoy\r\ncontent-length: 0\r\n","banner_hash_sha256":"98e0388e3314c9af73bf470c49c5278bd6ad0b6c759a13664a9bfd9405387f34","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\ndate: \u003cREDACTED\u003e\r\nserver: envoy\r\ncontent-length: 0\r\n","banner_hash_sha256":"98e0388e3314c9af73bf470c49c5278bd6ad0b6c759a13664a9bfd9405387f34","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"headers":{"content-length":{"headers":["0"]},"date":{"headers":["\u003cREDACTED\u003e"]},"server":{"headers":["envoy"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1","HTTP/2"],"uri":"http://185.177.72.205:9964/"},"ip":"185.177.72.205","path":"/","port":9964,"scan_time":"2026-06-27T08:12:49Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T01:25:09Z"},"port":9964,"protocol":"HTTP","scan_time":"2026-06-27T08:12:49Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:envoy_proxy:envoy:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"envoy","source":"recog","vendor":"envoy_proxy"}],"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","cert":{"added_at":"2026-01-22T10:54:50Z","ever_seen_in_scan":true,"fingerprint_md5":"317bbaf00e7b4426761d2a0509aa316f","fingerprint_sha1":"2f27ef36909be178ba18aed691290e7976a59a63","fingerprint_sha256":"9dc00c12787dbadc5b857ce29269e94dd6c1477b064eb2b9114b59265abd8e12","modified_at":"2026-01-22T10:54:50Z","names":["pk22","pk22@1769046545"],"parse_status":"success","parsed":{"extensions":{"authority_key_id":"ed11f59cd7f6d009098dcd9f04ad988ba5ca9e3e","basic_constraints":{},"extended_key_usage":{"server_auth":true},"key_usage":{"digital_signature":true,"key_encipherment":true,"value":5},"subject_alt_name":{"dns_names":["pk22"]}},"issuer":{"common_name":["pk22-ca@1769046545"]},"issuer_dn":"CN=pk22-ca@1769046545","ja4x":"7022c563de38_7022c563de38_52a6c7204f7c","serial_number":"3085830264672744159","serial_number_hex":"2ad31246baf7f2df","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"454a1045e7267693f655440396ec5c27d18f09ba3ac2b0294aa3a50d9d87737387d05bd32456fb9d8d6edf2977be948a1d55a2b3073e3f3ee53b5304466414395beb3741eb992932ef58bb83aab38d4a4e1df5dc3fba0deb3a06cd21b2ba2f8810039519e56acf509914fe70d64e250568e25762a99fc08b26bc618962ba621ff342a591ae317a11276353e7014a81b8817e88f1e8ce667372a4eff2fc40ef62ce27a34416870d1e5c86848abb389d3294470a60173559f6e67685e64ff53d086962a95f33fae66e073bcf06c06855224fae13e3e2e801f9b564ca378c7f82e648374cddf86d7376c248fef082df05f41f7229f22ac01e4d07bed0f2a0424920"},"subject":{"common_name":["pk22@1769046545"]},"subject_dn":"CN=pk22@1769046545","subject_key_info":{"fingerprint_sha256":"6ca6816dc1f3236d2bdb703a2c8eeafdfee1c31a4190466cfb55631dae7f767d","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"d7e2cb0ab1af5305df0598c43c35348db1c485dff96421da3fd8742cb2bb3f3cf2370fcfdb37c617b0fa1cb513ecddfbfa9fb65d52590c5b6622c8d9149609d1473cc592a674d580a94f766c094ac1ce81144678f909f4a7ea43d95182cc5d26d7a5dbc6f7524e1b9e7df9108fabe80ee0b4215c425240ab3b0e640eb4a4b789697f6d52f85302958ea539aa71eac8cb3995948f9b2882023de8b4bd39e0d863700e8755fefdd0ba7de4c405af93011e6f17674d040a5e562f6f72adee95cf707a75b0a2c88bbf5736db071658596321b1d0829110e64b14a229ab24943ed825d725bac2e9d8343d2cecfadaf58dbcfad6bef4c1d9bb853812613a27f1dfe9df"}},"validity_period":{"length_seconds":31536001,"not_after":"2027-01-22T00:49:05Z","not_before":"2026-01-22T00:49:05Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"2133b06dcb5df426e78dd3dbe38ee3804627ced6f227e6df6c1e62036d22e973","spki_subject_fingerprint_sha256":"2133b06dcb5df426e78dd3dbe38ee3804627ced6f227e6df6c1e62036d22e973","tbs_fingerprint_sha256":"a072a29ec38f77a3e607a1e839fa59f9d519c9cf338130f3fc3b38c2304b2f4d","tbs_no_ct_fingerprint_sha256":"a072a29ec38f77a3e607a1e839fa59f9d519c9cf338130f3fc3b38c2304b2f4d","validated_at":"2026-06-26T20:59:20Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_dnsname_bad_character_in_label","e_dnsname_not_valid_tld","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_subject_common_name_not_exactly_from_san","n_san_iana_pub_suffix_empty","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2026-01-22T10:54:50Z","version":3,"warnings_present":true}},"endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"body":"404 page not found\n","body_hash_sha1":"da3968197e7bf67aa45a77515b52ba2710c5fc34","body_hash_sha256":"b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793","body_size":19,"headers":{"Content-Length":{"headers":["19"]},"Content-Type":{"headers":["text/plain; charset=utf-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1","HTTP/2"],"uri":"https://185.177.72.205:10250/"},"ip":"185.177.72.205","path":"/","port":10250,"scan_time":"2026-06-27T08:20:40Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-25T09:26:29Z"},"jarm":{"cipher_and_version_fingerprint":"3fd3fd20d00000000043d3fd3fd43d","fingerprint":"3fd3fd20d00000000043d3fd3fd43d684d61a135bd962c8dd9c541ddbaefa8","ip":"185.177.72.205","is_success":true,"port":10250,"scan_time":"2026-06-26T08:14:26Z","tls_extensions_sha256":"684d61a135bd962c8dd9c541ddbaefa8","transport_protocol":"tcp"},"misconfigs":[{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024}],"port":10250,"protocol":"HTTP","scan_time":"2026-06-27T08:20:40Z","tls":{"cipher_selected":"TLS_CHACHA20_POLY1305_SHA256","fingerprint_sha256":"9dc00c12787dbadc5b857ce29269e94dd6c1477b064eb2b9114b59265abd8e12","ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","presented_chain":[{"fingerprint_sha256":"1cf0d17db4bc31edd4c6caef17da6e5598bd86ab202f6f4f7c1a91ea7c938cd2","issuer_dn":"CN=pk22-ca@1769046545","subject_dn":"CN=pk22-ca@1769046545"}],"version_selected":"tlsv1_3","versions":[{"ja3s":"475c9302dc42b2751db9edcac3b74891","ja4s":"t130200_1303_a56c5b993250","version":"tlsv1_3"},{"ja3s":"d25619cb77d3219fc9fc14cb6b35eacc","ja4s":"t120200_cca8_344b4dce5a52","version":"tlsv1_2"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/plain; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 19\r\n","banner_hash_sha256":"d01d33874c1a1716026081b3b3fc90b8173203aba832874a8faf5e56e0058837","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"body":"404 page not found\n","body_hash_sha1":"da3968197e7bf67aa45a77515b52ba2710c5fc34","body_hash_sha256":"b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793","body_size":19,"headers":{"Content-Length":{"headers":["19"]},"Content-Type":{"headers":["text/plain; charset=utf-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]}},"protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.205:10256/"},"ip":"185.177.72.205","path":"/","port":10256,"scan_time":"2026-06-27T08:48:24Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-24T23:09:09Z"},"port":10256,"protocol":"HTTP","scan_time":"2026-06-27T08:48:24Z","transport_protocol":"tcp"},{"banner":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Fri, 12 Jun 2026 12:27:51 GMT\r\nETag: W/\"190-19ebbcd8d58\"\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 400\r\nDate: \u003cREDACTED\u003e\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n","banner_hash_sha256":"e532ac9f5eec860a26dd9169de0b989f4535b0041ed960a2d8522dde3cf8db31","endpoints":[{"banner":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Fri, 12 Jun 2026 12:27:51 GMT\r\nETag: W/\"190-19ebbcd8d58\"\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 400\r\nDate: \u003cREDACTED\u003e\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n","banner_hash_sha256":"e532ac9f5eec860a26dd9169de0b989f4535b0041ed960a2d8522dde3cf8db31","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"body":"\u003c!DOCTYPE html\u003e\n\u003chtml lang=\"en\"\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\" /\u003e\n \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" /\u003e\n \u003ctitle\u003eCluster Monitor\u003c/title\u003e\n \u003cscript type=\"module\" crossorigin src=\"/assets/index-DeQ1aIDZ.js\"\u003e\u003c/script\u003e\n \u003clink rel=\"stylesheet\" crossorigin href=\"/assets/index-CH-e-uDD.css\"\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n \u003cdiv id=\"root\"\u003e\u003c/div\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n","body_hash_sha1":"dabe0f8291413e863987d07aac8a57762bcdf7bf","body_hash_sha256":"f3acfdd97b3dee85f45abf500147c940cec695d10235e8bf1bf825736279f412","body_hash_tlsh":"2fe02b05d8e14915422462545dc0f5545a86d787938a9a4426fba07c5f85786cecf878","body_size":400,"headers":{"Accept-Ranges":{"headers":["bytes"]},"Access-Control-Allow-Origin":{"headers":["*"]},"Cache-Control":{"headers":["public, max-age=0"]},"Connection":{"headers":["keep-alive"]},"Content-Length":{"headers":["400"]},"Content-Type":{"headers":["text/html; charset=UTF-8"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"ETag":{"headers":["W/\"190-19ebbcd8d58\""]},"Keep-Alive":{"headers":["timeout=5"]},"Last-Modified":{"headers":["Fri, 12 Jun 2026 12:27:51 GMT"]},"X-Powered-By":{"headers":["Express"]}},"html_tags":["\u003ctitle\u003eCluster Monitor\u003c/title\u003e","\u003cmeta charset=\"UTF-8\" /\u003e","\u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" /\u003e"],"html_title":"Cluster Monitor","protocol":"HTTP/1.1","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.205:30010/"},"ip":"185.177.72.205","path":"/","port":30010,"scan_time":"2026-06-27T08:06:58Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43338_2-4-8-1-3_1410_12_1-2-4-8-16","scan_time":"2026-06-27T02:31:50Z"},"port":30010,"protocol":"HTTP","scan_time":"2026-06-27T08:06:58Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:express:express:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.x-powered-by"}],"part":"a","product":"express","source":"recog","vendor":"express"}],"transport_protocol":"tcp"},{"banner":"HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/json\r\nX-Content-Type-Options: nosniff\r\nX-Load-Balancing-Endpoint-Weight: 0\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 141\r\n","banner_hash_sha256":"4b04b502956552b48e3de46cbf5d885d804a8b39573ed3b3e684a35387c3a3ab","endpoints":[{"banner":"HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/json\r\nX-Content-Type-Options: nosniff\r\nX-Load-Balancing-Endpoint-Weight: 0\r\nDate: \u003cREDACTED\u003e\r\nContent-Length: 141\r\n","banner_hash_sha256":"4b04b502956552b48e3de46cbf5d885d804a8b39573ed3b3e684a35387c3a3ab","endpoint_type":"HTTP","hostname":"185.177.72.205","http":{"body":"{\n\t\"service\": {\n\t\t\"namespace\": \"ingress-nginx\",\n\t\t\"name\": \"ingress-nginx-controller\"\n\t},\n\t\"localEndpoints\": 0,\n\t\"serviceProxyHealthy\": true\n}","body_hash_sha1":"a519902d89d086532839d830e6c70643dcb7ca8d","body_hash_sha256":"2ae1107e057e7f0fd621c7a161c9167cb02f391d536149c9335974cc20a5f550","body_hash_tlsh":"2fc02bd50747423203bc4e3c2dcdb94002390014100fe68f4ee43422c3efd1c1823c01","body_size":141,"headers":{"Content-Length":{"headers":["141"]},"Content-Type":{"headers":["application/json"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"X-Content-Type-Options":{"headers":["nosniff"]},"X-Load-Balancing-Endpoint-Weight":{"headers":["0"]}},"protocol":"HTTP/1.1","status_code":503,"status_reason":"Service Unavailable","supported_versions":["HTTP/1.1"],"uri":"http://185.177.72.205:32697/"},"ip":"185.177.72.205","path":"/","port":32697,"scan_time":"2026-06-27T08:54:39Z","transport_protocol":"tcp"}],"ip":"185.177.72.205","ja4tscan":{"fingerprint":"43440_2-4-8-1-3_1460_12_1-2-4-8-16","scan_time":"2026-06-26T07:30:09Z"},"port":32697,"protocol":"HTTP","scan_time":"2026-06-27T08:54:39Z","transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["185.177.72.0/24"],"created":"2025-05-27T00:00:00Z","handle":"FR-FBW-NETWORKS-20161110","name":"FBW NETWORKS SAS","updated":"2025-05-30T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@fiberway.fr","handle":"AR65110-RIPE","name":"Abuse-C Role"}],"address":"10 Allée Latécoère\\n78140\\nVélizy Villacoublay\\nFRANCE","admin_contacts":[{"email":"gautier@fiberway.fr","handle":"GML75-RIPE","name":"Gautier MARSOT LEMAIRE"}],"handle":"ORG-FNS23-RIPE","name":"FBW NETWORKS SAS"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "62.164.177.41" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":215929,"bgp_prefix":"62.164.177.0/24","country_code":"HK","description":"datacampus - Data Campus Limited","name":"datacampus - Data Campus Limited"},"dns":{"reverse_dns":{"names":["62-164-177-41.adsl.surfdsl.net"],"resolve_time":"2026-06-23T04:12:40Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"RDP Crawler"},{"name":"RDP Bruteforce Attempt"},{"name":"Web Crawler"},{"name":"RFB Protocol"},{"name":"MySQL Protocol"}]},"ip":"62.164.177.41","location":{"city":"Amsterdam","continent":"Europe","coordinates":{"latitude":52.37403,"longitude":4.88969},"country":"Netherlands","country_code":"NL","postal_code":"1012","province":"North Holland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":7,"services":[{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","dcerpc":{"could_bind":true,"could_query_epm":true,"endpoints":[{"bindings":["ncalrpc:[LRPC-26ae10ef7c2aa89f16]","ncalrpc:[dabrpc]","ncalrpc:[csebpub]","ncalrpc:[LRPC-782119963a6da20963]","ncalrpc:[LRPC-2a42007c9c0e2e8c35]","ncalrpc:[OLE73B5ED70CE74A76552D5B06143F6]","ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"9b008953-f195-4bf9-bde0-4471971e58ed v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"88abcbc3-34ea-76ae-8215-767520655a23 v0.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8bfc3be1-6def-4e2d-af74-7c47cd0ade4a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-504055908f88a95dc7]"],"executable":"N/A","explained_uuid":"169c453b-5955-4672-be44-21f61e9ef18f v1.0 INgcContainerEnum","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-efb16ad1b517bbd4df]"],"executable":"nrpsrv.dll","explained_uuid":"30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 NRP server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-972f40b194a324895b]","ncalrpc:[OLE736CD4BFEFA679F954762B32B489]"],"executable":"nsisvc.dll","explained_uuid":"7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0 NSI server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"29770a8f-829b-4158-90a2-78cd488501f7 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[nlaapi]","ncalrpc:[nlaplg]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"eb081a0d-10ee-478a-a1dd-50995283e7a8 v3.0 Witness Client Test Interface","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"86d35949-83c9-4044-b424-db363231fd0c v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"certprop.dll","explained_uuid":"30b044a5-a225-43f0-b3a4-e060df91f9c1 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-12103da3da6398ff36]"],"executable":"N/A","explained_uuid":"1a0d010f-1c33-432c-b0f5-8cf4e8053099 v1.0 IdSegSrv service","protocol":"N/A"},{"bindings":["ncalrpc:[WMsgKRpc04D41F2]"],"executable":"winlogon.exe","explained_uuid":"12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 Secure Desktop LRPC interface","protocol":"N/A"},{"bindings":["ncalrpc:[OLE46B6B4BBCE2392B8DFFEF284968E]","ncalrpc:[LRPC-61919dd5064f1d226d]"],"executable":"N/A","explained_uuid":"923c9623-db7f-4b34-9e6d-e86580f8ca2a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-782119963a6da20963]","ncalrpc:[LRPC-2a42007c9c0e2e8c35]","ncalrpc:[OLE73B5ED70CE74A76552D5B06143F6]","ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"697dcda9-3ba9-4eb2-9247-e11f1901b0d2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"857fb1be-084f-4fb5-b59c-4b2c4be5f0cf v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1832bcf6-cab8-41d4-85d2-c9410764f75a v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1537]","ncacn_np:\\\\H62-164-177-70[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-10021e7a9c391b5e06]","ncalrpc:[LRPC-2c39b045e7ceaeb6bf]","ncalrpc:[LRPC-efb16ad1b517bbd4df]"],"executable":"wevtsvc.dll","explained_uuid":"f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 Event log TCPIP","protocol":"[MS-EVEN6]: EventLog Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-10021e7a9c391b5e06]","ncalrpc:[LRPC-2c39b045e7ceaeb6bf]","ncalrpc:[LRPC-efb16ad1b517bbd4df]"],"executable":"N/A","explained_uuid":"a500d4c6-0dd1-4543-bc0c-d5f93486eaf8 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\PIPE\\wkssvc]","ncalrpc:[nlaapi]","ncalrpc:[nlaplg]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"7f1343fe-50a9-4927-a778-0c5859517bac v1.0 DfsDs service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-12103da3da6398ff36]"],"executable":"srvsvc.dll","explained_uuid":"98716d03-89ac-44c7-bb8c-285824e51c4a v1.0 XactSrv service","protocol":"N/A"},{"bindings":["ncalrpc:[WindowsShutdown]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc0174B30]","ncalrpc:[WMsgKRpc01775D1]","ncalrpc:[WMsgKRpc04D41F2]"],"executable":"winlogon.exe","explained_uuid":"76f226c3-ec14-4325-8a99-6a46348418af v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26ae10ef7c2aa89f16]","ncalrpc:[dabrpc]","ncalrpc:[csebpub]","ncalrpc:[LRPC-782119963a6da20963]","ncalrpc:[LRPC-2a42007c9c0e2e8c35]","ncalrpc:[OLE73B5ED70CE74A76552D5B06143F6]","ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"fc48cd89-98d6-4628-9839-86f7a3e4161a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-85ad23ece778134150]","ncalrpc:[LRPC-e2874bb3cf4429494d]"],"executable":"BFE.DLL","explained_uuid":"dd490425-5325-4565-b774-7e27d6c09c24 v1.0 Base Firewall Engine API","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"33d84484-3626-47ee-8c6f-e7e98b113be1 v2.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1539]","ncalrpc:[LRPC-2e71545ce329c25a89]"],"executable":"spoolsv.exe","explained_uuid":"0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncalrpc:[OLE46B6B4BBCE2392B8DFFEF284968E]","ncalrpc:[LRPC-61919dd5064f1d226d]"],"executable":"N/A","explained_uuid":"0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"55e6b932-1979-45d6-90c5-7f6270724112 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-1dddfba25924d857fb]"],"executable":"N/A","explained_uuid":"f3f09ffd-fbcf-4291-944d-70ad6e0e73bb v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"appinfo.dll","explained_uuid":"5f54ce7d-5b79-4175-8584-cb65313a0e98 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-fbed28d970feb807d2]"],"executable":"gpsvc.dll","explained_uuid":"2eb08e3e-639f-4fba-97b1-14f878961076 v1.0 Group Policy RPC Interface","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-deebc5e27283f9d5cd]"],"executable":"N/A","explained_uuid":"e7a216af-1ec1-447f-8d3f-a87278db564d v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:62.164.177.41[1545]"],"executable":"N/A","explained_uuid":"b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 v2.0 KeyIso","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8782d3b9-ebbd-4644-a3d8-e8725381919b v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-b034bcd263580796d6]","ncalrpc:[LRPC-85ad23ece778134150]","ncalrpc:[LRPC-e2874bb3cf4429494d]"],"executable":"N/A","explained_uuid":"f47433c3-3e9d-4157-aad4-83aa1f5c2d4c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"appinfo.dll","explained_uuid":"fd7a0523-dc70-43dd-9b2e-9c5ed48225b1 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 v1.0 Adh APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-313589612d2bd64ecc]"],"executable":"N/A","explained_uuid":"7aeb6705-3ae6-471a-882d-f39c109edc12 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1539]","ncalrpc:[LRPC-2e71545ce329c25a89]"],"executable":"spoolsv.exe","explained_uuid":"76f03f96-cdfd-44fc-a22c-64950a001209 v1.0","protocol":"[MS-PAR]: Print System Asynchronous Remote Protocol"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1541]","ncalrpc:[ipsec]"],"executable":"FwRemoteSvr.dll","explained_uuid":"6b5bdd1e-528c-422c-af8c-a4079be4fe48 v1.0 Remote Fw APIs","protocol":"[MS-FASP]: Firewall and Advanced Security Protocol"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2513bcbe-6cd4-4348-855e-7efb3c336dd3 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-454db6ab40b362917c]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE6AD5700BBDA296929F54EDE56E6D]","ncalrpc:[LRPC-7fdfda1257dd033d84]","ncalrpc:[LRPC-8cbccb1d41617d38fc]"],"executable":"pcasvc.dll","explained_uuid":"0767a036-0d22-48aa-ba69-b619480f38cb v1.0 PcaSvc","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c36be077-e14b-4fe9-8abc-e856ef4f048b v1.0 Proxy Manager client server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-b2b2cd0e858dbe5881]"],"executable":"N/A","explained_uuid":"e38f5360-8572-473e-b696-1b46873beeab v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ea7e55002619f2d763]","ncalrpc:[LRPC-ea7e55002619f2d763]","ncalrpc:[LRPC-ea7e55002619f2d763]"],"executable":"msdtcprx.dll","explained_uuid":"906b0ce0-c70b-1067-b317-00dd010662da v1.0","protocol":"[MS-CMPO]: MSDTC Connection Manager:"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4dace966-a243-4450-ae3f-9b7bcb5315b8 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c605f9fb-f0a3-4e2a-a073-73560f8d9e3e v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"085b0334-e454-4d91-9b8c-4134f9e793f3 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-454db6ab40b362917c]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE6AD5700BBDA296929F54EDE56E6D]","ncalrpc:[LRPC-7fdfda1257dd033d84]","ncalrpc:[LRPC-8cbccb1d41617d38fc]"],"executable":"N/A","explained_uuid":"880fd55e-43b9-11e0-b1a8-cf4edfd72085 v1.0 KAPI Service endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LicenseServiceEndpoint]"],"executable":"N/A","explained_uuid":"a4b8d482-80ce-40d6-934d-b22a01a44fe7 v1.0 LicenseManager","protocol":"N/A"},{"bindings":["ncalrpc:[OLE46B6B4BBCE2392B8DFFEF284968E]","ncalrpc:[LRPC-61919dd5064f1d226d]"],"executable":"N/A","explained_uuid":"d2716e94-25cb-4820-bc15-537866578562 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-e2874bb3cf4429494d]"],"executable":"N/A","explained_uuid":"df4df73a-c52d-4e3a-8003-8437fdf8302a v0.0 WM_WindowManagerRPC\\Server","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"2e6035b2-e8f1-41a7-a044-656b439c4c34 v1.0 Proxy Manager provider server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"1ff70682-0a51-30e8-076d-740be8cee98b v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-313589612d2bd64ecc]"],"executable":"N/A","explained_uuid":"b37f900a-eae4-4304-a2ab-12bb668c0188 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-313589612d2bd64ecc]"],"executable":"N/A","explained_uuid":"abfb6ca3-0c5e-4734-9285-0aee72fe8d1c v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-4c94be7225804793c9]","ncalrpc:[OLE478DA03EC5C966B5067BBBF6A8D3]"],"executable":"N/A","explained_uuid":"8ec21e98-b5ce-4916-a3d6-449fa428a007 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"20c40295-8dba-48e6-aebf-3e78ef3bb144 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c521facf-09a9-42c5-b155-72388595cbf0 v0.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2c7fd9ce-e706-4b40-b412-953107ef9bb0 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-e11a2333c9f8eae012]","ncalrpc:[trkwks]","ncacn_np:\\\\H62-164-177-70[\\pipe\\trkwks]","ncalrpc:[LRPC-454db6ab40b362917c]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE6AD5700BBDA296929F54EDE56E6D]","ncalrpc:[LRPC-7fdfda1257dd033d84]","ncalrpc:[LRPC-8cbccb1d41617d38fc]"],"executable":"N/A","explained_uuid":"bf4dc912-e52f-4904-8ebe-9317c1bdd497 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc]","ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:62.164.177.41[1537]","ncacn_np:\\\\H62-164-177-70[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-10021e7a9c391b5e06]","ncalrpc:[LRPC-2c39b045e7ceaeb6bf]","ncalrpc:[LRPC-efb16ad1b517bbd4df]"],"executable":"dhcpcsvc.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 DHCP Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-972f40b194a324895b]","ncalrpc:[OLE736CD4BFEFA679F954762B32B489]"],"executable":"N/A","explained_uuid":"3473dd4d-2e88-4006-9cba-22570909dd10 v5.1 WinHttp Auto-Proxy Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"appinfo.dll","explained_uuid":"58e604e8-9adb-4d2e-a464-3b0683fb1480 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"IKEEXT.DLL","explained_uuid":"a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0 IKE/Authip API","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"fb9a3757-cff0-4db0-b9fc-bd6c131612fd v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1536]","ncalrpc:[WindowsShutdown]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc0174B30]"],"executable":"wininit.exe","explained_uuid":"d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0","protocol":"[MS-RSP]: Remote Shutdown Protocol"},{"bindings":["ncalrpc:[csebpub]","ncalrpc:[LRPC-782119963a6da20963]","ncalrpc:[LRPC-2a42007c9c0e2e8c35]","ncalrpc:[OLE73B5ED70CE74A76552D5B06143F6]","ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncalrpc:[LRPC-2a42007c9c0e2e8c35]","ncalrpc:[OLE73B5ED70CE74A76552D5B06143F6]","ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncalrpc:[LRPC-8cbccb1d41617d38fc]","ncalrpc:[LRPC-2c39b045e7ceaeb6bf]","ncalrpc:[LRPC-efb16ad1b517bbd4df]","ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"d09bdeb5-6171-4a34-bfe2-06fa82652568 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-7fdfda1257dd033d84]","ncalrpc:[LRPC-8cbccb1d41617d38fc]"],"executable":"N/A","explained_uuid":"5222821f-d5e2-4885-84f1-5f6185a0ec41 v1.0 Network Connection Broker server endpoint for NCB Reset module","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"b18fbab6-56f8-4702-84e0-41053293a869 v1.0 UserMgrCli","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"3a9ef155-691d-4449-8d05-09ad57031823 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[nlaapi]","ncalrpc:[nlaplg]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"f2c9b409-c1c9-4100-8639-d8ab1486694a v1.0 Witness Client Upcall Server","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-454db6ab40b362917c]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE6AD5700BBDA296929F54EDE56E6D]","ncalrpc:[LRPC-7fdfda1257dd033d84]","ncalrpc:[LRPC-8cbccb1d41617d38fc]"],"executable":"N/A","explained_uuid":"e40f7b57-7a25-4cd3-a135-7f7d3df9d16b v1.0 Network Connection Broker server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:62.164.177.41[1537]","ncacn_np:\\\\H62-164-177-70[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-10021e7a9c391b5e06]","ncalrpc:[LRPC-2c39b045e7ceaeb6bf]","ncalrpc:[LRPC-efb16ad1b517bbd4df]"],"executable":"dhcpcsvc6.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 DHCPv6 Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"iphlpsvc.dll","explained_uuid":"552d076a-cb29-4e44-8b6a-d15e59e2c0af v1.0 IP Transition Configuration endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-313589612d2bd64ecc]"],"executable":"N/A","explained_uuid":"b3781086-6a54-489b-91c8-51d067172ab7 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1539]","ncalrpc:[LRPC-2e71545ce329c25a89]"],"executable":"spoolsv.exe","explained_uuid":"12345678-1234-abcd-ef00-0123456789ab v1.0","protocol":"[MS-RPRN]: Print System Remote Protocol"},{"bindings":["ncalrpc:[LRPC-b2b2cd0e858dbe5881]"],"executable":"N/A","explained_uuid":"4c9dbf19-d39e-4bb9-90ee-8f7179b20283 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1545]","ncalrpc:[samss lpc]","ncalrpc:[SidKey Local End Point]","ncalrpc:[protected_storage]","ncalrpc:[lsasspirpc]","ncalrpc:[lsapolicylookup]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[securityevent]","ncalrpc:[audit]","ncacn_np:\\\\H62-164-177-70[\\pipe\\lsass]"],"executable":"N/A","explained_uuid":"51a227ae-825b-41f2-b4a9-1ac9557a1018 v1.0 Ngc Pop Key Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-e093d00cf1c2656a69]"],"executable":"N/A","explained_uuid":"54b4c689-969a-476f-8dc2-990885e9f562 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-26808eb6a5add4af0d]","ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"76c217bc-c8b4-4201-a745-373ad9032b1a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-09c137c1c838166759]","ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"appinfo.dll","explained_uuid":"201ef99a-7fa0-444c-9399-19ba84f12a1a v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-f7dfb6e584448a6e9b]","ncacn_np:\\\\H62-164-177-70[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"0d3c7f20-1c8d-4654-a1b3-51563b298bda v1.0 UserMgrCli","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1539]","ncalrpc:[LRPC-2e71545ce329c25a89]"],"executable":"spoolsv.exe","explained_uuid":"4a452661-8290-4b36-8fbe-7f4093a94978 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-4c94be7225804793c9]","ncalrpc:[OLE478DA03EC5C966B5067BBBF6A8D3]"],"executable":"N/A","explained_uuid":"b1ef227e-dfa5-421e-82bb-67a6a129c496 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncacn_ip_tcp:62.164.177.41[1538]","ncalrpc:[LRPC-ed56ecaa81efffafad]","ncalrpc:[LRPC-e838878cf5d4d41a92]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\H62-164-177-70[\\PIPE\\atsvc]","ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]","ncalrpc:[IUserProfile2]","ncalrpc:[IUserProfile2]"],"executable":"sysntfy.dll","explained_uuid":"c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 Impl friendly name","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"3b338d89-6cfa-44b8-847e-531531bc9992 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[OLEE8FB7E8A071C0776B9465C53E92F]","ncalrpc:[senssvc]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-313589612d2bd64ecc]"],"executable":"N/A","explained_uuid":"e7f76134-9ef5-4949-a2d6-3368cc0988f3 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1539]","ncalrpc:[LRPC-2e71545ce329c25a89]"],"executable":"spoolsv.exe","explained_uuid":"ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1540]"],"executable":"services.exe","explained_uuid":"367abb81-9844-35f1-ad32-98f038001003 v2.0","protocol":"[MS-SCMR]: Service Control Manager Remote Protocol"},{"bindings":["ncalrpc:[LRPC-e093d00cf1c2656a69]"],"executable":"N/A","explained_uuid":"be7f785e-0e3a-4ab7-91de-7e46e443be29 v0.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-3cf2a071e98bc3b38c]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2d98a740-581d-41b9-aa0d-a88b9d5ce938 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-b034bcd263580796d6]","ncalrpc:[LRPC-85ad23ece778134150]","ncalrpc:[LRPC-e2874bb3cf4429494d]"],"executable":"MPSSVC.dll","explained_uuid":"2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-4c94be7225804793c9]","ncalrpc:[OLE478DA03EC5C966B5067BBBF6A8D3]"],"executable":"N/A","explained_uuid":"0fc77b1a-95d8-4a2e-a0c0-cff54237462b v0.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:62.164.177.41[1545]","ncacn_np:\\\\H62-164-177-70[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]"],"executable":"N/A","explained_uuid":"8fb74744-b2ff-4c00-be0d-9ef9a191fe1b v1.0 Ngc Pop Key Service","protocol":"N/A"},{"bindings":["ncalrpc:[OLE8CE8325DEAD3E34E6CA0FD2965A1]","ncalrpc:[LRPC-39262bfdf3dca00902]"],"executable":"N/A","explained_uuid":"c503f532-443a-4c69-8300-ccd1fbdb3839 v2.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-410576bcdaece0f5e3]"],"executable":"ssdpsrv.dll","explained_uuid":"4b112204-0e19-11d3-b42b-0000f81feb9f v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\H62-164-177-70[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:62.164.177.41[1545]"],"executable":"samsrv.dll","explained_uuid":"12345778-1234-abcd-ef00-0123456789ac v1.0","protocol":"[MS-SAMR]: Security Account Manager (SAM) Remote Protocol"},{"bindings":["ncalrpc:[LRPC-b034bcd263580796d6]","ncalrpc:[LRPC-85ad23ece778134150]","ncalrpc:[LRPC-e2874bb3cf4429494d]"],"executable":"MPSSVC.dll","explained_uuid":"7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0 Fw APIs","protocol":"N/A"}]},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"id":"CENSYS-2022-1025","metrics":{},"name":"Exposed DCERPC Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-25T19:10:53Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":135,"protocol":"DCERPC","scan_time":"2026-06-27T10:33:10Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp"},{"banner":"�\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000e\u0003H62-164-177-70 \u0004\u0000H62-164-177-70 \u0000\u0004\u0000WORKGROUP \u0000�\u0000Дf5\u0005\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","banner_hash_sha256":"12c5a2c5e529b42e600b07c5c47a2534fcc645b3790ee941782ca5c87db7548c","banner_hex":"e5d88400000000010000000020434b4141414141414141414141414141414141414141414141414141414141410000210001000000000065034836322d3136342d3137372d3730202004004836322d3136342d3137372d373020000400574f524b47524f5550202020202020008400d0946635050400000000000000000000000000000000000000000000000000000000000000000000000000000000","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"62.164.177.41","port":137,"protocol":"NETBIOS","scan_time":"2026-06-26T19:46:38Z","transport_protocol":"udp"},{"banner":"�\u0000\u0000\u0001�","banner_hash_sha256":"ffda6a629d2fc268bbf42019878a56c91ba8a0ca8162c9caa291fff957623e04","banner_hex":"8300000182","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-24T23:39:31Z"},"port":139,"protocol":"NETBIOS","scan_time":"2026-06-27T11:35:09Z","transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SMB","literal_match":"SMB"}],"id":"CENSYS-2022-1063","metrics":{},"name":"Exposed SMB Service","risk_source":"censys","severity":"critical","source":"censys","year":2022}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-26T03:44:37Z"},"port":445,"protocol":"SMB","scan_time":"2026-06-26T23:02:52Z","smb":{"has_ntlm":true,"negotiation_log":{"authentication_types":["1.3.6.1.4.1.311.2.2.30","1.3.6.1.4.1.311.2.2.10"],"capabilities":7,"dialect_revision":770,"header_log":{"credits":1,"flags":1,"protocol_id":"00000000fe534d42"},"security_mode":1,"server_guid":"0000000000000000000000000000000041fc8505e88d184aa80bd2fe108df254","server_start_time":1781420522,"system_time":1782514972},"session_setup_log":{"header_log":{"command":1,"credits":1,"flags":1,"protocol_id":"00000000fe534d42","status":3221225494},"negotiate_flags":2726953477,"target_name":"H62-164-177-70"},"smb_capabilities":{"smb_dfs_support":true,"smb_leasing_support":true,"smb_multicredit_support":true},"smb_version":{"major":3,"revision":2,"version_string":"SMB 3.0.2"}},"transport_protocol":"tcp"},{"cert":{"added_at":"2026-06-08T09:31:10Z","ever_seen_in_scan":true,"fingerprint_md5":"be47756b1af0f313167c0517ae868628","fingerprint_sha1":"965bfd0bac2cfd8d4f9af4bb08a72a62e9bdb6ee","fingerprint_sha256":"7436239bb6c0693972323512439668d721b3d10fd3467ca5e2debe099ac7ce2f","modified_at":"2026-06-08T09:31:10Z","names":["h62-164-177-70"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["h62-164-177-70"]},"issuer_dn":"CN=h62-164-177-70","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"155629507133162349752164414533336837371","serial_number_hex":"7515271e04c705be45f42fd4ff542cfb","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"valid":true,"value":"a1141db26bd9a1fd8197dd8840eaca9e2373e90c1404205dba7de686ce5f22f3301371378b7339cf11f6c6bcbc7e6c66eac53ddf7a3566bcebcf70275f61ad514608a11401de14e28ba717a22fcf12733bcf138415461456f7a1e16463266b12f20cdfe247ffe41269121d5c2a2df004986f6e0106a1241232599614ad46c111efe143d020ec40a58498ed2a2d2d4dc695849198464da946f8c34818c9329d28e166680c4cd6275ac3079ee9e31d19228b9a0b37f81475daa4f4faeef8be7db5804a522c5f3d6a5d07a50fba7dbe56eec79a008ddfdb924641d87d3bcee1678c80a6ede8e40d68d3063071b93631fc99bfe1fda91a22fd0007f969d93b7c141f"},"subject":{"common_name":["h62-164-177-70"]},"subject_dn":"CN=h62-164-177-70","subject_key_info":{"fingerprint_sha256":"6b6fdae6e6d9c917d07010524fb4089586f645d7195a6aed69b5339610e67d55","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"d53c7f55df5d5515588922537f4dd7f6d002903a9389660c0c24ba2a79480450f8f13339609be586725d7ecb03afba9721b5bc3b00f0529e63c6dcc88570a193d2c4a434ee0b0dfa271405c60b649c6bb01569313c98e7e431099923d43f2e75bd22b12f75abffc7d1f3f7321cc2865220d75fb2b76973c5eed15c87be3b32b559c224b63a7e2625295398621fa28231c90908304899b36a0ba4f1912ece9ffed51191b0dd6c96e6686c4e15a9341faef4d727bf251c87018ec54cdd76cc5034d906143687f8550c405fd2c40eb450892b6bf4e3f12bbfd888ee62b616edf1414ed35e86aaf1ce72c4c9c56ff12e73aa201e400ed95835476ed079998ab9f723"}},"validity_period":{"length_seconds":15811201,"not_after":"2026-12-06T18:25:16Z","not_before":"2026-06-06T18:25:16Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"12e3d7790934c77ae6b5abdbdcc42cf72cc49b554da84eef80d5e95a6cf9614d","spki_subject_fingerprint_sha256":"12e3d7790934c77ae6b5abdbdcc42cf72cc49b554da84eef80d5e95a6cf9614d","tbs_fingerprint_sha256":"e09d0d9bbb22f1ac3d9d0ede648b1724f13ee83fec79c392a802f8c1f5da9fb1","tbs_no_ct_fingerprint_sha256":"e09d0d9bbb22f1ac3d9d0ede648b1724f13ee83fec79c392a802f8c1f5da9fb1","validated_at":"2026-06-26T17:57:14Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert"],"notices_present":true,"timestamp":"2026-06-08T09:31:10Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"64000_2-1-3-4-8_1460_0_3-6","scan_time":"2026-06-27T04:39:45Z"},"jarm":{"cipher_and_version_fingerprint":"0002ad000000000000000000000000","fingerprint":"0002ad000000000000000000000000556aa6d752465a051da10bd3a83e55d2","ip":"62.164.177.41","is_success":true,"port":3389,"scan_time":"2026-06-21T12:05:48Z","tls_extensions_sha256":"556aa6d752465a051da10bd3a83e55d2","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":1,"evidence":[{"data_path":"tls.versions.version","found_value":"TLSv1_0","literal_match":"TLSv1_0"},{"data_path":"tls.versions.version","found_value":"TLSv1_1","literal_match":"TLSv1_1"}],"id":"CENSYS-2022-1013","metrics":{},"name":"Downgrade Attack Possible","risk_source":"censys","severity":"medium","source":"censys","year":2022},{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"dynvc_graphics_pipeline":true,"extended_client_data_supported":true,"neg_resp_reserved":true,"restricted_admin_mode":true,"restricted_auth_mode":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":10,"minor":2,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-06-27T12:31:35Z","screenshots":[{"extracted_text":"Administrator Password","handle":"aba141fe54914ec9a9a5ad9e7197623e","phash":"9d617ac6c5a81d99"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","fingerprint_sha256":"7436239bb6c0693972323512439668d721b3d10fd3467ca5e2debe099ac7ce2f","ja3s":"364ff14b04ef93c3b4cfa429d729c0d9","ja4s":"t120100_c030_bc98f8e001b5","version_selected":"tlsv1_2","versions":[{"ja3s":"364ff14b04ef93c3b4cfa429d729c0d9","ja4s":"t120100_c030_bc98f8e001b5","version":"tlsv1_2"},{"ja3s":"1308be477c8afb355e2860ab89378ae5","ja4s":"t110100_c014_bc98f8e001b5","version":"tlsv1_1"},{"ja3s":"bcf3a836c82d12ee988005fb0c011445","ja4s":"t100100_c014_bc98f8e001b5","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"id":"CENSYS-2025-1027","metrics":{},"name":"Exposed WINRM Service","risk_source":"censys","severity":"high","source":"censys","year":2025}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-25T08:03:46Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":5985,"protocol":"WINRM","scan_time":"2026-06-27T06:07:37Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp","winrm":{"auth_types":["Negotiate"],"ntlm_info":{"always_sign_supported":true,"challenge_type":3,"dns_domain_name":"h62-164-177-70","dns_server_name":"h62-164-177-70","encryption_128bit_supported":true,"encryption_56bit_supported":true,"netbios_computer_name":"H62-164-177-70","netbios_domain_name":"H62-164-177-70","ntlm1_supported":true,"ntlm2_supported":true,"ntlm_version":15,"os_version":"10.0.14393","target_name":"H62-164-177-70"}}},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \u003cREDACTED\u003e\r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \u003cREDACTED\u003e\r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"62.164.177.41","http":{"body":"\u003c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\u003e\r\n\u003cHTML\u003e\u003cHEAD\u003e\u003cTITLE\u003eNot Found\u003c/TITLE\u003e\r\n\u003cMETA HTTP-EQUIV=\"Content-Type\" Content=\"text/html; charset=us-ascii\"\u003e\u003c/HEAD\u003e\r\n\u003cBODY\u003e\u003ch2\u003eNot Found\u003c/h2\u003e\r\n\u003chr\u003e\u003cp\u003eHTTP Error 404. The requested resource is not found.\u003c/p\u003e\r\n\u003c/BODY\u003e\u003c/HTML\u003e\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["\u003cTITLE\u003eNot Found\u003c/TITLE\u003e","\u003cMETA HTTP-EQUIV=\"Content-Type\" Content=\"text/html; charset=us-ascii\"\u003e"],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://62.164.177.41:47001/"},"ip":"62.164.177.41","path":"/","port":47001,"scan_time":"2026-06-26T19:53:21Z","transport_protocol":"tcp"}],"ip":"62.164.177.41","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-25T19:05:36Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-06-26T19:53:21Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["62.164.177.0/25"],"created":"2025-07-26T00:00:00Z","handle":"DATACAMPUS-NET","name":"END CUSTOMERS VDS","updated":"2025-07-27T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@datacampus.hk","handle":"AR73267-RIPE","name":"Abuse-C Role"}],"address":"SuiteC, Level7, World Trust Tower, 50Stanley Street, Central\\n999077\\nHong Kong\\nHong Kong","admin_contacts":[{"email":"noc@datacampus.hk","handle":"NA8536-RIPE","name":"DATACAMPUS NOC TEAM"}],"handle":"ORG-DCL55-RIPE","name":"Data Campus Limited"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "80.82.77.202" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":202425,"bgp_prefix":"80.82.77.0/24","country_code":"SC","description":"INT-NETWORK - IP Volume inc","name":"INT-NETWORK - IP Volume inc"},"dns":{"forward_dns":{"interactsh.group-ib.com":{"name":"interactsh.group-ib.com","record_type":"a","resolve_time":"2026-06-03T16:22:06Z"}},"names":["interactsh.group-ib.com"],"reverse_dns":{"names":["rnd.group-ib.com"],"resolve_time":"2026-06-19T10:25:11Z"}},"greynoise":{"actor":"unknown","classification":"suspicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"Web Crawler"},{"name":"TLS/SSL Crawler"},{"name":"MySQL Protocol"},{"name":"Masscan Client"},{"name":"Generic XSS Commands in Request"},{"name":"GoogleBot Pretender"},{"name":"Generic SQL Commands in Request"},{"name":"Generic Suspicious Linux Command in Request"}]},"ip":"80.82.77.202","location":{"city":"Amsterdam","continent":"Europe","coordinates":{"latitude":52.37403,"longitude":4.88969},"country":"Netherlands","country_code":"NL","postal_code":"1012","province":"North Holland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"whois":{"network":{"cidrs":["80.82.77.0/24"],"created":"2013-04-26T00:00:00Z","handle":"NET-1-77","name":"IPV NETBLOCK","updated":"2019-02-01T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@ipvolume.net","handle":"IVNO1-RIPE","name":"IPV ABUSE ROLE"}],"address":"House of Francis, Room 303, Victoria, English River, Seychelles","handle":"ORG-IVI1-RIPE","name":"IP Volume inc"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "185.93.89.121" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":213790,"bgp_prefix":"185.93.89.0/24","country_code":"GB","description":"LimitedNetwork-AS - Limited Network LTD","name":"LimitedNetwork-AS - Limited Network LTD"},"dns":{"reverse_dns":{"resolve_time":"2026-06-22T19:18:32Z"}},"ip":"185.93.89.121","location":{"city":"Kerkrade","continent":"Europe","coordinates":{"latitude":50.86583,"longitude":6.0625},"country":"Netherlands","country_code":"NL","postal_code":"6461","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"whois":{"network":{"cidrs":["185.93.89.0/25"],"created":"2025-10-30T00:00:00Z","handle":"AMWAJ","name":"Limited Network LTD","updated":"2025-12-31T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@btcloud.ro","handle":"ACRO58261-RIPE","name":"Abuse contact role object"}],"address":"Jefferson Place 1 Fernie Street, Manchester, England, M4 4BN","handle":"ORG-LA1969-RIPE","name":"Limited Network LTD"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "77.83.36.160" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":214403,"bgp_prefix":"77.83.36.0/24","country_code":"DE","description":"ISI-ENDUSERS-ASN - Layer7 Networks GmbH","name":"ISI-ENDUSERS-ASN - Layer7 Networks GmbH"},"dns":{"reverse_dns":{"names":["f.77.83.36.160.outlook.idveven.com"],"resolve_time":"2026-06-22T21:27:04Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"RDP Crawler"},{"name":"RDP Bruteforce Attempt"}]},"ip":"77.83.36.160","location":{"city":"Sofia","continent":"Europe","coordinates":{"latitude":42.69751,"longitude":23.32415},"country":"Bulgaria","country_code":"BG","postal_code":"1000","province":"Sofia-Capital","timezone":"Europe/Sofia"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":7,"services":[{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","dcerpc":{"could_bind":true,"could_query_epm":true,"endpoints":[{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:77.83.36.160[1537]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-53abe8cf8102fa0742]"],"executable":"dhcpcsvc6.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 DHCPv6 Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[trkwks]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\trkwks]","ncalrpc:[LRPC-716393550d7c83d5be]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE0A4C863CFC5204C7AD761885D33D]","ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"N/A","explained_uuid":"be7f785e-0e3a-4ab7-91de-7e46e443be29 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ac219e03b1d80a6079]"],"executable":"N/A","explained_uuid":"f3f09ffd-fbcf-4291-944d-70ad6e0e73bb v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"IKEEXT.DLL","explained_uuid":"a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0 IKE/Authip API","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1542]","ncalrpc:[LRPC-a67a96fd8a5911b97a]"],"executable":"spoolsv.exe","explained_uuid":"12345678-1234-abcd-ef00-0123456789ab v1.0","protocol":"[MS-RPRN]: Print System Remote Protocol"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1549]"],"executable":"FwRemoteSvr.dll","explained_uuid":"6b5bdd1e-528c-422c-af8c-a4079be4fe48 v1.0 Remote Fw APIs","protocol":"[MS-FASP]: Firewall and Advanced Security Protocol"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c521facf-09a9-42c5-b155-72388595cbf0 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ab50292585f00e0c6c]","ncalrpc:[LRPC-c50dfd36122bba7ce9]","ncalrpc:[LRPC-50448f742bd3b83153]"],"executable":"N/A","explained_uuid":"f47433c3-3e9d-4157-aad4-83aa1f5c2d4c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-50448f742bd3b83153]"],"executable":"N/A","explained_uuid":"df4df73a-c52d-4e3a-8003-8437fdf8302a v0.0 WM_WindowManagerRPC\\Server","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ff45a8a720f958c6d5]"],"executable":"N/A","explained_uuid":"b37f900a-eae4-4304-a2ab-12bb668c0188 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"857fb1be-084f-4fb5-b59c-4b2c4be5f0cf v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-53abe8cf8102fa0742]"],"executable":"nrpsrv.dll","explained_uuid":"30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 NRP server endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"29770a8f-829b-4158-90a2-78cd488501f7 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"taskcomp.dll","explained_uuid":"378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"taskcomp.dll","explained_uuid":"1ff70682-0a51-30e8-076d-740be8cee98b v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[nlaapi]","ncalrpc:[nlaplg]"],"executable":"N/A","explained_uuid":"f2c9b409-c1c9-4100-8639-d8ab1486694a v1.0 Witness Client Upcall Server","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ff45a8a720f958c6d5]"],"executable":"N/A","explained_uuid":"b3781086-6a54-489b-91c8-51d067172ab7 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1542]","ncalrpc:[LRPC-a67a96fd8a5911b97a]"],"executable":"spoolsv.exe","explained_uuid":"4a452661-8290-4b36-8fbe-7f4093a94978 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4dace966-a243-4450-ae3f-9b7bcb5315b8 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"88abcbc3-34ea-76ae-8215-767520655a23 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-e82c5cf7b0699f08cb]","ncalrpc:[LRPC-f702e7737e63b0d99c]","ncalrpc:[dhcpcsvc]","ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:77.83.36.160[1537]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-53abe8cf8102fa0742]"],"executable":"N/A","explained_uuid":"a500d4c6-0dd1-4543-bc0c-d5f93486eaf8 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[trkwks]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\trkwks]","ncalrpc:[LRPC-716393550d7c83d5be]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE0A4C863CFC5204C7AD761885D33D]","ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"pcasvc.dll","explained_uuid":"0767a036-0d22-48aa-ba69-b619480f38cb v1.0 PcaSvc","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-716393550d7c83d5be]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE0A4C863CFC5204C7AD761885D33D]","ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"N/A","explained_uuid":"e40f7b57-7a25-4cd3-a135-7f7d3df9d16b v1.0 Network Connection Broker server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"appinfo.dll","explained_uuid":"5f54ce7d-5b79-4175-8584-cb65313a0e98 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"c36be077-e14b-4fe9-8abc-e856ef4f048b v1.0 Proxy Manager client server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"0d3c7f20-1c8d-4654-a1b3-51563b298bda v1.0 UserMgrCli","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1536]","ncalrpc:[WindowsShutdown]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc0DAC70]"],"executable":"wininit.exe","explained_uuid":"d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0","protocol":"[MS-RSP]: Remote Shutdown Protocol"},{"bindings":["ncalrpc:[dhcpcsvc]","ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:77.83.36.160[1537]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-53abe8cf8102fa0742]"],"executable":"dhcpcsvc.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 DHCP Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[trkwks]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\trkwks]","ncalrpc:[LRPC-716393550d7c83d5be]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE0A4C863CFC5204C7AD761885D33D]","ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"N/A","explained_uuid":"54b4c689-969a-476f-8dc2-990885e9f562 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[OLE64F658201A26D05A184FBBC29F0A]","ncalrpc:[LRPC-ecbda55953f080861f]"],"executable":"N/A","explained_uuid":"3473dd4d-2e88-4006-9cba-22570909dd10 v5.1 WinHttp Auto-Proxy Service","protocol":"N/A"},{"bindings":["ncalrpc:[nlaapi]","ncalrpc:[nlaplg]"],"executable":"N/A","explained_uuid":"eb081a0d-10ee-478a-a1dd-50995283e7a8 v3.0 Witness Client Test Interface","protocol":"N/A"},{"bindings":["ncalrpc:[OLEE02C5AF4699199431FA9BBF234A3]","ncalrpc:[LRPC-3d373ccf12c6d14f58]"],"executable":"N/A","explained_uuid":"d2716e94-25cb-4820-bc15-537866578562 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[OLEE02C5AF4699199431FA9BBF234A3]","ncalrpc:[LRPC-3d373ccf12c6d14f58]"],"executable":"N/A","explained_uuid":"923c9623-db7f-4b34-9e6d-e86580f8ca2a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[OLEFB3FF3DF7DBCCA157DD9C93FA462]","ncalrpc:[LRPC-ef06be913b8d0f5f25]"],"executable":"N/A","explained_uuid":"c503f532-443a-4c69-8300-ccd1fbdb3839 v2.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1537]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-53abe8cf8102fa0742]"],"executable":"wevtsvc.dll","explained_uuid":"f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 Event log TCPIP","protocol":"[MS-EVEN6]: EventLog Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-23b92ca4e180f5188d]"],"executable":"gpsvc.dll","explained_uuid":"2eb08e3e-639f-4fba-97b1-14f878961076 v1.0 Group Policy RPC Interface","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\wkssvc]","ncalrpc:[nlaapi]","ncalrpc:[nlaplg]"],"executable":"N/A","explained_uuid":"7f1343fe-50a9-4927-a778-0c5859517bac v1.0 DfsDs service","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1542]","ncalrpc:[LRPC-a67a96fd8a5911b97a]"],"executable":"spoolsv.exe","explained_uuid":"0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncalrpc:[LRPC-6dede5504bfe23a204]"],"executable":"N/A","explained_uuid":"1a0d010f-1c33-432c-b0f5-8cf4e8053099 v1.0 IdSegSrv service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-767e21b7cc4b937c89]"],"executable":"ssdpsrv.dll","explained_uuid":"4b112204-0e19-11d3-b42b-0000f81feb9f v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:77.83.36.160[1566]"],"executable":"samsrv.dll","explained_uuid":"12345778-1234-abcd-ef00-0123456789ac v1.0","protocol":"[MS-SAMR]: Security Account Manager (SAM) Remote Protocol"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:77.83.36.160[1566]"],"executable":"N/A","explained_uuid":"8fb74744-b2ff-4c00-be0d-9ef9a191fe1b v1.0 Ngc Pop Key Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ecbda55953f080861f]"],"executable":"nsisvc.dll","explained_uuid":"7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0 NSI server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 v1.0 Adh APIs","protocol":"N/A"},{"bindings":["ncalrpc:[csebpub]","ncalrpc:[LRPC-3581d502cadcbff06e]","ncalrpc:[LRPC-e75e955623d5cf99dd]","ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncalrpc:[LRPC-e75e955623d5cf99dd]","ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncalrpc:[LRPC-f702e7737e63b0d99c]","ncalrpc:[dhcpcsvc]","ncalrpc:[dhcpcsvc6]","ncacn_ip_tcp:77.83.36.160[1537]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\eventlog]","ncalrpc:[eventlog]","ncalrpc:[LRPC-53abe8cf8102fa0742]","ncalrpc:[LRPC-655027d56c966bf25e]","ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"d09bdeb5-6171-4a34-bfe2-06fa82652568 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"20c40295-8dba-48e6-aebf-3e78ef3bb144 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"76c217bc-c8b4-4201-a745-373ad9032b1a v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1832bcf6-cab8-41d4-85d2-c9410764f75a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ab50292585f00e0c6c]","ncalrpc:[LRPC-c50dfd36122bba7ce9]","ncalrpc:[LRPC-50448f742bd3b83153]"],"executable":"MPSSVC.dll","explained_uuid":"7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:77.83.36.160[1566]"],"executable":"N/A","explained_uuid":"51a227ae-825b-41f2-b4a9-1ac9557a1018 v1.0 Ngc Pop Key Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-5de5738d8ee56f5a11]"],"executable":"N/A","explained_uuid":"4c9dbf19-d39e-4bb9-90ee-8f7179b20283 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2c7fd9ce-e706-4b40-b412-953107ef9bb0 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8782d3b9-ebbd-4644-a3d8-e8725381919b v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ab50292585f00e0c6c]","ncalrpc:[LRPC-c50dfd36122bba7ce9]","ncalrpc:[LRPC-50448f742bd3b83153]"],"executable":"MPSSVC.dll","explained_uuid":"2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"b18fbab6-56f8-4702-84e0-41053293a869 v1.0 UserMgrCli","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"certprop.dll","explained_uuid":"30b044a5-a225-43f0-b3a4-e060df91f9c1 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1548]"],"executable":"services.exe","explained_uuid":"367abb81-9844-35f1-ad32-98f038001003 v2.0","protocol":"[MS-SCMR]: Service Control Manager Remote Protocol"},{"bindings":["ncalrpc:[OLE81FAEBD62F13D1BF596F11094FEA]","ncalrpc:[LRPC-5b252138bd58ce27b4]"],"executable":"N/A","explained_uuid":"8ec21e98-b5ce-4916-a3d6-449fa428a007 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-5de5738d8ee56f5a11]"],"executable":"N/A","explained_uuid":"e38f5360-8572-473e-b696-1b46873beeab v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-87f34f00249ffe13f3]","ncalrpc:[dabrpc]","ncalrpc:[csebpub]","ncalrpc:[LRPC-3581d502cadcbff06e]","ncalrpc:[LRPC-e75e955623d5cf99dd]","ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"fc48cd89-98d6-4628-9839-86f7a3e4161a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2513bcbe-6cd4-4348-855e-7efb3c336dd3 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"sysntfy.dll","explained_uuid":"c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 Impl friendly name","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"3b338d89-6cfa-44b8-847e-531531bc9992 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"085b0334-e454-4d91-9b8c-4134f9e793f3 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-4851b1907c23fdb0ca]","ncalrpc:[LRPC-4851b1907c23fdb0ca]","ncalrpc:[LRPC-4851b1907c23fdb0ca]"],"executable":"msdtcprx.dll","explained_uuid":"906b0ce0-c70b-1067-b317-00dd010662da v1.0","protocol":"[MS-CMPO]: MSDTC Connection Manager:"},{"bindings":["ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"55e6b932-1979-45d6-90c5-7f6270724112 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"schedsvc.dll","explained_uuid":"0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ff45a8a720f958c6d5]"],"executable":"N/A","explained_uuid":"e7f76134-9ef5-4949-a2d6-3368cc0988f3 v1.0","protocol":"N/A"},{"bindings":["ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\lsass]","ncalrpc:[audit]","ncalrpc:[securityevent]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSA_IDPEXT_ENDPOINT]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsapolicylookup]","ncalrpc:[lsasspirpc]","ncalrpc:[protected_storage]","ncalrpc:[SidKey Local End Point]","ncalrpc:[samss lpc]","ncacn_ip_tcp:77.83.36.160[1566]"],"executable":"N/A","explained_uuid":"b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 v2.0 KeyIso","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8bfc3be1-6def-4e2d-af74-7c47cd0ade4a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LicenseServiceEndpoint]"],"executable":"N/A","explained_uuid":"a4b8d482-80ce-40d6-934d-b22a01a44fe7 v1.0 LicenseManager","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"schedsvc.dll","explained_uuid":"86d35949-83c9-4044-b424-db363231fd0c v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-6dede5504bfe23a204]"],"executable":"srvsvc.dll","explained_uuid":"98716d03-89ac-44c7-bb8c-285824e51c4a v1.0 XactSrv service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-716393550d7c83d5be]","ncalrpc:[TSUMRPD_PRINT_DRV_LPC_API]","ncalrpc:[OLE0A4C863CFC5204C7AD761885D33D]","ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"N/A","explained_uuid":"880fd55e-43b9-11e0-b1a8-cf4edfd72085 v1.0 KAPI Service endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"fb9a3757-cff0-4db0-b9fc-bd6c131612fd v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1542]","ncalrpc:[LRPC-a67a96fd8a5911b97a]"],"executable":"spoolsv.exe","explained_uuid":"ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncalrpc:[OLE81FAEBD62F13D1BF596F11094FEA]","ncalrpc:[LRPC-5b252138bd58ce27b4]"],"executable":"N/A","explained_uuid":"b1ef227e-dfa5-421e-82bb-67a6a129c496 v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[WindowsShutdown]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc0DAC70]","ncalrpc:[WMsgKRpc0F1EE1]","ncalrpc:[WMsgKRpc03160BC2]"],"executable":"winlogon.exe","explained_uuid":"76f226c3-ec14-4325-8a99-6a46348418af v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-3581d502cadcbff06e]","ncalrpc:[LRPC-e75e955623d5cf99dd]","ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"697dcda9-3ba9-4eb2-9247-e11f1901b0d2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c50dfd36122bba7ce9]","ncalrpc:[LRPC-50448f742bd3b83153]"],"executable":"BFE.DLL","explained_uuid":"dd490425-5325-4565-b774-7e27d6c09c24 v1.0 Base Firewall Engine API","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"appinfo.dll","explained_uuid":"58e604e8-9adb-4d2e-a464-3b0683fb1480 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[OLEE02C5AF4699199431FA9BBF234A3]","ncalrpc:[LRPC-3d373ccf12c6d14f58]"],"executable":"N/A","explained_uuid":"0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[WMsgKRpc03160BC2]"],"executable":"winlogon.exe","explained_uuid":"12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 Secure Desktop LRPC interface","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-87f34f00249ffe13f3]","ncalrpc:[dabrpc]","ncalrpc:[csebpub]","ncalrpc:[LRPC-3581d502cadcbff06e]","ncalrpc:[LRPC-e75e955623d5cf99dd]","ncalrpc:[LRPC-10c1735ce0657fa234]","ncalrpc:[OLE8E0AA313D593540A2548763922A2]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-03d9c11473f809deb2]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"9b008953-f195-4bf9-bde0-4471971e58ed v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"appinfo.dll","explained_uuid":"fd7a0523-dc70-43dd-9b2e-9c5ed48225b1 v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"iphlpsvc.dll","explained_uuid":"552d076a-cb29-4e44-8b6a-d15e59e2c0af v1.0 IP Transition Configuration endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"3a9ef155-691d-4449-8d05-09ad57031823 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"33d84484-3626-47ee-8c6f-e7e98b113be1 v2.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c605f9fb-f0a3-4e2a-a073-73560f8d9e3e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-338dae7196a12bafe9]","ncalrpc:[LRPC-655027d56c966bf25e]"],"executable":"N/A","explained_uuid":"5222821f-d5e2-4885-84f1-5f6185a0ec41 v1.0 Network Connection Broker server endpoint for NCB Reset module","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a1f63515e1aa25fe15]","ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"appinfo.dll","explained_uuid":"201ef99a-7fa0-444c-9399-19ba84f12a1a v1.0 AppInfo","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-c69fb1557801ba153f]","ncalrpc:[LRPC-ea54cf45dfbb30a786]","ncacn_ip_tcp:77.83.36.160[1538]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\pipe\\SessEnvPublicRpc]","ncalrpc:[SessEnvPrivateRpc]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\WIN-V3C73LV9C1S[\\PIPE\\atsvc]","ncalrpc:[DeviceSetupManager]","ncalrpc:[senssvc]","ncalrpc:[LRPC-035a345101d5ccb8bf]","ncalrpc:[IUserProfile2]","ncalrpc:[OLEEB6875937B34DDFE31492127672C]"],"executable":"N/A","explained_uuid":"2e6035b2-e8f1-41a7-a044-656b439c4c34 v1.0 Proxy Manager provider server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ff45a8a720f958c6d5]"],"executable":"N/A","explained_uuid":"7aeb6705-3ae6-471a-882d-f39c109edc12 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ff45a8a720f958c6d5]"],"executable":"N/A","explained_uuid":"abfb6ca3-0c5e-4734-9285-0aee72fe8d1c v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:77.83.36.160[1542]","ncalrpc:[LRPC-a67a96fd8a5911b97a]"],"executable":"spoolsv.exe","explained_uuid":"76f03f96-cdfd-44fc-a22c-64950a001209 v1.0","protocol":"[MS-PAR]: Print System Asynchronous Remote Protocol"},{"bindings":["ncalrpc:[OLE81FAEBD62F13D1BF596F11094FEA]","ncalrpc:[LRPC-5b252138bd58ce27b4]"],"executable":"N/A","explained_uuid":"0fc77b1a-95d8-4a2e-a0c0-cff54237462b v0.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2d98a740-581d-41b9-aa0d-a88b9d5ce938 v1.0","protocol":"N/A"}]},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"id":"CENSYS-2022-1025","metrics":{},"name":"Exposed DCERPC Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-25T03:40:59Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":135,"protocol":"DCERPC","scan_time":"2026-06-27T15:27:14Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp"},{"banner":"�\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000e\u0003WIN-V3C73LV9C1S\u0000\u0004\u0000WORKGROUP \u0000�\u0000WIN-V3C73LV9C1S \u0004\u0000��\u001cTD�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","banner_hash_sha256":"c8dfcf84242185bac430e8fac9dfa7842f20cb8679b8ff77749f82f10470bc5c","banner_hex":"e5d88400000000010000000020434b41414141414141414141414141414141414141414141414141414141414100002100010000000000650357494e2d56334337334c5639433153000400574f524b47524f555020202020202000840057494e2d56334337334c563943315320040090b11c5444d800000000000000000000000000000000000000000000000000000000000000000000000000000000","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"77.83.36.160","port":137,"protocol":"NETBIOS","scan_time":"2026-06-26T20:35:31Z","transport_protocol":"udp"},{"banner":"�\u0000\u0000\u0001�","banner_hash_sha256":"ffda6a629d2fc268bbf42019878a56c91ba8a0ca8162c9caa291fff957623e04","banner_hex":"8300000182","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-27T00:05:13Z"},"port":139,"protocol":"NETBIOS","scan_time":"2026-06-27T12:27:22Z","transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SMB","literal_match":"SMB"}],"id":"CENSYS-2022-1063","metrics":{},"name":"Exposed SMB Service","risk_source":"censys","severity":"critical","source":"censys","year":2022}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-24T17:53:00Z"},"port":445,"protocol":"SMB","scan_time":"2026-06-26T23:33:37Z","smb":{"has_ntlm":true,"negotiation_log":{"authentication_types":["1.3.6.1.4.1.311.2.2.30","1.3.6.1.4.1.311.2.2.10"],"capabilities":7,"dialect_revision":770,"header_log":{"credits":1,"flags":1,"protocol_id":"00000000fe534d42"},"security_mode":1,"server_guid":"00000000000000000000000000000000216080c8282edc408f330a7a2253457b","server_start_time":1780156327,"system_time":1782516818},"session_setup_log":{"header_log":{"command":1,"credits":1,"flags":1,"protocol_id":"00000000fe534d42","status":3221225494},"negotiate_flags":2726953477,"target_name":"WIN-V3C73LV9C1S"},"smb_capabilities":{"smb_dfs_support":true,"smb_leasing_support":true,"smb_multicredit_support":true},"smb_version":{"major":3,"revision":2,"version_string":"SMB 3.0.2"}},"transport_protocol":"tcp"},{"cert":{"added_at":"2026-05-19T14:32:19Z","ever_seen_in_scan":true,"fingerprint_md5":"abdaf74bb72816482f8bcb68c76edf66","fingerprint_sha1":"da7cd86a2517fa5aff902cfeac0eb2ecd71064be","fingerprint_sha256":"44b71e9d3de574d2e38dcea3a8bca4adf9f285d1dcc55604dc473995d7078dec","modified_at":"2026-05-19T14:32:19Z","names":["WIN-V3C73LV9C1S"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["WIN-V3C73LV9C1S"]},"issuer_dn":"CN=WIN-V3C73LV9C1S","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"158223988612857063680860665198219294848","serial_number_hex":"7708d4ee283661ac4f980a161666f880","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"valid":true,"value":"58483aacd116ecba0fac56240486dee085f7ed9606da0a858a4030425c28f53a82162f8d4df1355f9371be6068a6a08fbbd5aa9ab5cf8727baf2fac13dd39c9ea73e002c08b63ea4f2eeb27807e47f8cb559a6fd69d0cae3bd62b231d97870b4a9194766c9d9008702afa55520f5b25c199af3c1c1890ccd3d13b415e85078f00ed24f3e20f5a9499aa9242bf81f249cadfd9797fafa48676d312c106e0dbf15ae09504dfcce8d6303b1d2975cd22701361b2389a64a855ccd6c2467488c746e8b608059b94bed8b04ed7e848aaff2814ec79e5af39a5fdbf6cf00a88af56df8b3d5e27b42367725a42a9ad7a8dd35326a81d90059d8f20c9925c0e71e7efc61"},"subject":{"common_name":["WIN-V3C73LV9C1S"]},"subject_dn":"CN=WIN-V3C73LV9C1S","subject_key_info":{"fingerprint_sha256":"8417168f81e5e6862180023263d43c6b6bcf60aefdde8a4318850eaa424e8fe9","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"c5352fb3d6c10c5fe5aff5f07d13333a218a62d411b4f50be425799938726e19e262738f58406242bbf5519a02aafbaaa57bc1aeda1b4be6d7f329970c88f52b0fd8d93cc9e64ad8d602de75826e290ac07937b9d6d06dc98badcf9a9e583f5efac33749475e74a8897abf4dcf844198fa3e06b6aaa7e0a77c18993a93ad3a066b95b63a7b7f620b0ec035033badf00b670a499036ffa4e1484d23836548a1beb142ec27cde7233b74863aca04c00f8ea67b79b3143abd94587443b006496621e514b5649e5c8928f006699251e9c9ef5ab34f806535f99670963b806537984a231b675cf683538afa5f2ebe59ee417ce13f8c26d2f7294e0f5b111c22991c69"}},"validity_period":{"length_seconds":15811201,"not_after":"2026-11-16T22:01:07Z","not_before":"2026-05-17T22:01:07Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"13d27292c85bd44b2907c79736b93934a29c94609a25b07c713a617efea0273f","spki_subject_fingerprint_sha256":"13d27292c85bd44b2907c79736b93934a29c94609a25b07c713a617efea0273f","tbs_fingerprint_sha256":"7969710a8740e421cc3f45e156b554b4f5e43cdc925a2b5222abc55495014a06","tbs_no_ct_fingerprint_sha256":"7969710a8740e421cc3f45e156b554b4f5e43cdc925a2b5222abc55495014a06","validated_at":"2026-06-26T23:58:39Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert"],"notices_present":true,"timestamp":"2026-05-19T14:32:19Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"64000_2-1-3-4-8_1460_0_3-6","scan_time":"2026-06-25T20:25:37Z"},"jarm":{"cipher_and_version_fingerprint":"2ad2ad16d2ad2ad22c2ad2ad2ad2ad","fingerprint":"2ad2ad16d2ad2ad22c2ad2ad2ad2adfd9c9d14e4f4f67f94f0359f8b28f532","ip":"77.83.36.160","is_success":true,"port":3389,"scan_time":"2026-06-23T19:15:58Z","tls_extensions_sha256":"fd9c9d14e4f4f67f94f0359f8b28f532","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":1,"evidence":[{"data_path":"tls.versions.version","found_value":"TLSv1_0","literal_match":"TLSv1_0"},{"data_path":"tls.versions.version","found_value":"TLSv1_1","literal_match":"TLSv1_1"}],"id":"CENSYS-2022-1013","metrics":{},"name":"Downgrade Attack Possible","risk_source":"censys","severity":"medium","source":"censys","year":2022},{"confidence":1,"evidence":[{"data_path":"certificate.fingerprint_sha256","exists":true},{"data_path":"certificate.validation.apple.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.chrome.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.microsoft.has_trusted_path","found_value":"false","literal_match":"false"},{"data_path":"certificate.validation.nss.has_trusted_path","found_value":"false","literal_match":"false"}],"id":"CENSYS-2024-1026","metrics":{},"name":"No Trusted Path Certificate","risk_source":"censys","severity":"medium","source":"censys","year":2024},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"dynvc_graphics_pipeline":true,"extended_client_data_supported":true,"neg_resp_reserved":true,"restricted_admin_mode":true,"restricted_auth_mode":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":10,"minor":2,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-06-27T03:56:57Z","screenshots":[{"extracted_text":"","handle":"ca350d24334c425eb0101f3c11662dd5","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","fingerprint_sha256":"44b71e9d3de574d2e38dcea3a8bca4adf9f285d1dcc55604dc473995d7078dec","ja3s":"364ff14b04ef93c3b4cfa429d729c0d9","ja4s":"t120100_c030_bc98f8e001b5","version_selected":"tlsv1_2","versions":[{"ja3s":"364ff14b04ef93c3b4cfa429d729c0d9","ja4s":"t120100_c030_bc98f8e001b5","version":"tlsv1_2"},{"ja3s":"1308be477c8afb355e2860ab89378ae5","ja4s":"t110100_c014_bc98f8e001b5","version":"tlsv1_1"},{"ja3s":"bcf3a836c82d12ee988005fb0c011445","ja4s":"t100100_c014_bc98f8e001b5","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"id":"CENSYS-2025-1027","metrics":{},"name":"Exposed WINRM Service","risk_source":"censys","severity":"high","source":"censys","year":2025}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-25T06:35:51Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":5985,"protocol":"WINRM","scan_time":"2026-06-27T10:59:55Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp","winrm":{"auth_types":["Negotiate"],"ntlm_info":{"always_sign_supported":true,"challenge_type":3,"dns_domain_name":"WIN-V3C73LV9C1S","dns_server_name":"WIN-V3C73LV9C1S","encryption_128bit_supported":true,"encryption_56bit_supported":true,"netbios_computer_name":"WIN-V3C73LV9C1S","netbios_domain_name":"WIN-V3C73LV9C1S","ntlm1_supported":true,"ntlm2_supported":true,"ntlm_version":15,"os_version":"10.0.14393","target_name":"WIN-V3C73LV9C1S"}}},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \u003cREDACTED\u003e\r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \u003cREDACTED\u003e\r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"77.83.36.160","http":{"body":"\u003c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\u003e\r\n\u003cHTML\u003e\u003cHEAD\u003e\u003cTITLE\u003eNot Found\u003c/TITLE\u003e\r\n\u003cMETA HTTP-EQUIV=\"Content-Type\" Content=\"text/html; charset=us-ascii\"\u003e\u003c/HEAD\u003e\r\n\u003cBODY\u003e\u003ch2\u003eNot Found\u003c/h2\u003e\r\n\u003chr\u003e\u003cp\u003eHTTP Error 404. The requested resource is not found.\u003c/p\u003e\r\n\u003c/BODY\u003e\u003c/HTML\u003e\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":["\u003cREDACTED\u003e"]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["\u003cTITLE\u003eNot Found\u003c/TITLE\u003e","\u003cMETA HTTP-EQUIV=\"Content-Type\" Content=\"text/html; charset=us-ascii\"\u003e"],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://77.83.36.160:47001/"},"ip":"77.83.36.160","path":"/","port":47001,"scan_time":"2026-06-27T12:02:29Z","transport_protocol":"tcp"}],"ip":"77.83.36.160","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-06-26T02:08:23Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-06-27T12:02:29Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["77.83.36.0/24"],"created":"2021-02-02T00:00:00Z","handle":"CLOUDVPS-NET","name":"Internet Solutions \u0026 Innovations LTD.","updated":"2021-02-02T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"info@4cloud.mobi","handle":"NOC299-RIPE","name":"Network Operations Centre"}],"address":"National Cultural Centre 865 P.O. Box 1494, Victoria Mahe, Seychelles","handle":"ORG-ISI14-RIPE","name":"Internet Solutions \u0026 Innovations LTD."}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "45.198.224.18" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":215925,"bgp_prefix":"45.198.224.0/24","country_code":"GB","description":"VPSVAULTHOST - VPSVAULT.HOST LTD","name":"VPSVAULTHOST - VPSVAULT.HOST LTD"},"dns":{"reverse_dns":{"resolve_time":"2026-06-20T13:20:30Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"RouterOS Bruteforcer"}]},"ip":"45.198.224.18","location":{"city":"Amsterdam","continent":"Europe","coordinates":{"latitude":52.37403,"longitude":4.88969},"country":"Netherlands","country_code":"NL","postal_code":"1012","province":"North Holland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15","banner_hash_sha256":"4c5f110dd722c3ffb4b79883bad482531842275e79e1a76c9cfef66492b25b06","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3135","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"45.198.224.18","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-06-25T12:02:52Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-06-26T16:38:24Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.15","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"A+ss9245A6zrT5HB/0vNry5HnrOOrIBu9XjjXoRJbWg=","y":"RNLLxA4LKvUIiHEOucMu3E/a/dMyvR8OAMq03YVwVFk="},"fingerprint_sha256":"24eb366b69003eba31f6c71b52d2d9841d0598625a60596367322e2ad7e566a4"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.9 \u0026\u0026 \u003c9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.797,"score":0.021}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.995,"score":0.768}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.941}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.9 \u0026\u0026 \u003c9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.341,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.971,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.5p1 \u0026\u0026 \u003c=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.6 \u0026\u0026 \u003c=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=6.8p1 \u0026\u0026 \u003c=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=6.9 \u0026\u0026 \u003c=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.933,"score":0.07}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=7.4 \u0026\u0026 \u003c10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.044,"score":0.001}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.205,"score":0.003}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.158,"score":0.002}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.073,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026}]}],"whois":{"network":{"cidrs":["45.198.224.0/24"],"created":"2026-04-24T00:00:00Z","handle":"VPSVAULTHOST_LTD","name":"VPSVAULT.HOST LTD","updated":"2026-04-24T00:00:00Z"}}}}} +``` + +**Tool: censys_get_host** + +**Input:** +```json +{ + "ip": "160.119.71.136" +} +``` + +**Output:** +``` +{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":49870,"bgp_prefix":"160.119.71.0/24","country_code":"NL","description":"AS49870-BV - Alsycon B.V.","name":"AS49870-BV - Alsycon B.V."},"dns":{"reverse_dns":{"names":["160-119-71-136.ptr.as49870.net"],"resolve_time":"2026-06-22T15:48:34Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-06-27T00:00:00Z","tags":[{"name":"React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt"},{"name":"Web Crawler"},{"name":"MySQL Protocol"},{"name":"Generic Suspicious Linux Command in Request"}]},"ip":"160.119.71.136","location":{"city":"Lelystad","continent":"Europe","coordinates":{"latitude":52.50833,"longitude":5.475},"country":"Netherlands","country_code":"NL","postal_code":"8224","province":"Flevoland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"model_version":"0.1.0","score_level":"benign"},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15","banner_hash_sha256":"4c5f110dd722c3ffb4b79883bad482531842275e79e1a76c9cfef66492b25b06","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3135","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"160.119.71.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-06-26T20:24:45Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-06-26T22:32:10Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.15","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"aKGctkN+8rhWUfb92MdN69eHUt+X043GleTxN43d3E8=","y":"oq1JOClOW5s0+ttvq2wVsxcP1KMSHj2iq/BZk6R/6M4="},"fingerprint_sha256":"cf81339e5805983f1aac86e369a3b19d34b6b56875fe454d5fed03447922a7f1"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.9 \u0026\u0026 \u003c9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.797,"score":0.021}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.995,"score":0.768}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.9 \u0026\u0026 \u003c9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.341,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.971,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.5p1 \u0026\u0026 \u003c=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=8.6 \u0026\u0026 \u003c=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=6.8p1 \u0026\u0026 \u003c=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=6.9 \u0026\u0026 \u003c=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.933,"score":0.07}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003e=7.4 \u0026\u0026 \u003c10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.044,"score":0.001}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.205,"score":0.003}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.158,"score":0.002}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"\u003c10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.073,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026}]}],"whois":{"network":{"cidrs":["160.119.70.0/23"],"created":"2018-09-18T00:00:00Z","handle":"JNB01-CLOUD","name":"Cloud Hosting","updated":"2018-09-18T00:00:00Z"}}}}} +``` + +--- + +## Assistant (Sisyphus - Ultraworker · DeepSeek V4 Flash · 24.0s) + +_Thinking:_ + +I now have comprehensive data from both Honeylabs and Censys. Let me synthesize everything into a clear summary. + +Here's the full landscape. + +--- + +## Honeylabs Threat Summary — 26–27 Jun 2026 + +### Volume & Tempo +- **~395K events** across the 40-hour window, from **~45K unique source IPs** +- Baseline ~9K events/hr with two notable spikes: **32K/hr at 03:00 UTC** (single IP, Brazil DNS flood), **15K–16.5K/hr** at 02:00 and 05:00 UTC both days +- Sustained activity — no sign of let-up + +### Top Targeted Ports +| Port | Events | What | +|------|--------|------| +| **50050** | 12,126 | Custom — Bucklog SARL cluster (FR) | +| **53** | 11,810 | DNS amplification / reconnaissance | +| **8417** | 9,023 | Custom — Bucklog SARL cluster | +| **445** | 5,859 | SMB worm/ransomware scanning | +| **443** | 4,720 | HTTPS | +| **80** | 4,049 | HTTP | +| **22** | 3,866 | SSH bruteforce | +| **135** | 3,059 | DCERPC | +| **8728** | 1,693 | MikroTik RouterOS API | +| **3389** | 730 | RDP | + +### Source Geography +**US dominates** (179K events, 5,688 IPs) — mostly Google Cloud scan infrastructure. Then **GB** (60K), **FR** (58K), **BG** (24K), **NL** (17K), **BR** (14K). China's 942 IPs are high by unique count but only 5.6K events — broad, light-touch probing. + +--- + +## Enriched Key IPs + +### 🔴 79.124.58.126 — #1 Attacker (21,148 events) +- **Bulgaria**, Tamatiya EOOD, Sofia +- **SSH port 22**: OpenSSH 9.9 — running a **fresh, vulnerable** install (8 CVEs flagged incl. `CVE-2024-6387` regreSSHion, `CVE-2025-26465`, `CVE-2026-35385`) +- GreyNoise: **suspicious** — Web Crawler, Palo Alto PAN-OS scanner, Cisco ASA scanner, TLS/SSL crawler +- Hit 5 random high ports (26224, 46925, 54537, ...) — textbook masscan/shodan-style sweepbox + +### 🔴 179.111.21.60 — DNS Flood (11,594 events in 27 min) +- **Brazil**, TELEFONICA BRASIL S.A, Atibaia/SP (residential DSL) +- Hit **only port 53** (DNS) — intense 27-minute burst at 03:00 UTC +- GreyNoise: no classification (likely a temporarily compromised residential router) +- RDNS: `179-111-21-60.dsl.telesp.net.br` — confirms consumer DSL + +### 🔴 185.177.72.38 / .205 / .24 / .68 / .54 — Bucklog SARL Cluster (22,831 events) +- **France**, Bucklog SARL / FBW Networks SAS, Paris — hosting provider +- **Both flagged malicious** by GreyNoise with **60+ attack tags** — full-spectrum web exploitation: Spring Boot Actuator, Kubernetes, Wordpress, Laravel, PHPUnit RCE, Docker, Grafana, all CVEs +- Running a **Kubernetes cluster** (`ingress-nginx`, `envoy`, Cilium cert, "Cluster Monitor" Express app on port 30010) +- Ports exposed: 4240, 4244 (TLS with Cilium hubble cert), 9964 (envoy), 10250 (kubelet), 10256, 30010, 32697 +- These are **not the attackers** — they're the *target*. The honeypot is recording them being scanned/attacked by others + +### 🔴 62.164.177.41 — Data Campus Windows Server (3,522 events) +- **Netherlands** (HK company), Data Campus Ltd, Amsterdam +- **Windows Server 2016** (OS 10.0.14393), fully exposed: + - **SMB 3.0.2** (port 445 — critical) + - **RDP** (port 3389 — TLS 1.0/1.1 enabled, downgrade possible, self-signed cert) + - **WINRM** (port 5985 — Negotiate auth exposed) + - **DCERPC** (port 135 — high risk) + - **NetBIOS** (ports 137/139) +- GreyNoise: **malicious** — RDP crawler, bruteforce, RFB, MySQL +- This is a **honeypot itself** or a badly-exposed Windows VPS being hammered from all angles + +### 🔴 80.82.77.202 — IP Volume (2,368 events) +- **Seychelles** hq, hosted in Amsterdam — IP Volume inc (known bulletproof-ish host) +- RDNS: `rnd.group-ib.com`, FDNS: `interactsh.group-ib.com` (Group-IB interactsh instance — legit security research?) +- GreyNoise: **suspicious** — masscan, MySQL, XSS, SQLi, GoogleBot pretender, TLS/SSL crawler +- Hit high ports: 7777, 9955, 7895, 5000, 6443 + +### 🔴 185.93.89.121 — Iranian Scanning Node (2,112 events) +- **Registered in UK** (Limited Network LTD) but routed through Netherlands (Kerkrade) +- Hit random high ports — generic sweep +- Only appeared for ~5 hours on 26 June then vanished + +### 🔴 77.83.36.160 — RDP Brute-Forcer (1,626 events) +- **Ukraine-hosted** (Layer7 Networks GmbH), but RDNS Bulgaria (Sofia) +- **Windows Server 2016** — RDP (3389 + variants), SMB, DCERPC, NetBIOS, WINRM all exposed +- GreyNoise: **malicious** — RDP crawler + RDP bruteforce +- Hit honeypot on RDP ports exclusively — dedicated credential-stuffing box +- Hostname: `WIN-V3C73LV9C1S` + +### 🔴 45.198.224.18 — MikroTik RouterOS Brute-Forcer (1,255 events) +- **UK company** (VPSVault.Host Ltd), hosted in Amsterdam +- Only **port 8728** — MikroTik RouterOS API +- GreyNoise: **malicious** — RouterOS brute-forcer +- OpenSSH 8.9p1 Ubuntu on same box — riddled with **critical CVEs** (`CVE-2024-6387`, `CVE-2023-38408` KEV, `CVE-2023-48795` KEV) +- This box is actively hunting MikroTik routers while itself being extremely vulnerable + +### 🔴 160.119.71.136 — Seychelles Scanner (1,252 events) +- **Alsycon B.V.**, Netherlands-hosted, Seychelles company +- Hitting high ports 30002, 4100, 3443, 8098, 30023 +- GreyNoise: **malicious** — React Server Components RCE (`CVE-2025-55182`), web crawler, suspicious Linux commands +- SSH only exposed (OpenSSH 8.9p1 — same CVE-laden version) + +--- + +### Key Takeaways +1. **Bucklog SARL cluster** (185.177.72.0/24) is the day's biggest story — a French Kubernetes cluster getting absolutely hammered by every web exploit in existence +2. **Windows RDP/SMB/WINRM boxes** (62.164.177.41, 77.83.36.160) are the most exposed — both are Windows 2016 with SMB, RDP, and WINRM wide open +3. **Massive infrastructure asymmetry** — US/Google Cloud is the top source by volume (scanning services), but the densest hostile activity is from bulletproof-friendly hosts (BG, FR, NL, SC) +4. **MikroTik hunting is active** — port 8728 is a clear signal of RouterOS credential-stuffing campaigns + +--- + |