From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../2026-08-31/censys/aggregations-AS138915.ndjson | 5 + .../2026-08-31/censys/aggregations-AS140666.ndjson | 5 + .../2026-08-31/censys/aggregations-AS14956.ndjson | 5 + .../2026-08-31/censys/aggregations-AS198953.ndjson | 5 + .../2026-08-31/censys/aggregations-AS200593.ndjson | 5 + .../2026-08-31/censys/aggregations-AS200651.ndjson | 5 + .../2026-08-31/censys/aggregations-AS202685.ndjson | 5 + .../2026-08-31/censys/aggregations-AS206728.ndjson | 5 + .../2026-08-31/censys/aggregations-AS209847.ndjson | 5 + .../2026-08-31/censys/aggregations-AS210644.ndjson | 5 + .../2026-08-31/censys/aggregations-AS211720.ndjson | 5 + .../2026-08-31/censys/aggregations-AS213702.ndjson | 5 + .../2026-08-31/censys/aggregations-AS214351.ndjson | 5 + .../2026-08-31/censys/aggregations-AS214940.ndjson | 5 + .../2026-08-31/censys/aggregations-AS216139.ndjson | 5 + .../2026-08-31/censys/aggregations-AS216246.ndjson | 5 + .../2026-08-31/censys/aggregations-AS216309.ndjson | 5 + .../2026-08-31/censys/aggregations-AS30823.ndjson | 5 + .../2026-08-31/censys/aggregations-AS33993.ndjson | 5 + .../2026-08-31/censys/aggregations-AS394711.ndjson | 5 + .../2026-08-31/censys/aggregations-AS400992.ndjson | 5 + .../2026-08-31/censys/aggregations-AS51396.ndjson | 5 + .../2026-08-31/censys/aggregations-AS51852.ndjson | 5 + .../2026-08-31/censys/aggregations-AS57043.ndjson | 5 + .../2026-08-31/censys/aggregations-AS58854.ndjson | 5 + kevlar/2026-08-31/censys/aggregations-all.json | 4907 ++++++++++++++++++++ kevlar/2026-08-31/censys/fleet-correlation.csv | 11 + kevlar/2026-08-31/censys/ip-enrichments.ndjson | 10 + 28 files changed, 5053 insertions(+) create mode 100644 kevlar/2026-08-31/censys/aggregations-AS138915.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS140666.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS14956.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS198953.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS200593.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS200651.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS202685.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS206728.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS209847.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS210644.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS211720.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS213702.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS214351.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS214940.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS216139.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS216246.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS216309.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS30823.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS33993.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS394711.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS400992.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS51396.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS51852.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS57043.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-AS58854.ndjson create mode 100644 kevlar/2026-08-31/censys/aggregations-all.json create mode 100644 kevlar/2026-08-31/censys/fleet-correlation.csv create mode 100644 kevlar/2026-08-31/censys/ip-enrichments.ndjson (limited to 'kevlar/2026-08-31/censys') diff --git a/kevlar/2026-08-31/censys/aggregations-AS138915.ndjson b/kevlar/2026-08-31/censys/aggregations-AS138915.ndjson new file mode 100644 index 0000000..200f5bb --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS138915.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 7319, "key": "22"}, {"count": 2669, "key": "443"}, {"count": 2501, "key": "80"}, {"count": 2430, "key": "32080"}, {"count": 2379, "key": "43080"}, {"count": 2243, "key": "40003"}, {"count": 2238, "key": "40801"}, {"count": 2235, "key": "40803"}, {"count": 2234, "key": "40804"}, {"count": 2229, "key": "40810"}], "is_more_than_total_hits": false, "other_count": 62162, "query_duration_millis": 306, "total_count": 13554}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 7679, "key": "openssh"}, {"count": 6327, "key": "openresty"}, {"count": 4526, "key": "tengine"}, {"count": 3369, "key": "nginx"}, {"count": 1055, "key": "http_api"}, {"count": 553, "key": "http_server"}, {"count": 435, "key": "express"}, {"count": 430, "key": "jquery"}, {"count": 309, "key": "bootstrap"}, {"count": 309, "key": "openvpn_access_server"}], "is_more_than_total_hits": false, "other_count": 4900, "query_duration_millis": 154, "total_count": 13554}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 13554, "key": "BULLETPROOF"}, {"count": 99, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 470, "total_count": 13554}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 4619, "key": "GlobalSign GCC R3 OV TLS CA 2024"}, {"count": 2393, "key": "localhost"}, {"count": 2346, "key": "prod-vpn.example.com"}, {"count": 2310, "key": "GlobalSign GCC R46 OV TLS CA 2025"}, {"count": 2240, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 1206, "key": "Sectigo Public Server Authentication CA DV R36"}, {"count": 431, "key": "NONE"}, {"count": 431, "key": "WoTrus RSA DV SSL CA 2"}, {"count": 361, "key": "YR1"}, {"count": 345, "key": "WIN-9QFKHJ39QE9"}], "is_more_than_total_hits": false, "other_count": 7531, "query_duration_millis": 511, "total_count": 13554}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 6092, "key": "linux"}, {"count": 626, "key": "windows"}, {"count": 66, "key": "routeros"}, {"count": 36, "key": "ubuntu"}, {"count": 33, "key": "debian_linux"}, {"count": 31, "key": "centos"}, {"count": 10, "key": "adaptive_security_appliance_software"}, {"count": 10, "key": "proxmox"}, {"count": 4, "key": "linux_kernel"}, {"count": 3, "key": "freebsd"}], "is_more_than_total_hits": false, "other_count": 10, "query_duration_millis": 195, "total_count": 13554}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson b/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson new file mode 100644 index 0000000..48305e4 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 1652, "key": "22"}, {"count": 694, "key": "443"}, {"count": 535, "key": "80"}, {"count": 376, "key": "6004"}, {"count": 376, "key": "6011"}, {"count": 375, "key": "6001"}, {"count": 375, "key": "6006"}, {"count": 375, "key": "6007"}, {"count": 375, "key": "6010"}, {"count": 375, "key": "6012"}], "is_more_than_total_hits": false, "other_count": 12271, "query_duration_millis": 32, "total_count": 2805}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1615, "key": "openssh"}, {"count": 1378, "key": "nginx"}, {"count": 146, "key": "openresty"}, {"count": 131, "key": "http_api"}, {"count": 80, "key": "jquery"}, {"count": 74, "key": "internet_information_services"}, {"count": 58, "key": "tengine"}, {"count": 54, "key": "bootstrap"}, {"count": 39, "key": "express"}, {"count": 36, "key": "node_exporter"}], "is_more_than_total_hits": false, "other_count": 575, "query_duration_millis": 168, "total_count": 2805}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 2805, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 244, "total_count": 2805}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 338, "key": "Sectigo Public Server Authentication CA DV R36"}, {"count": 183, "key": "NONE"}, {"count": 135, "key": "RapidSSL TLS RSA CA G1"}, {"count": 109, "key": "tudog_node_agent._reserved.bytefcdn.com"}, {"count": 107, "key": "RTCTS"}, {"count": 102, "key": "GeoTrust TLS RSA CA G1"}, {"count": 92, "key": "QY"}, {"count": 65, "key": "RapidSSL TLS ECC CA G1"}, {"count": 60, "key": "tls.internal.ypc.org"}, {"count": 47, "key": "GlobalSign GCC R3 OV TLS CA 2024"}], "is_more_than_total_hits": false, "other_count": 717, "query_duration_millis": 67, "total_count": 2805}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 1089, "key": "linux"}, {"count": 95, "key": "windows"}, {"count": 13, "key": "ubuntu"}, {"count": 3, "key": "routeros"}, {"count": 2, "key": "adaptive_security_appliance_software"}, {"count": 2, "key": "debian_linux"}, {"count": 1, "key": "linux_kernel"}, {"count": 1, "key": "proxmox"}, {"count": 1, "key": "windows_server_2008_r2"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 20, "total_count": 2805}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS14956.ndjson b/kevlar/2026-08-31/censys/aggregations-AS14956.ndjson new file mode 100644 index 0000000..c24b187 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS14956.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 15480, "key": "22"}, {"count": 8450, "key": "443"}, {"count": 7520, "key": "3389"}, {"count": 7412, "key": "80"}, {"count": 1091, "key": "2096"}, {"count": 1021, "key": "5985"}, {"count": 985, "key": "135"}, {"count": 842, "key": "445"}, {"count": 797, "key": "53"}, {"count": 786, "key": "8443"}], "is_more_than_total_hits": false, "other_count": 20519, "query_duration_millis": 125, "total_count": 25654}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 14570, "key": "openssh"}, {"count": 10034, "key": "nginx"}, {"count": 2567, "key": "express"}, {"count": 1582, "key": "http_server"}, {"count": 1224, "key": "dovecot"}, {"count": 1124, "key": "http_api"}, {"count": 859, "key": "google_web_services"}, {"count": 804, "key": "web_server"}, {"count": 705, "key": "caddy"}, {"count": 666, "key": "jquery"}], "is_more_than_total_hits": false, "other_count": 16007, "query_duration_millis": 91, "total_count": 25654}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 25654, "key": "BULLETPROOF"}, {"count": 210, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 22, "total_count": 25654}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 2029, "key": "YE2"}, {"count": 1907, "key": "YE1"}, {"count": 995, "key": "windows-Dallas0"}, {"count": 977, "key": "YR1"}, {"count": 967, "key": "YR2"}, {"count": 870, "key": "invalid2.invalid"}, {"count": 429, "key": "windows-Utah-4g"}, {"count": 378, "key": "www.example.com"}, {"count": 373, "key": "windows-Amsterd"}, {"count": 343, "key": "TRAEFIK DEFAULT CERT"}], "is_more_than_total_hits": false, "other_count": 13042, "query_duration_millis": 160, "total_count": 25654}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 13776, "key": "linux"}, {"count": 5506, "key": "windows"}, {"count": 218, "key": "ubuntu"}, {"count": 135, "key": "debian_linux"}, {"count": 101, "key": "routeros"}, {"count": 30, "key": "freebsd"}, {"count": 21, "key": "linux_kernel"}, {"count": 21, "key": "windows_server"}, {"count": 9, "key": "proxmox"}, {"count": 8, "key": "adaptive_security_appliance_software"}], "is_more_than_total_hits": false, "other_count": 20, "query_duration_millis": 126, "total_count": 25654}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS198953.ndjson b/kevlar/2026-08-31/censys/aggregations-AS198953.ndjson new file mode 100644 index 0000000..b76afdb --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS198953.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 166, "key": "3389"}, {"count": 161, "key": "22"}, {"count": 89, "key": "80"}, {"count": 83, "key": "443"}, {"count": 52, "key": "135"}, {"count": 41, "key": "137"}, {"count": 39, "key": "53"}, {"count": 36, "key": "139"}, {"count": 35, "key": "5985"}, {"count": 25, "key": "21"}], "is_more_than_total_hits": false, "other_count": 374, "query_duration_millis": 185, "total_count": 360}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 128, "key": "nginx"}, {"count": 123, "key": "openssh"}, {"count": 63, "key": "dovecot"}, {"count": 44, "key": "http_api"}, {"count": 36, "key": "express"}, {"count": 31, "key": "http_server"}, {"count": 30, "key": "fastpanel"}, {"count": 24, "key": "exim"}, {"count": 22, "key": "requirejs"}, {"count": 19, "key": "parallels_plesk_panel"}], "is_more_than_total_hits": false, "other_count": 231, "query_duration_millis": 146, "total_count": 360}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 360, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 923, "total_count": 360}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 23, "key": "Plesk"}, {"count": 19, "key": "YR1"}, {"count": 16, "key": "etc"}, {"count": 11, "key": "AnyDesk Client"}, {"count": 10, "key": "localhost"}, {"count": 9, "key": "R11"}, {"count": 9, "key": "parking"}, {"count": 8, "key": "R12"}, {"count": 8, "key": "YR2"}, {"count": 8, "key": "test"}], "is_more_than_total_hits": false, "other_count": 272, "query_duration_millis": 147, "total_count": 360}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 117, "key": "linux"}, {"count": 41, "key": "windows"}, {"count": 4, "key": "ubuntu"}, {"count": 3, "key": "debian_linux"}, {"count": 2, "key": "proxmox"}, {"count": 1, "key": "adaptive_security_appliance_software"}, {"count": 1, "key": "freenas_firmware"}, {"count": 1, "key": "ios"}, {"count": 1, "key": "linux_kernel"}, {"count": 1, "key": "routeros"}], "is_more_than_total_hits": false, "other_count": 2, "query_duration_millis": 25, "total_count": 360}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson b/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson new file mode 100644 index 0000000..407b511 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 201, "key": "22"}, {"count": 133, "key": "3389"}, {"count": 113, "key": "80"}, {"count": 81, "key": "443"}, {"count": 38, "key": "53"}, {"count": 26, "key": "135"}, {"count": 26, "key": "5985"}, {"count": 23, "key": "21"}, {"count": 21, "key": "25"}, {"count": 20, "key": "143"}], "is_more_than_total_hits": false, "other_count": 310, "query_duration_millis": 245, "total_count": 348}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 150, "key": "nginx"}, {"count": 137, "key": "openssh"}, {"count": 60, "key": "dovecot"}, {"count": 35, "key": "parallels_plesk_panel"}, {"count": 35, "key": "prototype"}, {"count": 35, "key": "requirejs"}, {"count": 33, "key": "express"}, {"count": 30, "key": "http_server"}, {"count": 29, "key": "http_api"}, {"count": 24, "key": "plesk"}], "is_more_than_total_hits": false, "other_count": 180, "query_duration_millis": 32, "total_count": 348}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 348, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 97, "total_count": 348}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 42, "key": "Plesk"}, {"count": 29, "key": "YR1"}, {"count": 24, "key": "YR2"}, {"count": 13, "key": "YE1"}, {"count": 12, "key": "R13"}, {"count": 9, "key": "TRAEFIK DEFAULT CERT"}, {"count": 7, "key": "DESKTOP-GKGI28A"}, {"count": 6, "key": "R12"}, {"count": 6, "key": "ckicksp-1.example.com"}, {"count": 6, "key": "devin-coo-1.example.com"}], "is_more_than_total_hits": false, "other_count": 207, "query_duration_millis": 183, "total_count": 348}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 138, "key": "linux"}, {"count": 26, "key": "windows"}, {"count": 3, "key": "proxmox"}, {"count": 2, "key": "debian_linux"}, {"count": 1, "key": "ubuntu"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 262, "total_count": 348}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson b/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson new file mode 100644 index 0000000..b59c7c8 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 2841, "key": "22"}, {"count": 2118, "key": "443"}, {"count": 1917, "key": "80"}, {"count": 380, "key": "53"}, {"count": 282, "key": "25"}, {"count": 234, "key": "587"}, {"count": 222, "key": "993"}, {"count": 189, "key": "111"}, {"count": 186, "key": "143"}, {"count": 168, "key": "110"}], "is_more_than_total_hits": false, "other_count": 4831, "query_duration_millis": 180, "total_count": 3806}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 2825, "key": "nginx"}, {"count": 2589, "key": "openssh"}, {"count": 585, "key": "dovecot"}, {"count": 465, "key": "http_server"}, {"count": 361, "key": "cpanel"}, {"count": 303, "key": "express"}, {"count": 270, "key": "exim"}, {"count": 258, "key": "caddy"}, {"count": 247, "key": "openresty"}, {"count": 196, "key": "authoritative_server"}], "is_more_than_total_hits": false, "other_count": 3469, "query_duration_millis": 79, "total_count": 3806}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 3806, "key": "BULLETPROOF"}, {"count": 130, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 20, "total_count": 3806}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 725, "key": "YE1"}, {"count": 637, "key": "YR2"}, {"count": 612, "key": "YE2"}, {"count": 562, "key": "YR1"}, {"count": 131, "key": "TRAEFIK DEFAULT CERT"}, {"count": 99, "key": "invalid2.invalid"}, {"count": 59, "key": "localhost"}, {"count": 47, "key": "WE1"}, {"count": 40, "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"}, {"count": 40, "key": "www.example.com"}], "is_more_than_total_hits": false, "other_count": 1621, "query_duration_millis": 128, "total_count": 3806}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 2167, "key": "linux"}, {"count": 56, "key": "ubuntu"}, {"count": 48, "key": "debian_linux"}, {"count": 30, "key": "proxmox"}, {"count": 27, "key": "windows"}, {"count": 10, "key": "freebsd"}, {"count": 8, "key": "routeros"}, {"count": 6, "key": "enterprise_linux"}, {"count": 6, "key": "openbsd"}, {"count": 5, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 8, "query_duration_millis": 162, "total_count": 3806}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS202685.ndjson b/kevlar/2026-08-31/censys/aggregations-AS202685.ndjson new file mode 100644 index 0000000..4a3143e --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS202685.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 4, "key": "80"}, {"count": 2, "key": "443"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 484, "total_count": 4}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 4, "key": "internet_information_services"}, {"count": 2, "key": "asp.net"}, {"count": 2, "key": "asp\\.net"}, {"count": 2, "key": "http_api"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 154, "total_count": 4}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 4, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 116, "total_count": 4}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 1, "key": "GeoTrust TLS RSA CA G1"}, {"count": 1, "key": "YR1"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 155, "total_count": 4}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 4, "key": "windows"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 120, "total_count": 4}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS206728.ndjson b/kevlar/2026-08-31/censys/aggregations-AS206728.ndjson new file mode 100644 index 0000000..88567ee --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS206728.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 7, "key": "443"}, {"count": 6, "key": "80"}, {"count": 3, "key": "53"}, {"count": 2, "key": "22"}, {"count": 2, "key": "445"}, {"count": 2, "key": "5910"}, {"count": 2, "key": "5934"}, {"count": 1, "key": "135"}, {"count": 1, "key": "139"}, {"count": 1, "key": "500"}], "is_more_than_total_hits": false, "other_count": 7, "query_duration_millis": 26, "total_count": 20}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 5, "key": "nginx"}, {"count": 4, "key": "http_api"}, {"count": 2, "key": "asp.net"}, {"count": 2, "key": "asp\\.net"}, {"count": 2, "key": "internet_information_services"}, {"count": 1, "key": "moment"}, {"count": 1, "key": "openssh"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 89, "total_count": 20}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 20, "key": "BULLETPROOF"}, {"count": 6, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 777, "total_count": 20}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 2, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 1, "key": "YE1"}, {"count": 1, "key": "hotelsoft.cer"}, {"count": 1, "key": "invalid2.invalid"}, {"count": 1, "key": "v673"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 132, "total_count": 20}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 6, "key": "windows"}, {"count": 1, "key": "linux"}, {"count": 1, "key": "routeros"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 58, "total_count": 20}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS209847.ndjson b/kevlar/2026-08-31/censys/aggregations-AS209847.ndjson new file mode 100644 index 0000000..e4b2cfd --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS209847.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 980, "key": "22"}, {"count": 564, "key": "8080"}, {"count": 517, "key": "1030"}, {"count": 517, "key": "1050"}, {"count": 514, "key": "24442"}, {"count": 499, "key": "1235"}, {"count": 494, "key": "1234"}, {"count": 440, "key": "443"}, {"count": 419, "key": "53"}, {"count": 387, "key": "80"}], "is_more_than_total_hits": false, "other_count": 2363, "query_duration_millis": 111, "total_count": 1784}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1567, "key": "python"}, {"count": 1554, "key": "aiohttp"}, {"count": 1231, "key": "openssh"}, {"count": 723, "key": "nginx"}, {"count": 367, "key": "bind"}, {"count": 312, "key": "dovecot"}, {"count": 217, "key": "exim"}, {"count": 201, "key": "proftpd"}, {"count": 130, "key": "google_web_services"}, {"count": 130, "key": "web_server"}], "is_more_than_total_hits": false, "other_count": 737, "query_duration_millis": 109, "total_count": 1784}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 1784, "key": "BULLETPROOF"}, {"count": 5, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 190, "total_count": 1784}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 221, "key": "YR1"}, {"count": 203, "key": "YR2"}, {"count": 132, "key": "invalid2.invalid"}, {"count": 121, "key": "YE2"}, {"count": 107, "key": "YE1"}, {"count": 30, "key": "server"}, {"count": 22, "key": "GeoTrust TLS RSA CA G1"}, {"count": 21, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 19, "key": "Sectigo Public Server Authentication CA DV E36"}, {"count": 17, "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"}], "is_more_than_total_hits": false, "other_count": 1073, "query_duration_millis": 118, "total_count": 1784}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 1210, "key": "linux"}, {"count": 42, "key": "ubuntu"}, {"count": 14, "key": "windows"}, {"count": 5, "key": "routeros"}, {"count": 2, "key": "linux_kernel"}, {"count": 1, "key": "adaptive_security_appliance_software"}, {"count": 1, "key": "centos"}, {"count": 1, "key": "debian_linux"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 125, "total_count": 1784}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS210644.ndjson b/kevlar/2026-08-31/censys/aggregations-AS210644.ndjson new file mode 100644 index 0000000..0210dc2 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS210644.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 62401, "key": "22"}, {"count": 35627, "key": "443"}, {"count": 18220, "key": "80"}, {"count": 12493, "key": "2096"}, {"count": 8314, "key": "8443"}, {"count": 6208, "key": "8080"}, {"count": 3499, "key": "2053"}, {"count": 1995, "key": "2222"}, {"count": 1737, "key": "3389"}, {"count": 1158, "key": "53"}], "is_more_than_total_hits": false, "other_count": 59626, "query_duration_millis": 77, "total_count": 72191}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 61805, "key": "openssh"}, {"count": 30153, "key": "nginx"}, {"count": 7299, "key": "google_web_services"}, {"count": 7299, "key": "web_server"}, {"count": 5523, "key": "ghost"}, {"count": 5521, "key": "app_and_api_protector"}, {"count": 4247, "key": "express"}, {"count": 3438, "key": "caddy"}, {"count": 3128, "key": "waf"}, {"count": 2926, "key": "cloudflare_load_balancer"}], "is_more_than_total_hits": false, "other_count": 34593, "query_duration_millis": 158, "total_count": 72191}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 72191, "key": "BULLETPROOF"}, {"count": 509, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 238, "total_count": 72191}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 13117, "key": "YE2"}, {"count": 13008, "key": "YE1"}, {"count": 7385, "key": "invalid2.invalid"}, {"count": 5097, "key": "YR2"}, {"count": 3278, "key": "YR1"}, {"count": 2117, "key": "GeoTrust TLS RSA CA G1"}, {"count": 2056, "key": "WE1"}, {"count": 1819, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 1341, "key": "Microsoft TLS G2 RSA CA OCSP 04"}, {"count": 1288, "key": "GlobalSign ECC OV SSL CA 2018"}], "is_more_than_total_hits": false, "other_count": 25046, "query_duration_millis": 193, "total_count": 72191}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 60420, "key": "linux"}, {"count": 719, "key": "ubuntu"}, {"count": 573, "key": "windows"}, {"count": 209, "key": "debian_linux"}, {"count": 84, "key": "routeros"}, {"count": 83, "key": "linux_kernel"}, {"count": 34, "key": "adaptive_security_appliance_software"}, {"count": 14, "key": "linux_ami"}, {"count": 13, "key": "centos"}, {"count": 12, "key": "windows_server"}], "is_more_than_total_hits": false, "other_count": 16, "query_duration_millis": 56, "total_count": 72191}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS211720.ndjson b/kevlar/2026-08-31/censys/aggregations-AS211720.ndjson new file mode 100644 index 0000000..9816c61 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS211720.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 28, "key": "22"}, {"count": 19, "key": "3389"}, {"count": 14, "key": "179"}, {"count": 9, "key": "80"}, {"count": 7, "key": "443"}, {"count": 6, "key": "111"}, {"count": 6, "key": "5985"}, {"count": 4, "key": "8081"}, {"count": 3, "key": "8080"}, {"count": 2, "key": "135"}], "is_more_than_total_hits": false, "other_count": 14, "query_duration_millis": 260, "total_count": 50}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 25, "key": "openssh"}, {"count": 11, "key": "nginx"}, {"count": 6, "key": "http_api"}, {"count": 2, "key": "mariadb"}, {"count": 2, "key": "tor"}, {"count": 1, "key": "caddy"}, {"count": 1, "key": "dropbear_ssh"}, {"count": 1, "key": "gunicorn"}, {"count": 1, "key": "http_server"}, {"count": 1, "key": "libupnp"}], "is_more_than_total_hits": false, "other_count": 2, "query_duration_millis": 111, "total_count": 50}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 50, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 80, "total_count": 50}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 3, "key": "IPMI"}, {"count": 2, "key": "FREE"}, {"count": 1, "key": "WIN-JDCEOBUFJUS"}, {"count": 1, "key": "WIN-JP7KUDECHOR"}, {"count": 1, "key": "YE1"}, {"count": 1, "key": "YE2"}, {"count": 1, "key": "YR2"}, {"count": 1, "key": "agent-ca@1757674441"}, {"count": 1, "key": "agent-ca@1757925038"}, {"count": 1, "key": "agent-ca@1759158944"}], "is_more_than_total_hits": false, "other_count": 16, "query_duration_millis": 122, "total_count": 50}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 10, "key": "linux"}, {"count": 3, "key": "windows"}, {"count": 1, "key": "debian_linux"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 98, "total_count": 50}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS213702.ndjson b/kevlar/2026-08-31/censys/aggregations-AS213702.ndjson new file mode 100644 index 0000000..1345dd5 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS213702.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 6376, "key": "22"}, {"count": 4393, "key": "443"}, {"count": 2150, "key": "80"}, {"count": 2020, "key": "2222"}, {"count": 820, "key": "8443"}, {"count": 671, "key": "2096"}, {"count": 404, "key": "3389"}, {"count": 242, "key": "8080"}, {"count": 193, "key": "2053"}, {"count": 160, "key": "9443"}], "is_more_than_total_hits": false, "other_count": 4685, "query_duration_millis": 3206, "total_count": 7381}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 6147, "key": "openssh"}, {"count": 3386, "key": "nginx"}, {"count": 621, "key": "caddy"}, {"count": 522, "key": "google_web_services"}, {"count": 521, "key": "web_server"}, {"count": 472, "key": "app_and_api_protector"}, {"count": 472, "key": "ghost"}, {"count": 333, "key": "express"}, {"count": 266, "key": "waf"}, {"count": 254, "key": "cloudflare_load_balancer"}], "is_more_than_total_hits": false, "other_count": 2854, "query_duration_millis": 37, "total_count": 7381}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 7381, "key": "BULLETPROOF"}, {"count": 16, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 27, "total_count": 7381}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 1187, "key": "YE2"}, {"count": 1098, "key": "YE1"}, {"count": 768, "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo"}, {"count": 524, "key": "invalid2.invalid"}, {"count": 331, "key": "YR2"}, {"count": 234, "key": "YR1"}, {"count": 217, "key": "GeoTrust TLS RSA CA G1"}, {"count": 193, "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5"}, {"count": 185, "key": "NvJhHp68p5mjSuW_EK9Lab6bH9"}, {"count": 169, "key": "WE1"}], "is_more_than_total_hits": false, "other_count": 3494, "query_duration_millis": 144, "total_count": 7381}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 6029, "key": "linux"}, {"count": 98, "key": "windows"}, {"count": 63, "key": "ubuntu"}, {"count": 14, "key": "debian_linux"}, {"count": 10, "key": "linux_kernel"}, {"count": 1, "key": "enterprise_linux"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 49, "total_count": 7381}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS214351.ndjson b/kevlar/2026-08-31/censys/aggregations-AS214351.ndjson new file mode 100644 index 0000000..a86b0f5 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS214351.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 547, "key": "80"}, {"count": 536, "key": "22"}, {"count": 340, "key": "443"}, {"count": 94, "key": "21"}, {"count": 93, "key": "53"}, {"count": 89, "key": "25"}, {"count": 87, "key": "8085"}, {"count": 86, "key": "22509"}, {"count": 81, "key": "143"}, {"count": 81, "key": "993"}], "is_more_than_total_hits": false, "other_count": 1019, "query_duration_millis": 291, "total_count": 712}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 795, "key": "nginx"}, {"count": 586, "key": "openssh"}, {"count": 251, "key": "express"}, {"count": 216, "key": "dovecot"}, {"count": 149, "key": "fastpanel"}, {"count": 147, "key": "exim"}, {"count": 81, "key": "http_server"}, {"count": 56, "key": "proftpd"}, {"count": 37, "key": "http_api"}, {"count": 37, "key": "next.js"}], "is_more_than_total_hits": false, "other_count": 394, "query_duration_millis": 40, "total_count": 712}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 712, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 161, "total_count": 712}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 97, "key": "etc"}, {"count": 60, "key": "YR2"}, {"count": 53, "key": "vm4660.defhost.co"}, {"count": 51, "key": "YR1"}, {"count": 39, "key": "parking"}, {"count": 37, "key": "FASTPANEL"}, {"count": 34, "key": "YE2"}, {"count": 31, "key": "misp.goodip"}, {"count": 27, "key": "YE1"}, {"count": 15, "key": "tech0.test"}], "is_more_than_total_hits": false, "other_count": 545, "query_duration_millis": 153, "total_count": 712}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 516, "key": "linux"}, {"count": 33, "key": "windows"}, {"count": 6, "key": "linux_kernel"}, {"count": 4, "key": "ubuntu"}, {"count": 1, "key": "centos"}, {"count": 1, "key": "debian_linux"}, {"count": 1, "key": "windows_server"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 162, "total_count": 712}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS214940.ndjson b/kevlar/2026-08-31/censys/aggregations-AS214940.ndjson new file mode 100644 index 0000000..467361a --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS214940.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 118, "total_count": 0}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 39, "total_count": 0}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 1001, "total_count": 0}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 126, "total_count": 0}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 568, "total_count": 0}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS216139.ndjson b/kevlar/2026-08-31/censys/aggregations-AS216139.ndjson new file mode 100644 index 0000000..1a2a897 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS216139.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 5492, "key": "22"}, {"count": 3315, "key": "443"}, {"count": 2125, "key": "80"}, {"count": 946, "key": "51821"}, {"count": 782, "key": "53"}, {"count": 621, "key": "21"}, {"count": 554, "key": "2096"}, {"count": 464, "key": "25"}, {"count": 425, "key": "110"}, {"count": 410, "key": "143"}], "is_more_than_total_hits": false, "other_count": 8904, "query_duration_millis": 46, "total_count": 9100}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 4460, "key": "openssh"}, {"count": 2997, "key": "nginx"}, {"count": 1354, "key": "dovecot"}, {"count": 1069, "key": "ddos-guard"}, {"count": 933, "key": "wg-easy"}, {"count": 836, "key": "exim"}, {"count": 783, "key": "express"}, {"count": 625, "key": "google_web_services"}, {"count": 623, "key": "web_server"}, {"count": 399, "key": "bind"}], "is_more_than_total_hits": false, "other_count": 5971, "query_duration_millis": 277, "total_count": 9100}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 9100, "key": "BULLETPROOF"}, {"count": 4, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 52, "total_count": 9100}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 701, "key": "invalid2.invalid"}, {"count": 634, "key": "YE1"}, {"count": 604, "key": "YE2"}, {"count": 404, "key": "GlobalSign GCC R6 AlphaSSL CA 2025"}, {"count": 231, "key": "YR2"}, {"count": 220, "key": "YR1"}, {"count": 203, "key": "WE1"}, {"count": 189, "key": "idrac"}, {"count": 179, "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate"}, {"count": 177, "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"}], "is_more_than_total_hits": false, "other_count": 3551, "query_duration_millis": 173, "total_count": 9100}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 3886, "key": "linux"}, {"count": 184, "key": "ubuntu"}, {"count": 55, "key": "enterprise_linux"}, {"count": 53, "key": "routeros"}, {"count": 32, "key": "debian_linux"}, {"count": 26, "key": "centos"}, {"count": 16, "key": "adaptive_security_appliance_software"}, {"count": 4, "key": "freebsd"}, {"count": 3, "key": "linux_kernel"}, {"count": 1, "key": "linux_ami"}], "is_more_than_total_hits": false, "other_count": 1, "query_duration_millis": 1440, "total_count": 9100}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS216246.ndjson b/kevlar/2026-08-31/censys/aggregations-AS216246.ndjson new file mode 100644 index 0000000..879c1e3 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS216246.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 5672, "key": "22"}, {"count": 4259, "key": "443"}, {"count": 3282, "key": "80"}, {"count": 704, "key": "2096"}, {"count": 693, "key": "8443"}, {"count": 390, "key": "8080"}, {"count": 368, "key": "2222"}, {"count": 310, "key": "3389"}, {"count": 193, "key": "3000"}, {"count": 179, "key": "3478"}], "is_more_than_total_hits": false, "other_count": 5444, "query_duration_millis": 519, "total_count": 7024}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 5230, "key": "openssh"}, {"count": 5040, "key": "nginx"}, {"count": 642, "key": "caddy"}, {"count": 501, "key": "express"}, {"count": 284, "key": "dovecot"}, {"count": 261, "key": "ghost"}, {"count": 260, "key": "app_and_api_protector"}, {"count": 238, "key": "traefik_proxy"}, {"count": 232, "key": "next.js"}, {"count": 221, "key": "next\\.js"}], "is_more_than_total_hits": false, "other_count": 3954, "query_duration_millis": 92, "total_count": 7024}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 7024, "key": "BULLETPROOF"}, {"count": 136, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 112, "total_count": 7024}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 1388, "key": "YE1"}, {"count": 1307, "key": "YE2"}, {"count": 349, "key": "YR2"}, {"count": 275, "key": "YR1"}, {"count": 273, "key": "GlobalSign ECC OV SSL CA 2018"}, {"count": 239, "key": "TRAEFIK DEFAULT CERT"}, {"count": 202, "key": "invalid2.invalid"}, {"count": 155, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 119, "key": "WE1"}, {"count": 113, "key": "WR1"}], "is_more_than_total_hits": false, "other_count": 2483, "query_duration_millis": 186, "total_count": 7024}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 5090, "key": "linux"}, {"count": 220, "key": "ubuntu"}, {"count": 135, "key": "windows"}, {"count": 30, "key": "debian_linux"}, {"count": 10, "key": "routeros"}, {"count": 7, "key": "linux_kernel"}, {"count": 3, "key": "proxmox"}, {"count": 2, "key": "adaptive_security_appliance_software"}, {"count": 2, "key": "windows_server"}, {"count": 1, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 2, "query_duration_millis": 152, "total_count": 7024}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS216309.ndjson b/kevlar/2026-08-31/censys/aggregations-AS216309.ndjson new file mode 100644 index 0000000..609218c --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS216309.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 35, "key": "22"}, {"count": 13, "key": "80"}, {"count": 8, "key": "443"}, {"count": 4, "key": "111"}, {"count": 2, "key": "25"}, {"count": 2, "key": "53"}, {"count": 2, "key": "110"}, {"count": 2, "key": "143"}, {"count": 2, "key": "161"}, {"count": 2, "key": "993"}], "is_more_than_total_hits": false, "other_count": 36, "query_duration_millis": 24, "total_count": 37}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 25, "key": "openssh"}, {"count": 16, "key": "nginx"}, {"count": 10, "key": "http_server"}, {"count": 9, "key": "express"}, {"count": 6, "key": "bootstrap"}, {"count": 6, "key": "dovecot"}, {"count": 6, "key": "php"}, {"count": 5, "key": "prototype"}, {"count": 4, "key": "jquery"}, {"count": 4, "key": "openssl"}], "is_more_than_total_hits": false, "other_count": 34, "query_duration_millis": 198, "total_count": 37}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 37, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 197, "total_count": 37}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 9, "key": "YR2"}, {"count": 4, "key": "Plesk"}, {"count": 3, "key": "YE2"}, {"count": 3, "key": "YR1"}, {"count": 2, "key": "pbx.invisiontech.eu"}, {"count": 1, "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate"}, {"count": 1, "key": "OpenWrt"}, {"count": 1, "key": "YE1"}, {"count": 1, "key": "www.jxb5pzqmff4pcbab.com"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 134, "total_count": 37}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 12, "key": "linux"}, {"count": 2, "key": "debian_linux"}, {"count": 1, "key": "centos"}, {"count": 1, "key": "proxmox"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 49, "total_count": 37}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS30823.ndjson b/kevlar/2026-08-31/censys/aggregations-AS30823.ndjson new file mode 100644 index 0000000..55ac943 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS30823.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 1203, "key": "22"}, {"count": 808, "key": "443"}, {"count": 614, "key": "80"}, {"count": 457, "key": "53"}, {"count": 388, "key": "27015"}, {"count": 296, "key": "3389"}, {"count": 109, "key": "25"}, {"count": 109, "key": "8443"}, {"count": 95, "key": "2096"}, {"count": 84, "key": "8080"}], "is_more_than_total_hits": false, "other_count": 2409, "query_duration_millis": 98, "total_count": 2036}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1113, "key": "openssh"}, {"count": 776, "key": "nginx"}, {"count": 198, "key": "express"}, {"count": 137, "key": "http_server"}, {"count": 102, "key": "google_web_services"}, {"count": 102, "key": "web_server"}, {"count": 92, "key": "dovecot"}, {"count": 92, "key": "http_api"}, {"count": 69, "key": "caddy"}, {"count": 66, "key": "cloudflare_load_balancer"}], "is_more_than_total_hits": false, "other_count": 1549, "query_duration_millis": 144, "total_count": 2036}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 2036, "key": "BULLETPROOF"}, {"count": 28, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 421, "total_count": 2036}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 201, "key": "YE2"}, {"count": 198, "key": "YE1"}, {"count": 108, "key": "invalid2.invalid"}, {"count": 97, "key": "YR2"}, {"count": 92, "key": "YR1"}, {"count": 62, "key": "windows-DE-Fran"}, {"count": 58, "key": "172.86.93"}, {"count": 56, "key": "windows-Frankfu"}, {"count": 51, "key": "GoGetSSL RSA DV CA"}, {"count": 36, "key": "WE1"}], "is_more_than_total_hits": false, "other_count": 986, "query_duration_millis": 184, "total_count": 2036}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 1025, "key": "linux"}, {"count": 162, "key": "windows"}, {"count": 21, "key": "proxmox"}, {"count": 17, "key": "routeros"}, {"count": 15, "key": "debian_linux"}, {"count": 11, "key": "ubuntu"}, {"count": 9, "key": "centos"}, {"count": 6, "key": "freebsd"}, {"count": 4, "key": "adaptive_security_appliance_software"}, {"count": 3, "key": "megarac_spx"}], "is_more_than_total_hits": false, "other_count": 6, "query_duration_millis": 338, "total_count": 2036}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS33993.ndjson b/kevlar/2026-08-31/censys/aggregations-AS33993.ndjson new file mode 100644 index 0000000..f699b5b --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS33993.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 3135, "key": "22"}, {"count": 2062, "key": "443"}, {"count": 2022, "key": "80"}, {"count": 1411, "key": "53"}, {"count": 713, "key": "21"}, {"count": 601, "key": "3000"}, {"count": 555, "key": "1500"}, {"count": 548, "key": "25"}, {"count": 523, "key": "993"}, {"count": 512, "key": "143"}], "is_more_than_total_hits": false, "other_count": 9561, "query_duration_millis": 362, "total_count": 4842}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 3759, "key": "nginx"}, {"count": 3248, "key": "openssh"}, {"count": 1719, "key": "dovecot"}, {"count": 1155, "key": "exim"}, {"count": 1141, "key": "bind"}, {"count": 570, "key": "proftpd"}, {"count": 384, "key": "express"}, {"count": 290, "key": "python"}, {"count": 230, "key": "aiohttp"}, {"count": 228, "key": "bootstrap"}], "is_more_than_total_hits": false, "other_count": 3414, "query_duration_millis": 42, "total_count": 4842}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 4842, "key": "BULLETPROOF"}, {"count": 9, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 50, "total_count": 4842}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 769, "key": "YR2"}, {"count": 715, "key": "YR1"}, {"count": 516, "key": "YE2"}, {"count": 487, "key": "YE1"}, {"count": 322, "key": "ssl.by"}, {"count": 242, "key": "Sectigo Public Server Authentication CA DV E36"}, {"count": 173, "key": "issssrt.ru"}, {"count": 124, "key": "GlobalSign GCC R3 DV TLS CA 2020"}, {"count": 113, "key": "invalid2.invalid"}, {"count": 105, "key": "TRAEFIK DEFAULT CERT"}], "is_more_than_total_hits": false, "other_count": 4885, "query_duration_millis": 107, "total_count": 4842}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 2989, "key": "linux"}, {"count": 132, "key": "ubuntu"}, {"count": 57, "key": "windows"}, {"count": 38, "key": "enterprise_linux"}, {"count": 23, "key": "debian_linux"}, {"count": 21, "key": "routeros"}, {"count": 6, "key": "freebsd"}, {"count": 5, "key": "centos"}, {"count": 4, "key": "windows_server"}, {"count": 3, "key": "linux_kernel"}], "is_more_than_total_hits": false, "other_count": 5, "query_duration_millis": 335, "total_count": 4842}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS394711.ndjson b/kevlar/2026-08-31/censys/aggregations-AS394711.ndjson new file mode 100644 index 0000000..634a1e8 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS394711.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 2, "key": "80"}, {"count": 2, "key": "443"}, {"count": 1, "key": "3389"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 272, "total_count": 3}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 4, "key": "bootstrap"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 31, "total_count": 3}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 3, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 25, "total_count": 3}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 2, "key": "vergeos.local.root"}, {"count": 1, "key": "pcmrp-test"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 113, "total_count": 3}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 158, "total_count": 3}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS400992.ndjson b/kevlar/2026-08-31/censys/aggregations-AS400992.ndjson new file mode 100644 index 0000000..e355479 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS400992.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 6669, "key": "22"}, {"count": 3214, "key": "443"}, {"count": 1298, "key": "80"}, {"count": 1045, "key": "2096"}, {"count": 494, "key": "8443"}, {"count": 193, "key": "2222"}, {"count": 192, "key": "8080"}, {"count": 183, "key": "3389"}, {"count": 174, "key": "2053"}, {"count": 121, "key": "25"}], "is_more_than_total_hits": false, "other_count": 4258, "query_duration_millis": 61, "total_count": 7781}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 5750, "key": "openssh"}, {"count": 1959, "key": "nginx"}, {"count": 909, "key": "google_web_services"}, {"count": 906, "key": "web_server"}, {"count": 434, "key": "app_and_api_protector"}, {"count": 434, "key": "ghost"}, {"count": 321, "key": "waf"}, {"count": 306, "key": "cloudflare_load_balancer"}, {"count": 266, "key": "caddy"}, {"count": 237, "key": "express"}], "is_more_than_total_hits": false, "other_count": 2595, "query_duration_millis": 179, "total_count": 7781}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 7781, "key": "BULLETPROOF"}, {"count": 41, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 41, "total_count": 7781}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 998, "key": "YE2"}, {"count": 908, "key": "invalid2.invalid"}, {"count": 877, "key": "YE1"}, {"count": 253, "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"}, {"count": 244, "key": "YR2"}, {"count": 198, "key": "WE1"}, {"count": 191, "key": "YR1"}, {"count": 136, "key": "GeoTrust TLS RSA CA G1"}, {"count": 105, "key": "GlobalSign ECC OV SSL CA 2018"}, {"count": 100, "key": "Sectigo Public Server Authentication CA DV E36"}], "is_more_than_total_hits": false, "other_count": 2008, "query_duration_millis": 122, "total_count": 7781}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 5522, "key": "linux"}, {"count": 63, "key": "ubuntu"}, {"count": 44, "key": "windows"}, {"count": 26, "key": "debian_linux"}, {"count": 17, "key": "routeros"}, {"count": 9, "key": "adaptive_security_appliance_software"}, {"count": 5, "key": "linux_kernel"}, {"count": 2, "key": "centos"}, {"count": 2, "key": "freebsd"}, {"count": 1, "key": "linux_ami"}], "is_more_than_total_hits": false, "other_count": 1, "query_duration_millis": 28, "total_count": 7781}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS51396.ndjson b/kevlar/2026-08-31/censys/aggregations-AS51396.ndjson new file mode 100644 index 0000000..47caf64 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS51396.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 838, "key": "22"}, {"count": 360, "key": "80"}, {"count": 281, "key": "443"}, {"count": 129, "key": "3389"}, {"count": 100, "key": "1407"}, {"count": 99, "key": "11407"}, {"count": 94, "key": "135"}, {"count": 93, "key": "445"}, {"count": 87, "key": "5985"}, {"count": 84, "key": "139"}], "is_more_than_total_hits": false, "other_count": 3342, "query_duration_millis": 457, "total_count": 1917}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 744, "key": "openssh"}, {"count": 398, "key": "nginx"}, {"count": 191, "key": "http_server"}, {"count": 129, "key": "http_api"}, {"count": 105, "key": "express"}, {"count": 69, "key": "php"}, {"count": 53, "key": "python"}, {"count": 48, "key": "jquery"}, {"count": 48, "key": "pve"}, {"count": 48, "key": "virtual_environment"}], "is_more_than_total_hits": false, "other_count": 801, "query_duration_millis": 1064, "total_count": 1917}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 1917, "key": "BULLETPROOF"}, {"count": 15, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 159, "total_count": 1917}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 110, "key": "YE1"}, {"count": 105, "key": "YE2"}, {"count": 45, "key": "YR2"}, {"count": 42, "key": "YR1"}, {"count": 27, "key": "WIN-9QL4SDRB93L"}, {"count": 24, "key": "localhost"}, {"count": 20, "key": "Proxmox Virtual Environment"}, {"count": 20, "key": "TRAEFIK DEFAULT CERT"}, {"count": 20, "key": "WIN-IK7N6SD2UBU"}, {"count": 17, "key": "invalid2.invalid"}], "is_more_than_total_hits": false, "other_count": 440, "query_duration_millis": 126, "total_count": 1917}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 668, "key": "linux"}, {"count": 85, "key": "windows"}, {"count": 39, "key": "debian_linux"}, {"count": 22, "key": "proxmox"}, {"count": 13, "key": "ubuntu"}, {"count": 3, "key": "centos"}, {"count": 3, "key": "routeros"}, {"count": 1, "key": "linux_kernel"}, {"count": 1, "key": "windows_server"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 72, "total_count": 1917}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS51852.ndjson b/kevlar/2026-08-31/censys/aggregations-AS51852.ndjson new file mode 100644 index 0000000..1f2f611 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS51852.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 4338, "key": "443"}, {"count": 4060, "key": "22"}, {"count": 3590, "key": "161"}, {"count": 2799, "key": "80"}, {"count": 1886, "key": "123"}, {"count": 1547, "key": "53"}, {"count": 829, "key": "25"}, {"count": 829, "key": "500"}, {"count": 798, "key": "21"}, {"count": 796, "key": "143"}], "is_more_than_total_hits": false, "other_count": 15977, "query_duration_millis": 966, "total_count": 8641}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 4731, "key": "nginx"}, {"count": 4036, "key": "openssh"}, {"count": 2536, "key": "dovecot"}, {"count": 1391, "key": "exim"}, {"count": 819, "key": "openvpn_access_server"}, {"count": 816, "key": "cpanel"}, {"count": 753, "key": "bind"}, {"count": 740, "key": "http_server"}, {"count": 598, "key": "ceph"}, {"count": 512, "key": "webmail"}], "is_more_than_total_hits": false, "other_count": 8305, "query_duration_millis": 143, "total_count": 8641}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 8641, "key": "BULLETPROOF"}, {"count": 39, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 131, "total_count": 8641}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 1906, "key": "server"}, {"count": 1451, "key": "YR2"}, {"count": 962, "key": "YR1"}, {"count": 903, "key": "Hydra Authentication RSA SubCA #155"}, {"count": 804, "key": "server.domain.com"}, {"count": 534, "key": "YE2"}, {"count": 405, "key": "YE1"}, {"count": 348, "key": "server.ibras.eu"}, {"count": 295, "key": "''"}, {"count": 263, "key": "invalid2.invalid"}], "is_more_than_total_hits": false, "other_count": 4001, "query_duration_millis": 132, "total_count": 8641}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 3029, "key": "linux"}, {"count": 208, "key": "windows"}, {"count": 157, "key": "proxmox"}, {"count": 129, "key": "enterprise_linux"}, {"count": 47, "key": "ubuntu"}, {"count": 36, "key": "debian_linux"}, {"count": 32, "key": "freebsd"}, {"count": 26, "key": "centos"}, {"count": 22, "key": "routeros"}, {"count": 17, "key": "vmware_esxi_server"}], "is_more_than_total_hits": false, "other_count": 21, "query_duration_millis": 177, "total_count": 8641}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS57043.ndjson b/kevlar/2026-08-31/censys/aggregations-AS57043.ndjson new file mode 100644 index 0000000..887eabe --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS57043.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 77135, "key": "22"}, {"count": 49750, "key": "443"}, {"count": 32331, "key": "80"}, {"count": 14629, "key": "2096"}, {"count": 8459, "key": "8443"}, {"count": 4010, "key": "111"}, {"count": 2912, "key": "8080"}, {"count": 2598, "key": "2222"}, {"count": 2515, "key": "2053"}, {"count": 2258, "key": "53"}], "is_more_than_total_hits": false, "other_count": 125759, "query_duration_millis": 220, "total_count": 101011}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 76785, "key": "openssh"}, {"count": 59721, "key": "nginx"}, {"count": 8938, "key": "google_web_services"}, {"count": 8936, "key": "web_server"}, {"count": 6500, "key": "ghost"}, {"count": 6499, "key": "app_and_api_protector"}, {"count": 5458, "key": "express"}, {"count": 3900, "key": "caddy"}, {"count": 3435, "key": "waf"}, {"count": 3313, "key": "cloudflare_load_balancer"}], "is_more_than_total_hits": false, "other_count": 57657, "query_duration_millis": 372, "total_count": 101011}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 101011, "key": "BULLETPROOF"}, {"count": 8, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 171, "total_count": 101011}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 13508, "key": "YE2"}, {"count": 13247, "key": "YE1"}, {"count": 9044, "key": "invalid2.invalid"}, {"count": 4967, "key": "YR1"}, {"count": 4513, "key": "YR2"}, {"count": 2378, "key": "GeoTrust TLS RSA CA G1"}, {"count": 2369, "key": "WE1"}, {"count": 2034, "key": "TRAEFIK DEFAULT CERT"}, {"count": 1748, "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"}, {"count": 1538, "key": "Microsoft TLS G2 RSA CA OCSP 04"}], "is_more_than_total_hits": false, "other_count": 35502, "query_duration_millis": 171, "total_count": 101011}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 72754, "key": "linux"}, {"count": 800, "key": "ubuntu"}, {"count": 573, "key": "windows"}, {"count": 305, "key": "routeros"}, {"count": 273, "key": "debian_linux"}, {"count": 180, "key": "proxmox"}, {"count": 139, "key": "linux_kernel"}, {"count": 108, "key": "adaptive_security_appliance_software"}, {"count": 55, "key": "freebsd"}, {"count": 44, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 132, "query_duration_millis": 61, "total_count": 101011}}} diff --git a/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson b/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson new file mode 100644 index 0000000..3aaabd1 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 180, "key": "8887"}, {"count": 177, "key": "80"}, {"count": 163, "key": "443"}, {"count": 116, "key": "0"}, {"count": 82, "key": "8081"}, {"count": 79, "key": "8888"}, {"count": 78, "key": "111"}, {"count": 74, "key": "16257"}, {"count": 74, "key": "16259"}, {"count": 72, "key": "16258"}], "is_more_than_total_hits": false, "other_count": 4440, "query_duration_millis": 120, "total_count": 624}}} +{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1169, "key": "mysql"}, {"count": 349, "key": "nginx"}, {"count": 228, "key": "python"}, {"count": 183, "key": "wsgiserver"}, {"count": 163, "key": "jquery"}, {"count": 152, "key": "bootstrap"}, {"count": 103, "key": "node_exporter"}, {"count": 79, "key": "openssh"}, {"count": 78, "key": "kestrel_web_server"}, {"count": 72, "key": "cadvisor"}], "is_more_than_total_hits": false, "other_count": 279, "query_duration_millis": 536, "total_count": 624}}} +{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 624, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 102, "total_count": 624}}} +{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 47, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 13, "key": "TrustAsia DV TLS RSA CA 2025"}, {"count": 10, "key": "FtpServer"}, {"count": 9, "key": "YR1"}, {"count": 8, "key": "RapidSSL TLS RSA CA G1"}, {"count": 6, "key": "TrustAsia DV TLS RSA CA 2024"}, {"count": 5, "key": "IPMI"}, {"count": 5, "key": "WIN-RIK6D08VRRQ"}, {"count": 4, "key": "Firecloud Root Client Certification Authority"}, {"count": 4, "key": "Sectigo Public Server Authentication CA DV R36"}], "is_more_than_total_hits": false, "other_count": 78, "query_duration_millis": 101, "total_count": 624}}} +{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 33, "key": "linux"}, {"count": 26, "key": "windows"}, {"count": 13, "key": "ubuntu"}, {"count": 2, "key": "routeros"}, {"count": 1, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 411, "total_count": 624}}} diff --git a/kevlar/2026-08-31/censys/aggregations-all.json b/kevlar/2026-08-31/censys/aggregations-all.json new file mode 100644 index 0000000..2280a60 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-all.json @@ -0,0 +1,4907 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 77135, + "key": "22" + }, + { + "count": 49750, + "key": "443" + }, + { + "count": 32331, + "key": "80" + }, + { + "count": 14629, + "key": "2096" + }, + { + "count": 8459, + "key": "8443" + }, + { + "count": 4010, + "key": "111" + }, + { + "count": 2912, + "key": "8080" + }, + { + "count": 2598, + "key": "2222" + }, + { + "count": 2515, + "key": "2053" + }, + { + "count": 2258, + "key": "53" + } + ], + "is_more_than_total_hits": false, + "other_count": 125759, + "query_duration_millis": 220, + "total_count": 101011 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 76785, + "key": "openssh" + }, + { + "count": 59721, + "key": "nginx" + }, + { + "count": 8938, + "key": "google_web_services" + }, + { + "count": 8936, + "key": "web_server" + }, + { + "count": 6500, + "key": "ghost" + }, + { + "count": 6499, + "key": "app_and_api_protector" + }, + { + "count": 5458, + "key": "express" + }, + { + "count": 3900, + "key": "caddy" + }, + { + "count": 3435, + "key": "waf" + }, + { + "count": 3313, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 57657, + "query_duration_millis": 372, + "total_count": 101011 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 101011, + "key": "BULLETPROOF" + }, + { + "count": 8, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 171, + "total_count": 101011 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 13508, + "key": "YE2" + }, + { + "count": 13247, + "key": "YE1" + }, + { + "count": 9044, + "key": "invalid2.invalid" + }, + { + "count": 4967, + "key": "YR1" + }, + { + "count": 4513, + "key": "YR2" + }, + { + "count": 2378, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2369, + "key": "WE1" + }, + { + "count": 2034, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 1748, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 1538, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + } + ], + "is_more_than_total_hits": false, + "other_count": 35502, + "query_duration_millis": 171, + "total_count": 101011 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 72754, + "key": "linux" + }, + { + "count": 800, + "key": "ubuntu" + }, + { + "count": 573, + "key": "windows" + }, + { + "count": 305, + "key": "routeros" + }, + { + "count": 273, + "key": "debian_linux" + }, + { + "count": 180, + "key": "proxmox" + }, + { + "count": 139, + "key": "linux_kernel" + }, + { + "count": 108, + "key": "adaptive_security_appliance_software" + }, + { + "count": 55, + "key": "freebsd" + }, + { + "count": 44, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 132, + "query_duration_millis": 61, + "total_count": 101011 + } + } + } + }, + "AS209847": { + "name": "THE", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 980, + "key": "22" + }, + { + "count": 564, + "key": "8080" + }, + { + "count": 517, + "key": "1030" + }, + { + "count": 517, + "key": "1050" + }, + { + "count": 514, + "key": "24442" + }, + { + "count": 499, + "key": "1235" + }, + { + "count": 494, + "key": "1234" + }, + { + "count": 440, + "key": "443" + }, + { + "count": 419, + "key": "53" + }, + { + "count": 387, + "key": "80" + } + ], + "is_more_than_total_hits": false, + "other_count": 2363, + "query_duration_millis": 111, + "total_count": 1784 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1567, + "key": "python" + }, + { + "count": 1554, + "key": "aiohttp" + }, + { + "count": 1231, + "key": "openssh" + }, + { + "count": 723, + "key": "nginx" + }, + { + "count": 367, + "key": "bind" + }, + { + "count": 312, + "key": "dovecot" + }, + { + "count": 217, + "key": "exim" + }, + { + "count": 201, + "key": "proftpd" + }, + { + "count": 130, + "key": "google_web_services" + }, + { + "count": 130, + "key": "web_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 737, + "query_duration_millis": 109, + "total_count": 1784 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 1784, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 190, + "total_count": 1784 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 221, + "key": "YR1" + }, + { + "count": 203, + "key": "YR2" + }, + { + "count": 132, + "key": "invalid2.invalid" + }, + { + "count": 121, + "key": "YE2" + }, + { + "count": 107, + "key": "YE1" + }, + { + "count": 30, + "key": "server" + }, + { + "count": 22, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 21, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 19, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 17, + "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3" + } + ], + "is_more_than_total_hits": false, + "other_count": 1073, + "query_duration_millis": 118, + "total_count": 1784 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1210, + "key": "linux" + }, + { + "count": 42, + "key": "ubuntu" + }, + { + "count": 14, + "key": "windows" + }, + { + "count": 5, + "key": "routeros" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 125, + "total_count": 1784 + } + } + } + }, + "AS210644": { + "name": "AEZA-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 62401, + "key": "22" + }, + { + "count": 35627, + "key": "443" + }, + { + "count": 18220, + "key": "80" + }, + { + "count": 12493, + "key": "2096" + }, + { + "count": 8314, + "key": "8443" + }, + { + "count": 6208, + "key": "8080" + }, + { + "count": 3499, + "key": "2053" + }, + { + "count": 1995, + "key": "2222" + }, + { + "count": 1737, + "key": "3389" + }, + { + "count": 1158, + "key": "53" + } + ], + "is_more_than_total_hits": false, + "other_count": 59626, + "query_duration_millis": 77, + "total_count": 72191 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 61805, + "key": "openssh" + }, + { + "count": 30153, + "key": "nginx" + }, + { + "count": 7299, + "key": "google_web_services" + }, + { + "count": 7299, + "key": "web_server" + }, + { + "count": 5523, + "key": "ghost" + }, + { + "count": 5521, + "key": "app_and_api_protector" + }, + { + "count": 4247, + "key": "express" + }, + { + "count": 3438, + "key": "caddy" + }, + { + "count": 3128, + "key": "waf" + }, + { + "count": 2926, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 34593, + "query_duration_millis": 158, + "total_count": 72191 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 72191, + "key": "BULLETPROOF" + }, + { + "count": 509, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 238, + "total_count": 72191 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 13117, + "key": "YE2" + }, + { + "count": 13008, + "key": "YE1" + }, + { + "count": 7385, + "key": "invalid2.invalid" + }, + { + "count": 5097, + "key": "YR2" + }, + { + "count": 3278, + "key": "YR1" + }, + { + "count": 2117, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2056, + "key": "WE1" + }, + { + "count": 1819, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1341, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1288, + "key": "GlobalSign ECC OV SSL CA 2018" + } + ], + "is_more_than_total_hits": false, + "other_count": 25046, + "query_duration_millis": 193, + "total_count": 72191 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 60420, + "key": "linux" + }, + { + "count": 719, + "key": "ubuntu" + }, + { + "count": 573, + "key": "windows" + }, + { + "count": 209, + "key": "debian_linux" + }, + { + "count": 84, + "key": "routeros" + }, + { + "count": 83, + "key": "linux_kernel" + }, + { + "count": 34, + "key": "adaptive_security_appliance_software" + }, + { + "count": 14, + "key": "linux_ami" + }, + { + "count": 13, + "key": "centos" + }, + { + "count": 12, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 16, + "query_duration_millis": 56, + "total_count": 72191 + } + } + } + }, + "AS138915": { + "name": "KAOPU-HK (Kaopu Cloud HK Limited)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 7319, + "key": "22" + }, + { + "count": 2669, + "key": "443" + }, + { + "count": 2501, + "key": "80" + }, + { + "count": 2430, + "key": "32080" + }, + { + "count": 2379, + "key": "43080" + }, + { + "count": 2243, + "key": "40003" + }, + { + "count": 2238, + "key": "40801" + }, + { + "count": 2235, + "key": "40803" + }, + { + "count": 2234, + "key": "40804" + }, + { + "count": 2229, + "key": "40810" + } + ], + "is_more_than_total_hits": false, + "other_count": 62162, + "query_duration_millis": 306, + "total_count": 13554 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 7679, + "key": "openssh" + }, + { + "count": 6327, + "key": "openresty" + }, + { + "count": 4526, + "key": "tengine" + }, + { + "count": 3369, + "key": "nginx" + }, + { + "count": 1055, + "key": "http_api" + }, + { + "count": 553, + "key": "http_server" + }, + { + "count": 435, + "key": "express" + }, + { + "count": 430, + "key": "jquery" + }, + { + "count": 309, + "key": "bootstrap" + }, + { + "count": 309, + "key": "openvpn_access_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 4900, + "query_duration_millis": 154, + "total_count": 13554 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 13554, + "key": "BULLETPROOF" + }, + { + "count": 99, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 470, + "total_count": 13554 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 4619, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 2393, + "key": "localhost" + }, + { + "count": 2346, + "key": "prod-vpn.example.com" + }, + { + "count": 2310, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 2240, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1206, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 431, + "key": "NONE" + }, + { + "count": 431, + "key": "WoTrus RSA DV SSL CA 2" + }, + { + "count": 361, + "key": "YR1" + }, + { + "count": 345, + "key": "WIN-9QFKHJ39QE9" + } + ], + "is_more_than_total_hits": false, + "other_count": 7531, + "query_duration_millis": 511, + "total_count": 13554 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6092, + "key": "linux" + }, + { + "count": 626, + "key": "windows" + }, + { + "count": 66, + "key": "routeros" + }, + { + "count": 36, + "key": "ubuntu" + }, + { + "count": 33, + "key": "debian_linux" + }, + { + "count": 31, + "key": "centos" + }, + { + "count": 10, + "key": "adaptive_security_appliance_software" + }, + { + "count": 10, + "key": "proxmox" + }, + { + "count": 4, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "freebsd" + } + ], + "is_more_than_total_hits": false, + "other_count": 10, + "query_duration_millis": 195, + "total_count": 13554 + } + } + } + }, + "AS14956": { + "name": "ROUTERHOSTING (RouterHosting LLC)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 15480, + "key": "22" + }, + { + "count": 8450, + "key": "443" + }, + { + "count": 7520, + "key": "3389" + }, + { + "count": 7412, + "key": "80" + }, + { + "count": 1091, + "key": "2096" + }, + { + "count": 1021, + "key": "5985" + }, + { + "count": 985, + "key": "135" + }, + { + "count": 842, + "key": "445" + }, + { + "count": 797, + "key": "53" + }, + { + "count": 786, + "key": "8443" + } + ], + "is_more_than_total_hits": false, + "other_count": 20519, + "query_duration_millis": 125, + "total_count": 25654 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 14570, + "key": "openssh" + }, + { + "count": 10034, + "key": "nginx" + }, + { + "count": 2567, + "key": "express" + }, + { + "count": 1582, + "key": "http_server" + }, + { + "count": 1224, + "key": "dovecot" + }, + { + "count": 1124, + "key": "http_api" + }, + { + "count": 859, + "key": "google_web_services" + }, + { + "count": 804, + "key": "web_server" + }, + { + "count": 705, + "key": "caddy" + }, + { + "count": 666, + "key": "jquery" + } + ], + "is_more_than_total_hits": false, + "other_count": 16007, + "query_duration_millis": 91, + "total_count": 25654 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 25654, + "key": "BULLETPROOF" + }, + { + "count": 210, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 22, + "total_count": 25654 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2029, + "key": "YE2" + }, + { + "count": 1907, + "key": "YE1" + }, + { + "count": 995, + "key": "windows-Dallas0" + }, + { + "count": 977, + "key": "YR1" + }, + { + "count": 967, + "key": "YR2" + }, + { + "count": 870, + "key": "invalid2.invalid" + }, + { + "count": 429, + "key": "windows-Utah-4g" + }, + { + "count": 378, + "key": "www.example.com" + }, + { + "count": 373, + "key": "windows-Amsterd" + }, + { + "count": 343, + "key": "TRAEFIK DEFAULT CERT" + } + ], + "is_more_than_total_hits": false, + "other_count": 13042, + "query_duration_millis": 160, + "total_count": 25654 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 13776, + "key": "linux" + }, + { + "count": 5506, + "key": "windows" + }, + { + "count": 218, + "key": "ubuntu" + }, + { + "count": 135, + "key": "debian_linux" + }, + { + "count": 101, + "key": "routeros" + }, + { + "count": 30, + "key": "freebsd" + }, + { + "count": 21, + "key": "linux_kernel" + }, + { + "count": 21, + "key": "windows_server" + }, + { + "count": 9, + "key": "proxmox" + }, + { + "count": 8, + "key": "adaptive_security_appliance_software" + } + ], + "is_more_than_total_hits": false, + "other_count": 20, + "query_duration_millis": 126, + "total_count": 25654 + } + } + } + }, + "AS216139": { + "name": "IRONHOST", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 5492, + "key": "22" + }, + { + "count": 3315, + "key": "443" + }, + { + "count": 2125, + "key": "80" + }, + { + "count": 946, + "key": "51821" + }, + { + "count": 782, + "key": "53" + }, + { + "count": 621, + "key": "21" + }, + { + "count": 554, + "key": "2096" + }, + { + "count": 464, + "key": "25" + }, + { + "count": 425, + "key": "110" + }, + { + "count": 410, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 8904, + "query_duration_millis": 46, + "total_count": 9100 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4460, + "key": "openssh" + }, + { + "count": 2997, + "key": "nginx" + }, + { + "count": 1354, + "key": "dovecot" + }, + { + "count": 1069, + "key": "ddos-guard" + }, + { + "count": 933, + "key": "wg-easy" + }, + { + "count": 836, + "key": "exim" + }, + { + "count": 783, + "key": "express" + }, + { + "count": 625, + "key": "google_web_services" + }, + { + "count": 623, + "key": "web_server" + }, + { + "count": 399, + "key": "bind" + } + ], + "is_more_than_total_hits": false, + "other_count": 5971, + "query_duration_millis": 277, + "total_count": 9100 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 9100, + "key": "BULLETPROOF" + }, + { + "count": 4, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 52, + "total_count": 9100 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 701, + "key": "invalid2.invalid" + }, + { + "count": 634, + "key": "YE1" + }, + { + "count": 604, + "key": "YE2" + }, + { + "count": 404, + "key": "GlobalSign GCC R6 AlphaSSL CA 2025" + }, + { + "count": 231, + "key": "YR2" + }, + { + "count": 220, + "key": "YR1" + }, + { + "count": 203, + "key": "WE1" + }, + { + "count": 189, + "key": "idrac" + }, + { + "count": 179, + "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate" + }, + { + "count": 177, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + } + ], + "is_more_than_total_hits": false, + "other_count": 3551, + "query_duration_millis": 173, + "total_count": 9100 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 3886, + "key": "linux" + }, + { + "count": 184, + "key": "ubuntu" + }, + { + "count": 55, + "key": "enterprise_linux" + }, + { + "count": 53, + "key": "routeros" + }, + { + "count": 32, + "key": "debian_linux" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 16, + "key": "adaptive_security_appliance_software" + }, + { + "count": 4, + "key": "freebsd" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "linux_ami" + } + ], + "is_more_than_total_hits": false, + "other_count": 1, + "query_duration_millis": 1440, + "total_count": 9100 + } + } + } + }, + "AS51852": { + "name": "PLI-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 4338, + "key": "443" + }, + { + "count": 4060, + "key": "22" + }, + { + "count": 3590, + "key": "161" + }, + { + "count": 2799, + "key": "80" + }, + { + "count": 1886, + "key": "123" + }, + { + "count": 1547, + "key": "53" + }, + { + "count": 829, + "key": "25" + }, + { + "count": 829, + "key": "500" + }, + { + "count": 798, + "key": "21" + }, + { + "count": 796, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 15977, + "query_duration_millis": 966, + "total_count": 8641 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4731, + "key": "nginx" + }, + { + "count": 4036, + "key": "openssh" + }, + { + "count": 2536, + "key": "dovecot" + }, + { + "count": 1391, + "key": "exim" + }, + { + "count": 819, + "key": "openvpn_access_server" + }, + { + "count": 816, + "key": "cpanel" + }, + { + "count": 753, + "key": "bind" + }, + { + "count": 740, + "key": "http_server" + }, + { + "count": 598, + "key": "ceph" + }, + { + "count": 512, + "key": "webmail" + } + ], + "is_more_than_total_hits": false, + "other_count": 8305, + "query_duration_millis": 143, + "total_count": 8641 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 8641, + "key": "BULLETPROOF" + }, + { + "count": 39, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 131, + "total_count": 8641 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1906, + "key": "server" + }, + { + "count": 1451, + "key": "YR2" + }, + { + "count": 962, + "key": "YR1" + }, + { + "count": 903, + "key": "Hydra Authentication RSA SubCA #155" + }, + { + "count": 804, + "key": "server.domain.com" + }, + { + "count": 534, + "key": "YE2" + }, + { + "count": 405, + "key": "YE1" + }, + { + "count": 348, + "key": "server.ibras.eu" + }, + { + "count": 295, + "key": "''" + }, + { + "count": 263, + "key": "invalid2.invalid" + } + ], + "is_more_than_total_hits": false, + "other_count": 4001, + "query_duration_millis": 132, + "total_count": 8641 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 3029, + "key": "linux" + }, + { + "count": 208, + "key": "windows" + }, + { + "count": 157, + "key": "proxmox" + }, + { + "count": 129, + "key": "enterprise_linux" + }, + { + "count": 47, + "key": "ubuntu" + }, + { + "count": 36, + "key": "debian_linux" + }, + { + "count": 32, + "key": "freebsd" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 22, + "key": "routeros" + }, + { + "count": 17, + "key": "vmware_esxi_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 21, + "query_duration_millis": 177, + "total_count": 8641 + } + } + } + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 6669, + "key": "22" + }, + { + "count": 3214, + "key": "443" + }, + { + "count": 1298, + "key": "80" + }, + { + "count": 1045, + "key": "2096" + }, + { + "count": 494, + "key": "8443" + }, + { + "count": 193, + "key": "2222" + }, + { + "count": 192, + "key": "8080" + }, + { + "count": 183, + "key": "3389" + }, + { + "count": 174, + "key": "2053" + }, + { + "count": 121, + "key": "25" + } + ], + "is_more_than_total_hits": false, + "other_count": 4258, + "query_duration_millis": 61, + "total_count": 7781 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5750, + "key": "openssh" + }, + { + "count": 1959, + "key": "nginx" + }, + { + "count": 909, + "key": "google_web_services" + }, + { + "count": 906, + "key": "web_server" + }, + { + "count": 434, + "key": "app_and_api_protector" + }, + { + "count": 434, + "key": "ghost" + }, + { + "count": 321, + "key": "waf" + }, + { + "count": 306, + "key": "cloudflare_load_balancer" + }, + { + "count": 266, + "key": "caddy" + }, + { + "count": 237, + "key": "express" + } + ], + "is_more_than_total_hits": false, + "other_count": 2595, + "query_duration_millis": 179, + "total_count": 7781 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7781, + "key": "BULLETPROOF" + }, + { + "count": 41, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 41, + "total_count": 7781 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 998, + "key": "YE2" + }, + { + "count": 908, + "key": "invalid2.invalid" + }, + { + "count": 877, + "key": "YE1" + }, + { + "count": 253, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 244, + "key": "YR2" + }, + { + "count": 198, + "key": "WE1" + }, + { + "count": 191, + "key": "YR1" + }, + { + "count": 136, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 105, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 100, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ], + "is_more_than_total_hits": false, + "other_count": 2008, + "query_duration_millis": 122, + "total_count": 7781 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 5522, + "key": "linux" + }, + { + "count": 63, + "key": "ubuntu" + }, + { + "count": 44, + "key": "windows" + }, + { + "count": 26, + "key": "debian_linux" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 9, + "key": "adaptive_security_appliance_software" + }, + { + "count": 5, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "centos" + }, + { + "count": 2, + "key": "freebsd" + }, + { + "count": 1, + "key": "linux_ami" + } + ], + "is_more_than_total_hits": false, + "other_count": 1, + "query_duration_millis": 28, + "total_count": 7781 + } + } + } + }, + "AS33993": { + "name": "UFO-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 3135, + "key": "22" + }, + { + "count": 2062, + "key": "443" + }, + { + "count": 2022, + "key": "80" + }, + { + "count": 1411, + "key": "53" + }, + { + "count": 713, + "key": "21" + }, + { + "count": 601, + "key": "3000" + }, + { + "count": 555, + "key": "1500" + }, + { + "count": 548, + "key": "25" + }, + { + "count": 523, + "key": "993" + }, + { + "count": 512, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 9561, + "query_duration_millis": 362, + "total_count": 4842 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 3759, + "key": "nginx" + }, + { + "count": 3248, + "key": "openssh" + }, + { + "count": 1719, + "key": "dovecot" + }, + { + "count": 1155, + "key": "exim" + }, + { + "count": 1141, + "key": "bind" + }, + { + "count": 570, + "key": "proftpd" + }, + { + "count": 384, + "key": "express" + }, + { + "count": 290, + "key": "python" + }, + { + "count": 230, + "key": "aiohttp" + }, + { + "count": 228, + "key": "bootstrap" + } + ], + "is_more_than_total_hits": false, + "other_count": 3414, + "query_duration_millis": 42, + "total_count": 4842 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 4842, + "key": "BULLETPROOF" + }, + { + "count": 9, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 50, + "total_count": 4842 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 769, + "key": "YR2" + }, + { + "count": 715, + "key": "YR1" + }, + { + "count": 516, + "key": "YE2" + }, + { + "count": 487, + "key": "YE1" + }, + { + "count": 322, + "key": "ssl.by" + }, + { + "count": 242, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 173, + "key": "issssrt.ru" + }, + { + "count": 124, + "key": "GlobalSign GCC R3 DV TLS CA 2020" + }, + { + "count": 113, + "key": "invalid2.invalid" + }, + { + "count": 105, + "key": "TRAEFIK DEFAULT CERT" + } + ], + "is_more_than_total_hits": false, + "other_count": 4885, + "query_duration_millis": 107, + "total_count": 4842 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 2989, + "key": "linux" + }, + { + "count": 132, + "key": "ubuntu" + }, + { + "count": 57, + "key": "windows" + }, + { + "count": 38, + "key": "enterprise_linux" + }, + { + "count": 23, + "key": "debian_linux" + }, + { + "count": 21, + "key": "routeros" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 4, + "key": "windows_server" + }, + { + "count": 3, + "key": "linux_kernel" + } + ], + "is_more_than_total_hits": false, + "other_count": 5, + "query_duration_millis": 335, + "total_count": 4842 + } + } + } + }, + "AS51396": { + "name": "PFCLOUD (Pfcloud UG)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 838, + "key": "22" + }, + { + "count": 360, + "key": "80" + }, + { + "count": 281, + "key": "443" + }, + { + "count": 129, + "key": "3389" + }, + { + "count": 100, + "key": "1407" + }, + { + "count": 99, + "key": "11407" + }, + { + "count": 94, + "key": "135" + }, + { + "count": 93, + "key": "445" + }, + { + "count": 87, + "key": "5985" + }, + { + "count": 84, + "key": "139" + } + ], + "is_more_than_total_hits": false, + "other_count": 3342, + "query_duration_millis": 457, + "total_count": 1917 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 744, + "key": "openssh" + }, + { + "count": 398, + "key": "nginx" + }, + { + "count": 191, + "key": "http_server" + }, + { + "count": 129, + "key": "http_api" + }, + { + "count": 105, + "key": "express" + }, + { + "count": 69, + "key": "php" + }, + { + "count": 53, + "key": "python" + }, + { + "count": 48, + "key": "jquery" + }, + { + "count": 48, + "key": "pve" + }, + { + "count": 48, + "key": "virtual_environment" + } + ], + "is_more_than_total_hits": false, + "other_count": 801, + "query_duration_millis": 1064, + "total_count": 1917 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 1917, + "key": "BULLETPROOF" + }, + { + "count": 15, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 159, + "total_count": 1917 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 110, + "key": "YE1" + }, + { + "count": 105, + "key": "YE2" + }, + { + "count": 45, + "key": "YR2" + }, + { + "count": 42, + "key": "YR1" + }, + { + "count": 27, + "key": "WIN-9QL4SDRB93L" + }, + { + "count": 24, + "key": "localhost" + }, + { + "count": 20, + "key": "Proxmox Virtual Environment" + }, + { + "count": 20, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 20, + "key": "WIN-IK7N6SD2UBU" + }, + { + "count": 17, + "key": "invalid2.invalid" + } + ], + "is_more_than_total_hits": false, + "other_count": 440, + "query_duration_millis": 126, + "total_count": 1917 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 668, + "key": "linux" + }, + { + "count": 85, + "key": "windows" + }, + { + "count": 39, + "key": "debian_linux" + }, + { + "count": 22, + "key": "proxmox" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "centos" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 72, + "total_count": 1917 + } + } + } + }, + "AS213702": { + "name": "QWINS-LTD", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 6376, + "key": "22" + }, + { + "count": 4393, + "key": "443" + }, + { + "count": 2150, + "key": "80" + }, + { + "count": 2020, + "key": "2222" + }, + { + "count": 820, + "key": "8443" + }, + { + "count": 671, + "key": "2096" + }, + { + "count": 404, + "key": "3389" + }, + { + "count": 242, + "key": "8080" + }, + { + "count": 193, + "key": "2053" + }, + { + "count": 160, + "key": "9443" + } + ], + "is_more_than_total_hits": false, + "other_count": 4685, + "query_duration_millis": 3206, + "total_count": 7381 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 6147, + "key": "openssh" + }, + { + "count": 3386, + "key": "nginx" + }, + { + "count": 621, + "key": "caddy" + }, + { + "count": 522, + "key": "google_web_services" + }, + { + "count": 521, + "key": "web_server" + }, + { + "count": 472, + "key": "app_and_api_protector" + }, + { + "count": 472, + "key": "ghost" + }, + { + "count": 333, + "key": "express" + }, + { + "count": 266, + "key": "waf" + }, + { + "count": 254, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 2854, + "query_duration_millis": 37, + "total_count": 7381 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7381, + "key": "BULLETPROOF" + }, + { + "count": 16, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 27, + "total_count": 7381 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1187, + "key": "YE2" + }, + { + "count": 1098, + "key": "YE1" + }, + { + "count": 768, + "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo" + }, + { + "count": 524, + "key": "invalid2.invalid" + }, + { + "count": 331, + "key": "YR2" + }, + { + "count": 234, + "key": "YR1" + }, + { + "count": 217, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 193, + "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5" + }, + { + "count": 185, + "key": "NvJhHp68p5mjSuW_EK9Lab6bH9" + }, + { + "count": 169, + "key": "WE1" + } + ], + "is_more_than_total_hits": false, + "other_count": 3494, + "query_duration_millis": 144, + "total_count": 7381 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6029, + "key": "linux" + }, + { + "count": 98, + "key": "windows" + }, + { + "count": 63, + "key": "ubuntu" + }, + { + "count": 14, + "key": "debian_linux" + }, + { + "count": 10, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "enterprise_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 49, + "total_count": 7381 + } + } + } + }, + "AS216246": { + "name": "RU-AEZA-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 5672, + "key": "22" + }, + { + "count": 4259, + "key": "443" + }, + { + "count": 3282, + "key": "80" + }, + { + "count": 704, + "key": "2096" + }, + { + "count": 693, + "key": "8443" + }, + { + "count": 390, + "key": "8080" + }, + { + "count": 368, + "key": "2222" + }, + { + "count": 310, + "key": "3389" + }, + { + "count": 193, + "key": "3000" + }, + { + "count": 179, + "key": "3478" + } + ], + "is_more_than_total_hits": false, + "other_count": 5444, + "query_duration_millis": 519, + "total_count": 7024 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5230, + "key": "openssh" + }, + { + "count": 5040, + "key": "nginx" + }, + { + "count": 642, + "key": "caddy" + }, + { + "count": 501, + "key": "express" + }, + { + "count": 284, + "key": "dovecot" + }, + { + "count": 261, + "key": "ghost" + }, + { + "count": 260, + "key": "app_and_api_protector" + }, + { + "count": 238, + "key": "traefik_proxy" + }, + { + "count": 232, + "key": "next.js" + }, + { + "count": 221, + "key": "next\\.js" + } + ], + "is_more_than_total_hits": false, + "other_count": 3954, + "query_duration_millis": 92, + "total_count": 7024 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7024, + "key": "BULLETPROOF" + }, + { + "count": 136, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 112, + "total_count": 7024 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1388, + "key": "YE1" + }, + { + "count": 1307, + "key": "YE2" + }, + { + "count": 349, + "key": "YR2" + }, + { + "count": 275, + "key": "YR1" + }, + { + "count": 273, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 239, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 202, + "key": "invalid2.invalid" + }, + { + "count": 155, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 119, + "key": "WE1" + }, + { + "count": 113, + "key": "WR1" + } + ], + "is_more_than_total_hits": false, + "other_count": 2483, + "query_duration_millis": 186, + "total_count": 7024 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 5090, + "key": "linux" + }, + { + "count": 220, + "key": "ubuntu" + }, + { + "count": 135, + "key": "windows" + }, + { + "count": 30, + "key": "debian_linux" + }, + { + "count": 10, + "key": "routeros" + }, + { + "count": 7, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "windows_server" + }, + { + "count": 1, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 152, + "total_count": 7024 + } + } + } + }, + "AS200651": { + "name": "FLOKINET", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 2841, + "key": "22" + }, + { + "count": 2118, + "key": "443" + }, + { + "count": 1917, + "key": "80" + }, + { + "count": 380, + "key": "53" + }, + { + "count": 282, + "key": "25" + }, + { + "count": 234, + "key": "587" + }, + { + "count": 222, + "key": "993" + }, + { + "count": 189, + "key": "111" + }, + { + "count": 186, + "key": "143" + }, + { + "count": 168, + "key": "110" + } + ], + "is_more_than_total_hits": false, + "other_count": 4831, + "query_duration_millis": 180, + "total_count": 3806 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 2825, + "key": "nginx" + }, + { + "count": 2589, + "key": "openssh" + }, + { + "count": 585, + "key": "dovecot" + }, + { + "count": 465, + "key": "http_server" + }, + { + "count": 361, + "key": "cpanel" + }, + { + "count": 303, + "key": "express" + }, + { + "count": 270, + "key": "exim" + }, + { + "count": 258, + "key": "caddy" + }, + { + "count": 247, + "key": "openresty" + }, + { + "count": 196, + "key": "authoritative_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 3469, + "query_duration_millis": 79, + "total_count": 3806 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 3806, + "key": "BULLETPROOF" + }, + { + "count": 130, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 20, + "total_count": 3806 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 725, + "key": "YE1" + }, + { + "count": 637, + "key": "YR2" + }, + { + "count": 612, + "key": "YE2" + }, + { + "count": 562, + "key": "YR1" + }, + { + "count": 131, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 99, + "key": "invalid2.invalid" + }, + { + "count": 59, + "key": "localhost" + }, + { + "count": 47, + "key": "WE1" + }, + { + "count": 40, + "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3" + }, + { + "count": 40, + "key": "www.example.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 1621, + "query_duration_millis": 128, + "total_count": 3806 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 2167, + "key": "linux" + }, + { + "count": 56, + "key": "ubuntu" + }, + { + "count": 48, + "key": "debian_linux" + }, + { + "count": 30, + "key": "proxmox" + }, + { + "count": 27, + "key": "windows" + }, + { + "count": 10, + "key": "freebsd" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "openbsd" + }, + { + "count": 5, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 8, + "query_duration_millis": 162, + "total_count": 3806 + } + } + } + }, + "AS30823": { + "name": "AUROLOGIC (aurologic GmbH)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 1203, + "key": "22" + }, + { + "count": 808, + "key": "443" + }, + { + "count": 614, + "key": "80" + }, + { + "count": 457, + "key": "53" + }, + { + "count": 388, + "key": "27015" + }, + { + "count": 296, + "key": "3389" + }, + { + "count": 109, + "key": "25" + }, + { + "count": 109, + "key": "8443" + }, + { + "count": 95, + "key": "2096" + }, + { + "count": 84, + "key": "8080" + } + ], + "is_more_than_total_hits": false, + "other_count": 2409, + "query_duration_millis": 98, + "total_count": 2036 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1113, + "key": "openssh" + }, + { + "count": 776, + "key": "nginx" + }, + { + "count": 198, + "key": "express" + }, + { + "count": 137, + "key": "http_server" + }, + { + "count": 102, + "key": "google_web_services" + }, + { + "count": 102, + "key": "web_server" + }, + { + "count": 92, + "key": "dovecot" + }, + { + "count": 92, + "key": "http_api" + }, + { + "count": 69, + "key": "caddy" + }, + { + "count": 66, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 1549, + "query_duration_millis": 144, + "total_count": 2036 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 2036, + "key": "BULLETPROOF" + }, + { + "count": 28, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 421, + "total_count": 2036 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 201, + "key": "YE2" + }, + { + "count": 198, + "key": "YE1" + }, + { + "count": 108, + "key": "invalid2.invalid" + }, + { + "count": 97, + "key": "YR2" + }, + { + "count": 92, + "key": "YR1" + }, + { + "count": 62, + "key": "windows-DE-Fran" + }, + { + "count": 58, + "key": "172.86.93" + }, + { + "count": 56, + "key": "windows-Frankfu" + }, + { + "count": 51, + "key": "GoGetSSL RSA DV CA" + }, + { + "count": 36, + "key": "WE1" + } + ], + "is_more_than_total_hits": false, + "other_count": 986, + "query_duration_millis": 184, + "total_count": 2036 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1025, + "key": "linux" + }, + { + "count": 162, + "key": "windows" + }, + { + "count": 21, + "key": "proxmox" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 15, + "key": "debian_linux" + }, + { + "count": 11, + "key": "ubuntu" + }, + { + "count": 9, + "key": "centos" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 4, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "megarac_spx" + } + ], + "is_more_than_total_hits": false, + "other_count": 6, + "query_duration_millis": 338, + "total_count": 2036 + } + } + } + }, + "AS140666": { + "name": "ADPL-AS-AP (ANY DIGITAL PTE. LTD.)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 1652, + "key": "22" + }, + { + "count": 694, + "key": "443" + }, + { + "count": 535, + "key": "80" + }, + { + "count": 376, + "key": "6004" + }, + { + "count": 376, + "key": "6011" + }, + { + "count": 375, + "key": "6001" + }, + { + "count": 375, + "key": "6006" + }, + { + "count": 375, + "key": "6007" + }, + { + "count": 375, + "key": "6010" + }, + { + "count": 375, + "key": "6012" + } + ], + "is_more_than_total_hits": false, + "other_count": 12271, + "query_duration_millis": 32, + "total_count": 2805 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1615, + "key": "openssh" + }, + { + "count": 1378, + "key": "nginx" + }, + { + "count": 146, + "key": "openresty" + }, + { + "count": 131, + "key": "http_api" + }, + { + "count": 80, + "key": "jquery" + }, + { + "count": 74, + "key": "internet_information_services" + }, + { + "count": 58, + "key": "tengine" + }, + { + "count": 54, + "key": "bootstrap" + }, + { + "count": 39, + "key": "express" + }, + { + "count": 36, + "key": "node_exporter" + } + ], + "is_more_than_total_hits": false, + "other_count": 575, + "query_duration_millis": 168, + "total_count": 2805 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 2805, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 244, + "total_count": 2805 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 338, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 183, + "key": "NONE" + }, + { + "count": 135, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 109, + "key": "tudog_node_agent._reserved.bytefcdn.com" + }, + { + "count": 107, + "key": "RTCTS" + }, + { + "count": 102, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 92, + "key": "QY" + }, + { + "count": 65, + "key": "RapidSSL TLS ECC CA G1" + }, + { + "count": 60, + "key": "tls.internal.ypc.org" + }, + { + "count": 47, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + } + ], + "is_more_than_total_hits": false, + "other_count": 717, + "query_duration_millis": 67, + "total_count": 2805 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1089, + "key": "linux" + }, + { + "count": 95, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "proxmox" + }, + { + "count": 1, + "key": "windows_server_2008_r2" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 20, + "total_count": 2805 + } + } + } + }, + "AS214351": { + "name": "FEMOIT", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 547, + "key": "80" + }, + { + "count": 536, + "key": "22" + }, + { + "count": 340, + "key": "443" + }, + { + "count": 94, + "key": "21" + }, + { + "count": 93, + "key": "53" + }, + { + "count": 89, + "key": "25" + }, + { + "count": 87, + "key": "8085" + }, + { + "count": 86, + "key": "22509" + }, + { + "count": 81, + "key": "143" + }, + { + "count": 81, + "key": "993" + } + ], + "is_more_than_total_hits": false, + "other_count": 1019, + "query_duration_millis": 291, + "total_count": 712 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 795, + "key": "nginx" + }, + { + "count": 586, + "key": "openssh" + }, + { + "count": 251, + "key": "express" + }, + { + "count": 216, + "key": "dovecot" + }, + { + "count": 149, + "key": "fastpanel" + }, + { + "count": 147, + "key": "exim" + }, + { + "count": 81, + "key": "http_server" + }, + { + "count": 56, + "key": "proftpd" + }, + { + "count": 37, + "key": "http_api" + }, + { + "count": 37, + "key": "next.js" + } + ], + "is_more_than_total_hits": false, + "other_count": 394, + "query_duration_millis": 40, + "total_count": 712 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 712, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 161, + "total_count": 712 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 97, + "key": "etc" + }, + { + "count": 60, + "key": "YR2" + }, + { + "count": 53, + "key": "vm4660.defhost.co" + }, + { + "count": 51, + "key": "YR1" + }, + { + "count": 39, + "key": "parking" + }, + { + "count": 37, + "key": "FASTPANEL" + }, + { + "count": 34, + "key": "YE2" + }, + { + "count": 31, + "key": "misp.goodip" + }, + { + "count": 27, + "key": "YE1" + }, + { + "count": 15, + "key": "tech0.test" + } + ], + "is_more_than_total_hits": false, + "other_count": 545, + "query_duration_millis": 153, + "total_count": 712 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 516, + "key": "linux" + }, + { + "count": 33, + "key": "windows" + }, + { + "count": 6, + "key": "linux_kernel" + }, + { + "count": 4, + "key": "ubuntu" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + }, + { + "count": 1, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 162, + "total_count": 712 + } + } + } + }, + "AS198953": { + "name": "PROTON66", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 166, + "key": "3389" + }, + { + "count": 161, + "key": "22" + }, + { + "count": 89, + "key": "80" + }, + { + "count": 83, + "key": "443" + }, + { + "count": 52, + "key": "135" + }, + { + "count": 41, + "key": "137" + }, + { + "count": 39, + "key": "53" + }, + { + "count": 36, + "key": "139" + }, + { + "count": 35, + "key": "5985" + }, + { + "count": 25, + "key": "21" + } + ], + "is_more_than_total_hits": false, + "other_count": 374, + "query_duration_millis": 185, + "total_count": 360 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 128, + "key": "nginx" + }, + { + "count": 123, + "key": "openssh" + }, + { + "count": 63, + "key": "dovecot" + }, + { + "count": 44, + "key": "http_api" + }, + { + "count": 36, + "key": "express" + }, + { + "count": 31, + "key": "http_server" + }, + { + "count": 30, + "key": "fastpanel" + }, + { + "count": 24, + "key": "exim" + }, + { + "count": 22, + "key": "requirejs" + }, + { + "count": 19, + "key": "parallels_plesk_panel" + } + ], + "is_more_than_total_hits": false, + "other_count": 231, + "query_duration_millis": 146, + "total_count": 360 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 360, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 923, + "total_count": 360 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 23, + "key": "Plesk" + }, + { + "count": 19, + "key": "YR1" + }, + { + "count": 16, + "key": "etc" + }, + { + "count": 11, + "key": "AnyDesk Client" + }, + { + "count": 10, + "key": "localhost" + }, + { + "count": 9, + "key": "R11" + }, + { + "count": 9, + "key": "parking" + }, + { + "count": 8, + "key": "R12" + }, + { + "count": 8, + "key": "YR2" + }, + { + "count": 8, + "key": "test" + } + ], + "is_more_than_total_hits": false, + "other_count": 272, + "query_duration_millis": 147, + "total_count": 360 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 117, + "key": "linux" + }, + { + "count": 41, + "key": "windows" + }, + { + "count": 4, + "key": "ubuntu" + }, + { + "count": 3, + "key": "debian_linux" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "freenas_firmware" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "routeros" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 25, + "total_count": 360 + } + } + } + }, + "AS200593": { + "name": "PROSPERO-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 201, + "key": "22" + }, + { + "count": 133, + "key": "3389" + }, + { + "count": 113, + "key": "80" + }, + { + "count": 81, + "key": "443" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 26, + "key": "135" + }, + { + "count": 26, + "key": "5985" + }, + { + "count": 23, + "key": "21" + }, + { + "count": 21, + "key": "25" + }, + { + "count": 20, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 310, + "query_duration_millis": 245, + "total_count": 348 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 150, + "key": "nginx" + }, + { + "count": 137, + "key": "openssh" + }, + { + "count": 60, + "key": "dovecot" + }, + { + "count": 35, + "key": "parallels_plesk_panel" + }, + { + "count": 35, + "key": "prototype" + }, + { + "count": 35, + "key": "requirejs" + }, + { + "count": 33, + "key": "express" + }, + { + "count": 30, + "key": "http_server" + }, + { + "count": 29, + "key": "http_api" + }, + { + "count": 24, + "key": "plesk" + } + ], + "is_more_than_total_hits": false, + "other_count": 180, + "query_duration_millis": 32, + "total_count": 348 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 348, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 97, + "total_count": 348 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 42, + "key": "Plesk" + }, + { + "count": 29, + "key": "YR1" + }, + { + "count": 24, + "key": "YR2" + }, + { + "count": 13, + "key": "YE1" + }, + { + "count": 12, + "key": "R13" + }, + { + "count": 9, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 7, + "key": "DESKTOP-GKGI28A" + }, + { + "count": 6, + "key": "R12" + }, + { + "count": 6, + "key": "ckicksp-1.example.com" + }, + { + "count": 6, + "key": "devin-coo-1.example.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 207, + "query_duration_millis": 183, + "total_count": 348 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 138, + "key": "linux" + }, + { + "count": 26, + "key": "windows" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "ubuntu" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 262, + "total_count": 348 + } + } + } + }, + "AS214940": { + "name": "KPRONET", + "agg": { + "host.services.port": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 118, + "total_count": 0 + } + }, + "host.services.software.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 39, + "total_count": 0 + } + }, + "host.labels.value": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 1001, + "total_count": 0 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 126, + "total_count": 0 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 568, + "total_count": 0 + } + } + } + }, + "AS206728": { + "name": "MEDIALAND-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "80" + }, + { + "count": 3, + "key": "53" + }, + { + "count": 2, + "key": "22" + }, + { + "count": 2, + "key": "445" + }, + { + "count": 2, + "key": "5910" + }, + { + "count": 2, + "key": "5934" + }, + { + "count": 1, + "key": "135" + }, + { + "count": 1, + "key": "139" + }, + { + "count": 1, + "key": "500" + } + ], + "is_more_than_total_hits": false, + "other_count": 7, + "query_duration_millis": 26, + "total_count": 20 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5, + "key": "nginx" + }, + { + "count": 4, + "key": "http_api" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "asp\\.net" + }, + { + "count": 2, + "key": "internet_information_services" + }, + { + "count": 1, + "key": "moment" + }, + { + "count": 1, + "key": "openssh" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 89, + "total_count": 20 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 20, + "key": "BULLETPROOF" + }, + { + "count": 6, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 777, + "total_count": 20 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "hotelsoft.cer" + }, + { + "count": 1, + "key": "invalid2.invalid" + }, + { + "count": 1, + "key": "v673" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 132, + "total_count": 20 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6, + "key": "windows" + }, + { + "count": 1, + "key": "linux" + }, + { + "count": 1, + "key": "routeros" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 58, + "total_count": 20 + } + } + } + }, + "AS211720": { + "name": "Datashield, Inc.", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 28, + "key": "22" + }, + { + "count": 19, + "key": "3389" + }, + { + "count": 14, + "key": "179" + }, + { + "count": 9, + "key": "80" + }, + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "111" + }, + { + "count": 6, + "key": "5985" + }, + { + "count": 4, + "key": "8081" + }, + { + "count": 3, + "key": "8080" + }, + { + "count": 2, + "key": "135" + } + ], + "is_more_than_total_hits": false, + "other_count": 14, + "query_duration_millis": 260, + "total_count": 50 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 11, + "key": "nginx" + }, + { + "count": 6, + "key": "http_api" + }, + { + "count": 2, + "key": "mariadb" + }, + { + "count": 2, + "key": "tor" + }, + { + "count": 1, + "key": "caddy" + }, + { + "count": 1, + "key": "dropbear_ssh" + }, + { + "count": 1, + "key": "gunicorn" + }, + { + "count": 1, + "key": "http_server" + }, + { + "count": 1, + "key": "libupnp" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 111, + "total_count": 50 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 50, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 80, + "total_count": 50 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 3, + "key": "IPMI" + }, + { + "count": 2, + "key": "FREE" + }, + { + "count": 1, + "key": "WIN-JDCEOBUFJUS" + }, + { + "count": 1, + "key": "WIN-JP7KUDECHOR" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "YE2" + }, + { + "count": 1, + "key": "YR2" + }, + { + "count": 1, + "key": "agent-ca@1757674441" + }, + { + "count": 1, + "key": "agent-ca@1757925038" + }, + { + "count": 1, + "key": "agent-ca@1759158944" + } + ], + "is_more_than_total_hits": false, + "other_count": 16, + "query_duration_millis": 122, + "total_count": 50 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 10, + "key": "linux" + }, + { + "count": 3, + "key": "windows" + }, + { + "count": 1, + "key": "debian_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 98, + "total_count": 50 + } + } + } + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 35, + "key": "22" + }, + { + "count": 13, + "key": "80" + }, + { + "count": 8, + "key": "443" + }, + { + "count": 4, + "key": "111" + }, + { + "count": 2, + "key": "25" + }, + { + "count": 2, + "key": "53" + }, + { + "count": 2, + "key": "110" + }, + { + "count": 2, + "key": "143" + }, + { + "count": 2, + "key": "161" + }, + { + "count": 2, + "key": "993" + } + ], + "is_more_than_total_hits": false, + "other_count": 36, + "query_duration_millis": 24, + "total_count": 37 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 16, + "key": "nginx" + }, + { + "count": 10, + "key": "http_server" + }, + { + "count": 9, + "key": "express" + }, + { + "count": 6, + "key": "bootstrap" + }, + { + "count": 6, + "key": "dovecot" + }, + { + "count": 6, + "key": "php" + }, + { + "count": 5, + "key": "prototype" + }, + { + "count": 4, + "key": "jquery" + }, + { + "count": 4, + "key": "openssl" + } + ], + "is_more_than_total_hits": false, + "other_count": 34, + "query_duration_millis": 198, + "total_count": 37 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 37, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 197, + "total_count": 37 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 9, + "key": "YR2" + }, + { + "count": 4, + "key": "Plesk" + }, + { + "count": 3, + "key": "YE2" + }, + { + "count": 3, + "key": "YR1" + }, + { + "count": 2, + "key": "pbx.invisiontech.eu" + }, + { + "count": 1, + "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate" + }, + { + "count": 1, + "key": "OpenWrt" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "www.jxb5pzqmff4pcbab.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 134, + "total_count": 37 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 12, + "key": "linux" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "proxmox" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 49, + "total_count": 37 + } + } + } + }, + "AS58854": { + "name": "KAOPY (Kaopu Cloud)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 180, + "key": "8887" + }, + { + "count": 177, + "key": "80" + }, + { + "count": 163, + "key": "443" + }, + { + "count": 116, + "key": "0" + }, + { + "count": 82, + "key": "8081" + }, + { + "count": 79, + "key": "8888" + }, + { + "count": 78, + "key": "111" + }, + { + "count": 74, + "key": "16257" + }, + { + "count": 74, + "key": "16259" + }, + { + "count": 72, + "key": "16258" + } + ], + "is_more_than_total_hits": false, + "other_count": 4440, + "query_duration_millis": 120, + "total_count": 624 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1169, + "key": "mysql" + }, + { + "count": 349, + "key": "nginx" + }, + { + "count": 228, + "key": "python" + }, + { + "count": 183, + "key": "wsgiserver" + }, + { + "count": 163, + "key": "jquery" + }, + { + "count": 152, + "key": "bootstrap" + }, + { + "count": 103, + "key": "node_exporter" + }, + { + "count": 79, + "key": "openssh" + }, + { + "count": 78, + "key": "kestrel_web_server" + }, + { + "count": 72, + "key": "cadvisor" + } + ], + "is_more_than_total_hits": false, + "other_count": 279, + "query_duration_millis": 536, + "total_count": 624 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 624, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 102, + "total_count": 624 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 47, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 13, + "key": "TrustAsia DV TLS RSA CA 2025" + }, + { + "count": 10, + "key": "FtpServer" + }, + { + "count": 9, + "key": "YR1" + }, + { + "count": 8, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 6, + "key": "TrustAsia DV TLS RSA CA 2024" + }, + { + "count": 5, + "key": "IPMI" + }, + { + "count": 5, + "key": "WIN-RIK6D08VRRQ" + }, + { + "count": 4, + "key": "Firecloud Root Client Certification Authority" + }, + { + "count": 4, + "key": "Sectigo Public Server Authentication CA DV R36" + } + ], + "is_more_than_total_hits": false, + "other_count": 78, + "query_duration_millis": 101, + "total_count": 624 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 33, + "key": "linux" + }, + { + "count": 26, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 411, + "total_count": 624 + } + } + } + }, + "AS202685": { + "name": "TR-ARKEL", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 4, + "key": "80" + }, + { + "count": 2, + "key": "443" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 484, + "total_count": 4 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "internet_information_services" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "asp\\.net" + }, + { + "count": 2, + "key": "http_api" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 154, + "total_count": 4 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 4, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 116, + "total_count": 4 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1, + "key": "YR1" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 155, + "total_count": 4 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "windows" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 120, + "total_count": 4 + } + } + } + }, + "AS394711": { + "name": "KORGRID (KorGrid LLC)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 2, + "key": "80" + }, + { + "count": 2, + "key": "443" + }, + { + "count": 1, + "key": "3389" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 272, + "total_count": 3 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "bootstrap" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 31, + "total_count": 3 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 3, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 25, + "total_count": 3 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2, + "key": "vergeos.local.root" + }, + { + "count": 1, + "key": "pcmrp-test" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 113, + "total_count": 3 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 158, + "total_count": 3 + } + } + } + } +} \ No newline at end of file diff --git a/kevlar/2026-08-31/censys/fleet-correlation.csv b/kevlar/2026-08-31/censys/fleet-correlation.csv new file mode 100644 index 0000000..eafafd9 --- /dev/null +++ b/kevlar/2026-08-31/censys/fleet-correlation.csv @@ -0,0 +1,11 @@ +ip,asn,as_description,cc,service_count,ports,software,greynoise_class,greynoise_tags +176.120.22.61,AS198953,proton66 - Proton66 OOO,RU,6,135;137;139;3389;5985;47001,http_api,malicious,"Looks Like Windows 7 server,MSSQL TDS PRELOGIN Scanner,MySQL Protocol,RDP Crawler,RDP Protocol,SSH Alternative Port Crawler,SSH Bruteforcer,SSH Connection Attempt,Web Crawler" +204.76.203.7,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,2,22;9001,nginx,malicious,"Carries HTTP Referer,CrushFTP Scanner,F5 BIG-IP Crawler,FTP Protocol,Generic IoT Default Password Attempt,Generic Open Redirect,Generic XSS Commands in Request,Go HTTP Client,ICMPv4 Protocol,Ivanti Co" +204.76.203.14,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,0,,,malicious,"AWS Configuration Scanner,Carries HTTP Referer,CrushFTP Scanner,ENV Crawler,F5 BIG-IP Crawler,Generic /proc Enumeration Attempt,Generic Login Attempt,Generic PHPInfo Access Attempt,Generic Path Traver" +45.135.193.193,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,malicious,"Generic Path Traversal Attempt,Generic Sensitive File Access Attempt,Generic XSS Commands in Request,ICMPv4 Protocol,Looks Like Debian server,Open Proxy Scanner,Ping Scanner,TLS/SSL Crawler,Web Crawle" +204.76.203.49,AS51396,,,0,,,, +45.135.194.113,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,malicious,"Carries HTTP Referer,Go HTTP Client,ICMPv4 Protocol,Looks Like Debian server,Open Proxy Scanner,Ping Scanner,SOCKS5 Proxy Scanner,Web Crawler" +45.135.193.198,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,suspicious,"Generic XSS Commands in Request,ICMPv4 Protocol,Looks Like Debian server,Ping Scanner,TLS/SSL Crawler,Web Crawler" +204.76.203.4,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,1,22,,unknown, +176.120.22.43,AS198953,proton66 - Proton66 OOO,RU,1,3389,,malicious,"Cisco ASA Scanner,Cisco SSL VPN Bruteforcer,ConnectWise ScreenConnect Auth Bypass Check,CrushFTP Scanner,F5 BIG-IP Crawler,Generic Login Attempt,Generic Path Traversal Attempt,Looks Like Windows 10 la" +176.65.148.226,AS51396,PFCLOUD - Pfcloud UG (haftungsbeschrankt),DE,2,22;80,,malicious,"Carries HTTP Referer,ConnectWise ScreenConnect Auth Bypass Check,CrushFTP Scanner,DNS Protocol,F5 BIG-IP Crawler,Generic Sensitive File Access Attempt,Generic XSS Commands in Request,ICMPv4 Protocol,I" diff --git a/kevlar/2026-08-31/censys/ip-enrichments.ndjson b/kevlar/2026-08-31/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..4efc7e4 --- /dev/null +++ b/kevlar/2026-08-31/censys/ip-enrichments.ndjson @@ -0,0 +1,10 @@ +{"ip": "176.120.22.61", "asn": "AS198953", "name": "PROTON66", "honeylabs_events": 1141, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 198953, "bgp_prefix": "176.120.22.0/24", "country_code": "RU", "description": "proton66 - Proton66 OOO", "name": "proton66 - Proton66 OOO"}, "dns": {"reverse_dns": {"resolve_time": "2026-08-27T14:52:41Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Looks Like Windows 7 server"}, {"name": "MSSQL TDS PRELOGIN Scanner"}, {"name": "MySQL Protocol"}, {"name": "RDP Crawler"}, {"name": "RDP Protocol"}, {"name": "SSH Alternative Port Crawler"}, {"name": "SSH Bruteforcer"}, {"name": "SSH Connection Attempt"}, {"name": "Web Crawler"}]}, "ip": "176.120.22.61", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Saint Petersburg", "continent": "Europe", "coordinates": {"latitude": 59.93863, "longitude": 30.31413}, "country": "Russia", "country_code": "RU", "postal_code": "195213", "province": "St.-Petersburg", "timezone": "Europe/Moscow"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.server"}], "part": "o", "product": "windows", "source": "recog", "vendor": "microsoft"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 6, "services": [{"banner_hash_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "dcerpc": {"could_bind": true, "could_query_epm": true, "endpoints": [{"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-8dc8f5673df46eb52d]", "ncacn_ip_tcp:176.120.22.61[1026]", "ncacn_np:\\\\M051108[\\pipe\\eventlog]", "ncalrpc:[eventlog]"], "executable": "nrpsrv.dll", "explained_uuid": "30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 NRP server endpoint", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "srvsvc.dll", "explained_uuid": "98716d03-89ac-44c7-bb8c-285824e51c4a v1.0 XactSrv service", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "N/A", "explained_uuid": "3a9ef155-691d-4449-8d05-09ad57031823 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-a2f1d3b7cddc139c78]"], "executable": "gpsvc.dll", "explained_uuid": "2eb08e3e-639f-4fba-97b1-14f878961076 v1.0 Group Policy RPC Interface", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-75133026b353cf66c2]", "ncalrpc:[LRPC-8116c31a18a2af404a]"], "executable": "N/A", "explained_uuid": "f47433c3-3e9d-4157-aad4-83aa1f5c2d4c v1.0 Fw APIs", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]", "ncalrpc:[DNSResolver]"], "executable": "N/A", "explained_uuid": "eb081a0d-10ee-478a-a1dd-50995283e7a8 v3.0 Witness Client Test Interface", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "8782d3b9-ebbd-4644-a3d8-e8725381919b v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[dabrpc]", "ncalrpc:[LRPC-7563631bf11d56b19e]", "ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]", "ncalrpc:[LSMApi]", "ncalrpc:[LRPC-87c422f6707b03390f]", "ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "9b008953-f195-4bf9-bde0-4471971e58ed v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-8dc8f5673df46eb52d]", "ncacn_ip_tcp:176.120.22.61[1026]", "ncacn_np:\\\\M051108[\\pipe\\eventlog]", "ncalrpc:[eventlog]"], "executable": "N/A", "explained_uuid": "abfb6ca3-0c5e-4734-9285-0aee72fe8d1c v1.0 Wcm Service", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-ddacc17bdd42921044]"], "executable": "N/A", "explained_uuid": "b2507c30-b126-494a-92ac-ee32b6eeb039 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-75133026b353cf66c2]", "ncalrpc:[LRPC-8116c31a18a2af404a]"], "executable": "MPSSVC.dll", "explained_uuid": "2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0 Fw APIs", "protocol": "N/A"}, {"bindings": ["ncacn_np:\\\\M051108[\\PIPE\\wkssvc]", "ncalrpc:[LRPC-43ef2ed6ee1c17eb27]", "ncalrpc:[DNSResolver]"], "executable": "N/A", "explained_uuid": "7f1343fe-50a9-4927-a778-0c5859517bac v1.0 DfsDs service", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1028]", "ncalrpc:[LRPC-697e8331bb546929eb]"], "executable": "spoolsv.exe", "explained_uuid": "0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0", "protocol": "[MS-PAN]: Print System Asynchronous Notification Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1026]", "ncacn_np:\\\\M051108[\\pipe\\eventlog]", "ncalrpc:[eventlog]"], "executable": "wevtsvc.dll", "explained_uuid": "f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 Event log TCPIP", "protocol": "[MS-EVEN6]: EventLog Remoting Protocol"}, {"bindings": ["ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "taskcomp.dll", "explained_uuid": "1ff70682-0a51-30e8-076d-740be8cee98b v1.0", "protocol": "[MS-TSCH]: Task Scheduler Service Remoting Protocol"}, {"bindings": ["ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "schedsvc.dll", "explained_uuid": "0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]", "ncalrpc:[DNSResolver]"], "executable": "N/A", "explained_uuid": "f2c9b409-c1c9-4100-8639-d8ab1486694a v1.0 Witness Client Upcall Server", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1028]", "ncalrpc:[LRPC-697e8331bb546929eb]"], "executable": "spoolsv.exe", "explained_uuid": "12345678-1234-abcd-ef00-0123456789ab v1.0", "protocol": "[MS-RPRN]: Print System Remote Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1032]", "ncalrpc:[samss lpc]", "ncalrpc:[SidKey Local End Point]", "ncalrpc:[protected_storage]", "ncalrpc:[lsasspirpc]", "ncalrpc:[lsapolicylookup]", "ncalrpc:[LSA_EAS_ENDPOINT]", "ncalrpc:[lsacap]", "ncalrpc:[LSARPC_ENDPOINT]", "ncalrpc:[securityevent]", "ncalrpc:[audit]", "ncacn_np:\\\\M051108[\\pipe\\lsass]"], "executable": "N/A", "explained_uuid": "b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 v2.0 KeyIso", "protocol": "N/A"}, {"bindings": ["ncalrpc:[WindowsShutdown]", "ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]", "ncalrpc:[WMsgKRpc068920]", "ncalrpc:[WMsgKRpc0BA091]", "ncalrpc:[WMsgKRpc0289BF2]"], "executable": "winlogon.exe", "explained_uuid": "76f226c3-ec14-4325-8a99-6a46348418af v1.0", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "N/A", "explained_uuid": "1a0d010f-1c33-432c-b0f5-8cf4e8053099 v1.0 IdSegSrv service", "protocol": "N/A"}, {"bindings": ["ncacn_np:\\\\M051108[\\PIPE\\W32TIME_ALT]", "ncalrpc:[W32TIME_ALT]", "ncalrpc:[LRPC-1f4f400a89fd304001]", "ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"], "executable": "N/A", "explained_uuid": "3473dd4d-2e88-4006-9cba-22570909dd10 v5.1 WinHttp Auto-Proxy Service", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-75133026b353cf66c2]", "ncalrpc:[LRPC-8116c31a18a2af404a]"], "executable": "MPSSVC.dll", "explained_uuid": "7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0 Fw APIs", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1028]", "ncalrpc:[LRPC-697e8331bb546929eb]"], "executable": "spoolsv.exe", "explained_uuid": "4a452661-8290-4b36-8fbe-7f4093a94978 v1.0", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1032]", "ncalrpc:[samss lpc]", "ncalrpc:[SidKey Local End Point]", "ncalrpc:[protected_storage]", "ncalrpc:[lsasspirpc]", "ncalrpc:[lsapolicylookup]", "ncalrpc:[LSA_EAS_ENDPOINT]", "ncalrpc:[lsacap]", "ncalrpc:[LSARPC_ENDPOINT]", "ncalrpc:[securityevent]", "ncalrpc:[audit]", "ncacn_np:\\\\M051108[\\pipe\\lsass]"], "executable": "samsrv.dll", "explained_uuid": "12345778-1234-abcd-ef00-0123456789ac v1.0", "protocol": "[MS-SAMR]: Security Account Manager (SAM) Remote Protocol"}, {"bindings": ["ncalrpc:[LRPC-5b3c020788ba8cdd19]", "ncalrpc:[LRPC-5b3c020788ba8cdd19]", "ncalrpc:[LRPC-5b3c020788ba8cdd19]"], "executable": "msdtcprx.dll", "explained_uuid": "906b0ce0-c70b-1067-b317-00dd010662da v1.0", "protocol": "[MS-CMPO]: MSDTC Connection Manager:"}, {"bindings": ["ncalrpc:[WMsgKRpc0289BF2]"], "executable": "winlogon.exe", "explained_uuid": "12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 Secure Desktop LRPC interface", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-7563631bf11d56b19e]", "ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]", "ncalrpc:[LSMApi]", "ncalrpc:[LRPC-87c422f6707b03390f]", "ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "697dcda9-3ba9-4eb2-9247-e11f1901b0d2 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[dhcpcsvc6]", "ncalrpc:[dhcpcsvc]", "ncalrpc:[LRPC-8dc8f5673df46eb52d]", "ncacn_ip_tcp:176.120.22.61[1026]", "ncacn_np:\\\\M051108[\\pipe\\eventlog]", "ncalrpc:[eventlog]"], "executable": "dhcpcsvc6.dll", "explained_uuid": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 DHCPv6 Client LRPC Endpoint", "protocol": "N/A"}, {"bindings": ["ncalrpc:[dhcpcsvc]", "ncalrpc:[LRPC-8dc8f5673df46eb52d]", "ncacn_ip_tcp:176.120.22.61[1026]", "ncacn_np:\\\\M051108[\\pipe\\eventlog]", "ncalrpc:[eventlog]"], "executable": "dhcpcsvc.dll", "explained_uuid": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 DHCP Client LRPC Endpoint", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "N/A", "explained_uuid": "c36be077-e14b-4fe9-8abc-e856ef4f048b v1.0 Proxy Manager client server endpoint", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "iphlpsvc.dll", "explained_uuid": "552d076a-cb29-4e44-8b6a-d15e59e2c0af v1.0 IP Transition Configuration endpoint", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-8116c31a18a2af404a]"], "executable": "BFE.DLL", "explained_uuid": "dd490425-5325-4565-b774-7e27d6c09c24 v1.0 Base Firewall Engine API", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1028]", "ncalrpc:[LRPC-697e8331bb546929eb]"], "executable": "spoolsv.exe", "explained_uuid": "76f03f96-cdfd-44fc-a22c-64950a001209 v1.0", "protocol": "[MS-PAR]: Print System Asynchronous Remote Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "IKEEXT.DLL", "explained_uuid": "a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0 IKE/Authip API", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-87c422f6707b03390f]", "ncalrpc:[actkernel]", "ncalrpc:[umpo]", "ncacn_np:\\\\M051108[\\PIPE\\srvsvc]", "ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]", "ncalrpc:[IUserProfile2]"], "executable": "sysntfy.dll", "explained_uuid": "c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 Impl friendly name", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[LRPC-729277d6e71e759854]", "ncacn_np:\\\\M051108[\\PIPE\\srvsvc]", "ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "certprop.dll", "explained_uuid": "30b044a5-a225-43f0-b3a4-e060df91f9c1 v1.0", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "schedsvc.dll", "explained_uuid": "86d35949-83c9-4044-b424-db363231fd0c v1.0", "protocol": "[MS-TSCH]: Task Scheduler Service Remoting Protocol"}, {"bindings": ["ncalrpc:[LRPC-1f4f400a89fd304001]", "ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"], "executable": "nsisvc.dll", "explained_uuid": "7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0 NSI server endpoint", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "3b338d89-6cfa-44b8-847e-531531bc9992 v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "085b0334-e454-4d91-9b8c-4134f9e793f3 v1.0", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "N/A", "explained_uuid": "2e6035b2-e8f1-41a7-a044-656b439c4c34 v1.0 Proxy Manager provider server endpoint", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1029]"], "executable": "services.exe", "explained_uuid": "367abb81-9844-35f1-ad32-98f038001003 v2.0", "protocol": "[MS-SCMR]: Service Control Manager Remote Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1025]", "ncalrpc:[WindowsShutdown]", "ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]", "ncalrpc:[WMsgKRpc068920]"], "executable": "wininit.exe", "explained_uuid": "d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0", "protocol": "[MS-RSP]: Remote Shutdown Protocol"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "c605f9fb-f0a3-4e2a-a073-73560f8d9e3e v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "8bfc3be1-6def-4e2d-af74-7c47cd0ade4a v1.0", "protocol": "N/A"}, {"bindings": ["ncalrpc:[actkernel]", "ncalrpc:[umpo]"], "executable": "N/A", "explained_uuid": "2d98a740-581d-41b9-aa0d-a88b9d5ce938 v1.0", "protocol": "N/A"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1027]", "ncalrpc:[ubpmtaskhostchannel]", "ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "N/A", "explained_uuid": "c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 v1.0 Adh APIs", "protocol": "N/A"}, {"bindings": ["ncacn_np:\\\\M051108[\\PIPE\\atsvc]", "ncalrpc:[senssvc]", "ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]", "ncalrpc:[IUserProfile2]"], "executable": "taskcomp.dll", "explained_uuid": "378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0", "protocol": "[MS-TSCH]: Task Scheduler Service Remoting Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1028]", "ncalrpc:[LRPC-697e8331bb546929eb]"], "executable": "spoolsv.exe", "explained_uuid": "ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0", "protocol": "[MS-PAN]: Print System Asynchronous Notification Protocol"}, {"bindings": ["ncacn_ip_tcp:176.120.22.61[1030]"], "executable": "FwRemoteSvr.dll", "explained_uuid": "6b5bdd1e-528c-422c-af8c-a4079be4fe48 v1.0 Remote Fw APIs", "protocol": "[MS-FASP]: Firewall and Advanced Security Protocol"}]}, "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "DCERPC", "literal_match": "DCERPC"}], "id": "CENSYS-2022-1025", "metrics": {}, "name": "Exposed DCERPC Service", "risk_source": "censys", "severity": "high", "source": "censys", "year": 2022}], "ip": "176.120.22.61", "ja4tscan": {"fingerprint": "8192_2-1-3-4-8_1460_8_3-6", "scan_time": "2026-08-31T01:10:33Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "DCERPC", "literal_match": "DCERPC"}], "source": "censys", "value": "REMOTE_ACCESS"}], "port": 135, "protocol": "DCERPC", "scan_time": "2026-08-31T11:38:40Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "DCERPC", "literal_match": "DCERPC"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}], "transport_protocol": "tcp"}, {"banner": "\ufffd\u0604\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000/\u0000<\ufffd\ufffdp\ufffdp\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "banner_hash_sha256": "3eafb65f29d04699ee533a5329edd7fcc03a4a623be0e41032afe81389e2e9cc", "banner_hex": "e5d88400000000010000000020434b414141414141414141414141414141414141414141414141414141414141000021000100000000002f003cecef70ab7000000000000000000000000000000000000000000000000000000000000000000000000000000000", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "NETBIOS", "literal_match": "NETBIOS"}], "id": "CENSYS-2022-1048", "metrics": {}, "name": "Exposed NetBIOS Service", "risk_source": "censys", "severity": "high", "source": "censys", "year": 2022}], "ip": "176.120.22.61", "port": 137, "protocol": "NETBIOS", "scan_time": "2026-08-30T23:38:15Z", "transport_protocol": "udp"}, {"banner": "\ufffd\u0000\u0000\u0001\ufffd", "banner_hash_sha256": "58107a5ecf9946731642e90c1697df14cd2256d86b0b12ce5f49c002271d9ab1", "banner_hex": "830000018f", "ip": "176.120.22.61", "ja4tscan": {"fingerprint": "8192_2-1-3-4-8_1460_8_3-6", "scan_time": "2026-08-28T18:18:17Z"}, "port": 139, "protocol": "UNKNOWN", "scan_time": "2026-08-31T05:20:25Z", "transport_protocol": "tcp"}, {"cert": {"added_at": "2026-08-15T08:45:19Z", "ever_seen_in_scan": true, "fingerprint_md5": "d1c6245ff53529256936944f02bbb799", "fingerprint_sha1": "8ed826c5a4d251e4114c41bd805cadbaaa453d28", "fingerprint_sha256": "5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9", "modified_at": "2026-08-15T08:45:19Z", "names": ["M051108"], "parse_status": "success", "parsed": {"extensions": {"extended_key_usage": {"server_auth": true}, "key_usage": {"data_encipherment": true, "key_encipherment": true, "value": 12}}, "issuer": {"common_name": ["M051108"]}, "issuer_dn": "CN=M051108", "ja4x": "7022c563de38_7022c563de38_e73b053161df", "serial_number": "41589344625908147176989412798876321205", "serial_number_hex": "1f49d100c949abb941aa0fb62bdf85b5", "signature": {"self_signed": true, "signature_algorithm": {"name": "SHA1-RSA", "oid": "1.2.840.113549.1.1.5"}, "valid": true, "value": "a2791bf8c3e14d5e9d6d6191107e6b53091d530ea61818324cf2a5408a78f93f47e57affe03bef889623fec3a4eec5dbf83674136fc2fc606b8801632edea7d14e1fe4ca0662e9e348890d27e373566aa1c61cbadfb1ef25c3f4fd38c3d6937620d92bb991076fdf80f3f19c42d6d8abd23e1a509f94dceca872f332eb78d0fa3816c5847fc0260f054ccdf108c53ef3a5082e0742d0fe683bb3ea74c08af50e860732275bc9034891546862afe8eb5ef7afd7f6111bcece21d6b5c4ca59170a2175a74cf77125861369b2047c9e30d5668ffbbbce785325e9756c3edd1332d6cdd3e02a878211ed41a07b8bd9df80d5899a64fb04520d63cfd106a34f7aa8c0"}, "subject": {"common_name": ["M051108"]}, "subject_dn": "CN=M051108", "subject_key_info": {"fingerprint_sha256": "b9df7ebb8ef6601132112b543ac023199a9fe33e8fce6ef03ee2250c5d2728e6", "key_algorithm": {"name": "RSA", "oid": "1.2.840.113549.1.1.1"}, "rsa": {"exponent": 65537, "length": 2048, "modulus": "e337f4e05615c11cf4743f38b87a0cc4b3313f7abc5c642901fbd3843349e724d9d0deb581fadecbd8bb02d9c9122303d6bbf2498e2a827a77b6126ab0cbe62e986aa62e2e96cd936d30213e2180f4f71e5b8fa57ac322aab66a5c879e2008c31e1ebe195681834ed90d36b3255530d9b25f079cad7b8f39ee5f21feb7b05051dfd1bc310de0efbb1ba3276d73d1968e98e8c2cfbc12ebf2663d771ea61fe7e11c648478adbf97b65dd773097d00cb21ace23d760a0fcf9933203469d6f0dcc933ed3f74edc8263934fcdccb48405d4ef6e1242645a59e05741d809b4d8ac8773f73f7b6c7c5f3f2533c17a20b15ff98107571b4de52051e0b5bdfe94402d4ff"}}, "validity_period": {"length_seconds": 15811201, "not_after": "2027-02-12T17:38:09Z", "not_before": "2026-08-13T17:38:09Z"}, "version": 3}, "revocation": {"crl": {}, "ocsp": {}}, "spki_fingerprint_sha256": "327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5", "spki_subject_fingerprint_sha256": "327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5", "tbs_fingerprint_sha256": "1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2", "tbs_no_ct_fingerprint_sha256": "1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2", "validated_at": "2026-08-30T18:04:11Z", "validation": {"apple": {}, "chrome": {}, "microsoft": {}, "nss": {}}, "zlint": {"errors_present": true, "failed_lints": ["e_ext_san_missing", "e_sub_cert_aia_does_not_contain_ocsp_url", "e_sub_cert_aia_missing", "e_sub_cert_cert_policy_empty", "e_sub_cert_certificate_policies_missing", "e_sub_cert_or_sub_ca_using_sha1", "e_subject_common_name_not_exactly_from_san", "n_subject_common_name_included", "w_ext_key_usage_not_critical", "w_ext_subject_key_identifier_missing_sub_cert", "w_sub_cert_sha1_expiration_too_long"], "notices_present": true, "timestamp": "2026-08-15T08:45:19Z", "version": 3, "warnings_present": true}}, "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "id": "CENSYS-2022-1054", "metrics": {}, "name": "Exposed RDP Service", "risk_source": "censys", "severity": "high", "source": "censys", "year": 2022}], "ip": "176.120.22.61", "ja4tscan": {"fingerprint": "64000_2-1-3-4-8_1460_0_3-6", "scan_time": "2026-08-28T09:03:26Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "source": "censys", "value": "REMOTE_ACCESS"}], "misconfigs": [{"confidence": 0.5, "evidence": [{"data_path": "service.tls.cipher_selected", "found_value": "TLS_RSA_WITH_AES_256_GCM_SHA384", "literal_match": "TLS_RSA_WITH_AES_256_GCM_SHA384"}], "id": "CENSYS-2026-1193", "metrics": {}, "name": "Weak TLS Cipher Selected", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2026}, {"confidence": 1, "evidence": [{"data_path": "cert.parsed.signature.self_signed", "found_value": "true"}], "id": "CENSYS-2026-1196", "metrics": {}, "name": "Self-Signed Certificate", "risk_source": "censys", "severity": "low", "source": "censys", "year": 2026}], "port": 3389, "protocol": "RDP", "rdp": {"certificate_info": {}, "connect_response": {"domain_parameters": {"domain_protocol_version": 2, "max_channel_ids": 34, "max_mcspdu_size": 65528, "max_provider_height": 1, "max_user_id_channels": 3, "num_priorities": 1}}, "protocol_flags": {"dynvc_graphics_pipeline": true, "extended_client_data_supported": true, "neg_resp_reserved": true, "restricted_admin_mode": true}, "selected_security_protocol": {"raw_value": 1, "standard_rdp": true, "tls": true}, "version": {"major": 5, "raw": "00000000"}, "x224_cc_pdu_dstref": 51966, "x224_cc_pdu_srcref": 13330}, "scan_time": "2026-08-30T21:40:35Z", "screenshots": [{"extracted_text": "", "handle": "0f61e0e0c8e24862b48e983b0284604d", "phash": "0000000000000000"}], "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}], "tls": {"cipher_selected": "TLS_RSA_WITH_AES_256_GCM_SHA384", "fingerprint_sha256": "5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9", "ja3s": "f75082535b4a79c07b31bdd0e2b7eb87", "ja4s": "t120100_009d_bc98f8e001b5", "version_selected": "tlsv1_2", "versions": [{"ja3s": "f75082535b4a79c07b31bdd0e2b7eb87", "ja4s": "t120100_009d_bc98f8e001b5", "version": "tlsv1_2"}, {"ja3s": "1308be477c8afb355e2860ab89378ae5", "ja4s": "t110100_c014_bc98f8e001b5", "version": "tlsv1_1"}, {"ja3s": "bcf3a836c82d12ee988005fb0c011445", "ja4s": "t100100_c014_bc98f8e001b5", "version": "tlsv1_0"}]}, "transport_protocol": "tcp"}, {"banner": "HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n", "banner_hash_sha256": "d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362", "endpoints": [{"banner": "HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n", "banner_hash_sha256": "d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362", "endpoint_type": "HTTP", "hostname": "176.120.22.61", "http": {"body": "\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n", "body_hash_sha1": "a66898b36c94c53766e66c1a7aaeb149447ec083", "body_hash_sha256": "ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0", "body_hash_tlsh": "8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf", "body_size": 315, "headers": {"Connection": {"headers": ["close"]}, "Content-Length": {"headers": ["315"]}, "Content-Type": {"headers": ["text/html; charset=us-ascii"]}, "Date": {"headers": [""]}, "Server": {"headers": ["Microsoft-HTTPAPI/2.0"]}}, "html_tags": ["Not Found", ""], "html_title": "Not Found", "protocol": "HTTP/1.1", "status_code": 404, "status_reason": "Not Found", "supported_versions": ["HTTP/1.1"], "uri": "http://176.120.22.61:5985/"}, "ip": "176.120.22.61", "path": "/", "port": 5985, "scan_time": "2026-08-31T11:10:22Z", "transport_protocol": "tcp"}], "ip": "176.120.22.61", "ja4tscan": {"fingerprint": "8192_2-1-3-4-8_1460_8_3-6", "scan_time": "2026-08-29T17:48:59Z"}, "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.server"}], "part": "o", "product": "windows", "source": "recog", "vendor": "microsoft"}], "port": 5985, "protocol": "HTTP", "scan_time": "2026-08-31T11:10:22Z", "software": [{"confidence": 0.25, "cpe": "cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.server"}], "part": "a", "product": "http_api", "source": "recog", "vendor": "microsoft", "version": "2.0"}], "transport_protocol": "tcp"}, {"banner": "HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n", "banner_hash_sha256": "d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362", "endpoints": [{"banner": "HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n", "banner_hash_sha256": "d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362", "endpoint_type": "HTTP", "hostname": "176.120.22.61", "http": {"body": "\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n", "body_hash_sha1": "a66898b36c94c53766e66c1a7aaeb149447ec083", "body_hash_sha256": "ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0", "body_hash_tlsh": "8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf", "body_size": 315, "headers": {"Connection": {"headers": ["close"]}, "Content-Length": {"headers": ["315"]}, "Content-Type": {"headers": ["text/html; charset=us-ascii"]}, "Date": {"headers": [""]}, "Server": {"headers": ["Microsoft-HTTPAPI/2.0"]}}, "html_tags": ["Not Found", ""], "html_title": "Not Found", "protocol": "HTTP/1.1", "status_code": 404, "status_reason": "Not Found", "supported_versions": ["HTTP/1.1"], "uri": "http://176.120.22.61:47001/"}, "ip": "176.120.22.61", "path": "/", "port": 47001, "scan_time": "2026-08-30T15:39:31Z", "transport_protocol": "tcp"}], "ip": "176.120.22.61", "ja4tscan": {"fingerprint": "8192_2-1-3-4-8_1460_8_3-6", "scan_time": "2026-08-29T16:32:27Z"}, "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.server"}], "part": "o", "product": "windows", "source": "recog", "vendor": "microsoft"}], "port": 47001, "protocol": "HTTP", "scan_time": "2026-08-30T15:39:31Z", "software": [{"confidence": 0.25, "cpe": "cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.server"}], "part": "a", "product": "http_api", "source": "recog", "vendor": "microsoft", "version": "2.0"}], "transport_protocol": "tcp"}], "whois": {"network": {"cidrs": ["176.120.22.0/24"], "created": "2024-08-27T00:00:00Z", "handle": "RU-PROTON66-20240827", "name": "Proton66 OOO", "updated": "2024-08-27T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@proton66.ru", "handle": "AR70098-RIPE", "name": "Abuse-C Role"}], "address": "DISTRICT No. 54, ISKROVSKY PR-KT, D. 21, LIT. U, kv.218\\n193230\\nST. PETERSBURG\\nRUSSIAN FEDERATION", "admin_contacts": [{"email": "mail@proton66.ru", "handle": "TD6653-RIPE", "name": "Tech dept."}], "handle": "ORG-PO84-RIPE", "name": "Proton66 OOO"}}}}}, "services": {"result": {"next_page_token": "8792023c86b702f03a6a7fb8:zz/lR6xg4iRSNfqP/yp/62qD5qAa+2f4agCTDhiHCYhKmKwMEsdtx1PUCShlzMcvpDYNq6lera6Vfm1RsUyLHrz7qhghkkBFo5A5O4pLlDAQlSCZUgtGwOBHgt5SMcc8cMl5TSEdNsi7Ar2+rJ+1JZy2ykEict2Moo7BdgkFgMGY1bQkLJOUQ3OtnQUMYi/AmawUspW9dcq6nnZtCcHveTmigsO4S46NjEsIn8HY1oVjGXej6Otd6q2CIcRel5gwrmD5CohCUO9odvxYOIqmlhCIB6J4hNu+7xgHLiYX5tvV0xCxay3b2zNNRf7BG00fzUrAgyVqeplpYiQCL3HnCmor/JxbO8D1hAxSLACYNDCWXagCuz9EP/XZb2OybwCxCibGc1IOgV6j8lKCEvSVkQyYr8zKXgH+86ACb8Y4+LhRiTpF0w98nJ7tOxMirzJwWG36ajawk4sH+lGV86/UZcakH+V1snlXuS8kd+EhpeEJKbvnF+rG0HkgsOd+eqgDFASzkW3bTQmlEHdiNX/URiCjmLhJvvgE97InhrLIbqa3cRF4m6+mdtqMGh6S46EC8Glenvk58godstjWvDR5sPkJnp87n02nNulqT8O6FZxDFqAl2milr352wPymN+rFmiQdNGJ9g7EMsXSLRjDB8xyzTwc9cb+dPoYSN9yChZnct+PC81pY8bxB5Us/vqmL0NiGntLxgns5DCqj1A8XFtYO9QfzCLdDdmuxjiZSCL+L/HxrkPymYbN0nryYBMXdeFb9n0HE", "ranges": [{"end_time": "2026-08-30T23:38:16.099607Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-08-20T07:42:14.372647Z", "transport_protocol": "UDP"}, {"end_time": "2026-08-30T21:40:36.639126Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-08-06T19:47:31.859886Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T15:39:32.01147Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-08-06T02:43:52.747803Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T10:32:06.311402Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-27T12:18:02.047257Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T10:31:24.813461Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-08-06T02:43:46.311271Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T10:06:33.398707Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-08-06T02:44:01.749124Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-27T08:43:41.570019Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-27T08:43:40.570019Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-26T10:21:46.760391Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-26T10:20:25.67231Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-26T08:13:36.504647Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-26T08:13:35.504647Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-26T08:13:12.42251Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-25T04:43:30.494382Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-25T17:34:19.531526Z", "ip": "176.120.22.61", "port": "5985", "protocol": "WINRM", "start_time": "2026-08-08T19:17:33.821091Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-24T07:36:40.054527Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-23T06:50:12.773792Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-22T15:23:44.11493Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-22T08:38:09.523732Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-22T08:37:33.581826Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-21T07:41:17.778311Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-21T07:38:14.917603Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-21T07:38:13.917603Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-21T07:19:00.451075Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-21T07:18:59.451075Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-20T06:44:17.276544Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-20T06:44:16.276544Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-19T07:50:18.707543Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-18T11:41:13.716445Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-19T02:49:51.723149Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-08-09T20:06:57.477747Z", "transport_protocol": "UDP"}, {"end_time": "2026-08-17T14:01:55.895553Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-17T14:01:53.811806Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-17T14:01:48.234317Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-17T14:01:47.234317Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-17T14:01:34.438545Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-08-16T07:32:40.445243Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-15T13:38:22.298154Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-06T18:41:27.264213Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-05T01:37:40.529844Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-08-05T01:37:39.529844Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-04T18:00:08.854314Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-08-04T18:00:07.854314Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-04T00:07:25.545518Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-08-04T00:07:24.545518Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-11T18:17:40.953526Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-06-11T18:17:39.953526Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-11T17:13:52.184593Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-06-11T17:13:51.184593Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-03T05:21:47.778097Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-06-03T05:21:46.778097Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-01T13:21:45.552973Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-06-01T13:21:44.552973Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-31T11:59:37.716174Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-05-31T11:59:36.716174Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-31T04:38:06.680817Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-31T04:38:05.680817Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-29T22:14:19.208939Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-05-29T22:14:18.208939Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-29T07:02:58.389854Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-05-29T07:02:57.389854Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-29T04:05:25.20307Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-29T04:05:24.20307Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-28T17:28:28.787203Z", "ip": "176.120.22.61", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-05-28T17:28:27.787203Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-27T13:13:50.268721Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-05-27T01:07:49.294913Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-21T11:39:31.149123Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-21T11:39:30.149123Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-20T06:35:47.601788Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-18T05:24:08.392658Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-17T01:18:18.028105Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-17T01:18:17.028105Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-15T15:31:29.175412Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-15T15:31:28.175412Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-15T04:14:16.791927Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-05-15T04:14:15.791927Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-15T03:55:36.848816Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-15T03:55:35.848816Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-14T14:56:17.761063Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-14T14:56:16.761063Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-13T15:08:00.800876Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-13T15:07:59.800876Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-13T03:26:28.627729Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-05-12T07:50:34.962837Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-13T02:20:49.751824Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-13T02:20:48.751824Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-12T18:40:14.353273Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-12T18:40:13.353273Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-11T18:48:39.930699Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-11T18:48:38.930699Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-11T02:01:01.410146Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-05-10T02:24:06.195117Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-10T22:31:35.377374Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-10T22:31:34.377374Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-10T05:37:23.559231Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-10T05:37:22.559231Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-09T21:37:43.506453Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-09T21:37:42.506453Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-09T21:37:29.450271Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-09T21:37:28.450271Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-09T19:54:50.330648Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-05-09T19:54:49.330648Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-08T21:15:58.311145Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-07T22:59:54.997321Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-08T21:15:51.999282Z", "ip": "176.120.22.61", "port": "47001", "protocol": "UNKNOWN", "start_time": "2026-05-08T21:15:50.999282Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-07T18:31:48.72907Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-05-06T17:48:21.177639Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-05T02:28:47.751376Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-05-05T02:28:46.751376Z", "transport_protocol": "UDP"}, {"end_time": "2026-05-04T08:28:18.641295Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-05-04T08:28:17.641295Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-03T02:16:38.304547Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-05-03T02:16:37.304547Z", "transport_protocol": "UDP"}, {"end_time": "2026-05-02T04:21:56.385586Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-05-02T04:21:55.385586Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-01T11:51:04.381131Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-30T11:09:07.220963Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-30T22:59:39.760584Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-04-29T21:47:33.085667Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-30T00:32:19.26696Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-04-27T23:16:37.032761Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-29T12:17:13.960929Z", "ip": "176.120.22.61", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-04-29T12:17:12.960929Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-29T06:41:09.172449Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-29T06:41:08.172449Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-28T22:32:55.762689Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-04-27T01:40:45.637947Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-28T21:27:04.225648Z", "ip": "176.120.22.61", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-04-28T21:27:03.225648Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-28T16:35:18.810593Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-04-28T16:35:17.810593Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-28T12:48:34.982189Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-04-27T11:58:42.4909Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-28T08:44:26.059079Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-04-28T08:44:25.059079Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-27T22:15:41.662264Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-27T22:15:40.662264Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-27T16:13:54.947103Z", "ip": "176.120.22.61", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-04-27T16:13:53.947103Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-27T07:45:54.375223Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-04-27T07:45:53.375223Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-26T13:58:08.231706Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-26T13:58:07.231706Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-26T02:15:30.006463Z", "ip": "176.120.22.61", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-04-26T02:15:29.006463Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-25T18:53:50.934945Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-04-21T15:02:44.256579Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-24T21:16:57.206015Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-04-24T21:16:56.206015Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-24T21:08:12.467422Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-23T19:45:59.138797Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-24T12:41:05.027246Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-04-24T12:41:04.027246Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-24T12:33:52.933439Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-04-23T12:17:21.241554Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-22T18:51:16.543959Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-04-22T18:51:15.543959Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-22T15:36:46.004145Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-04-22T15:36:45.004145Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-22T11:21:05.741384Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-22T11:21:04.741384Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-21T10:32:12.509336Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-04-18T07:58:05.149909Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-21T04:32:24.241526Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-04-19T02:57:17.731764Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-20T23:16:25.20814Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-04-20T23:16:24.20814Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-20T19:17:26.020854Z", "ip": "176.120.22.61", "port": "5985", "protocol": "HTTP", "start_time": "2026-04-20T19:17:25.020854Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-20T10:05:01.609157Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-04-20T10:05:00.609157Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-20T02:35:39.603981Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-04-19T01:36:31.641712Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-19T04:53:03.044811Z", "ip": "176.120.22.61", "port": "47001", "protocol": "HTTP", "start_time": "2026-04-17T02:48:43.238301Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-19T01:36:00.433291Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-04-18T00:53:03.996167Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-17T19:42:29.956391Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-04-17T19:42:28.956391Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-17T13:37:34.38622Z", "ip": "176.120.22.61", "port": "3389", "protocol": "RDP", "start_time": "2026-04-16T12:40:28.151909Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-17T02:45:51.877095Z", "ip": "176.120.22.61", "port": "135", "protocol": "DCERPC", "start_time": "2026-04-17T02:45:50.877095Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-16T20:36:17.354577Z", "ip": "176.120.22.61", "port": "137", "protocol": "NETBIOS", "start_time": "2026-04-15T19:35:20.166111Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-16T18:42:11.019621Z", "ip": "176.120.22.61", "port": "5985", "protocol": "UNKNOWN", "start_time": "2026-04-16T18:42:10.019621Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-16T10:34:55.268684Z", "ip": "176.120.22.61", "port": "139", "protocol": "UNKNOWN", "start_time": "2026-04-16T10:34:54.268684Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-16T01:02:53.809618Z", "ip": "176.120.22.61", "port": "139", "protocol": "NETBIOS", "start_time": "2026-04-16T01:02:52.809618Z", "transport_protocol": "TCP"}]}}} +{"ip": "204.76.203.7", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 1095, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "204.76.203.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"reverse_dns": {"names": ["204.76.203.7.ptr.pfcloud.network"], "resolve_time": "2026-08-26T14:49:40Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Carries HTTP Referer"}, {"name": "CrushFTP Scanner"}, {"name": "F5 BIG-IP Crawler"}, {"name": "FTP Protocol"}, {"name": "Generic IoT Default Password Attempt"}, {"name": "Generic Open Redirect"}, {"name": "Generic XSS Commands in Request"}, {"name": "Go HTTP Client"}, {"name": "ICMPv4 Protocol"}, {"name": "Ivanti Connect Secure (ICS) Scanner"}, {"name": "Ivanti VTM Scanner"}, {"name": "Looks Like Debian server"}, {"name": "MySQL Protocol"}, {"name": "Open Proxy Scanner"}, {"name": "Outlook Web Access Crawler"}, {"name": "Outlook Web Access Login Crawler"}, {"name": "Ping Scanner"}, {"name": "Pulse Secure VPN Scanner"}, {"name": "SOCKS5 Proxy Scanner"}, {"name": "SSH Alternative Port Crawler"}, {"name": "SSH Connection Attempt"}, {"name": "Sophos XG Firewall User Portal Scanner"}, {"name": "Telnet Login Attempt"}, {"name": "Telnet Protocol"}, {"name": "Web Crawler"}, {"name": "Wordpress Enumeration"}]}, "ip": "204.76.203.7", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Eygelshoven", "continent": "Europe", "coordinates": {"latitude": 50.89394, "longitude": 6.0587}, "country": "Netherlands", "country_code": "NL", "postal_code": "6471", "province": "Limburg", "timezone": "Europe/Amsterdam"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 2, "services": [{"banner": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18", "banner_hash_sha256": "b04692223bd773fee5925703ef034b57925f84bbb50484fb653f809efe00baca", "banner_hex": "5353482d322e302d4f70656e5353485f392e367031205562756e74752d337562756e747531332e3138", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "204.76.203.7", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-8-16", "scan_time": "2026-08-29T17:42:23Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-31T00:36:57Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}, {"confidence": 0.25, "cpe": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "a", "product": "openssh", "source": "recog", "vendor": "openbsd", "version": "9.6p1"}], "ssh": {"algorithm_selection": {"client_to_server_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}, "host_key_algorithm": "ecdsa-sha2-nistp256", "kex_algorithm": "curve25519-sha256@libssh.org", "server_to_client_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}}, "endpoint_id": {"comment": "Ubuntu-3ubuntu13.18", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18", "software_version": "OpenSSH_9.6p1"}, "hassh_fingerprint": "e42184b06d45385a906f0803d04c83da", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256", "ssh-ed25519"], "kex_algorithms": ["sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "ext-info-s", "kex-strict-s-v00@openssh.com"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}, "server_host_key": {"ecdsa_public_key": {"b": "WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=", "curve": "P-256", "gx": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=", "gy": "T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=", "length": 256, "n": "/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=", "p": "/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=", "x": "w+tcwcFaslsel1gEvQ2csUu+bsTKUJrEHtFJqB/PGiI=", "y": "jroXSsWhNDvOKZ0rdr2n8mLXOVVABLF5+eP/ZS4nwz4="}, "fingerprint_sha256": "5b832758258137c8f09d36551d7dd770f192ea181de615f24eefe6835e04e064"}}, "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.5p1 && <=9.7p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.6 && <=9.8"}], "id": "CVE-2024-6387", "kev": [{"date_added": "2024-07-17T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 8.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.999, "score": 0.995}}, "name": "CVE-2024-6387", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2024}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.8p1 && <=9.9p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.9 && <=9.8"}], "id": "CVE-2025-26465", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 6.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "epss": {"percentile": 0.941, "score": 0.076}}, "name": "CVE-2025-26465", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=9.5p1 && <=9.9p1"}], "id": "CVE-2025-26466", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 0.985, "score": 0.398}}, "name": "CVE-2025-26466", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=7.4 && <10.0"}], "id": "CVE-2025-32728", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "changed", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "epss": {"percentile": 0.085, "score": 0.002}}, "name": "CVE-2025-32728", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.468, "score": 0.006}}, "name": "CVE-2026-35385", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35386", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.6, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.242, "score": 0.003}}, "name": "CVE-2026-35386", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35387", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.145, "score": 0.002}}, "name": "CVE-2026-35387", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35388", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 2.5, "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.029, "score": 0.001}}, "name": "CVE-2026-35388", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35414", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.072, "score": 0.002}}, "name": "CVE-2026-35414", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59995", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59995", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59996", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59996", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59997", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.07, "score": 0.002}}, "name": "CVE-2026-59997", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59998", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 4.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.075, "score": 0.002}}, "name": "CVE-2026-59998", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59999", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.054, "score": 0.002}}, "name": "CVE-2026-59999", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60000", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 3.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "epss": {"percentile": 0.367, "score": 0.004}}, "name": "CVE-2026-60000", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60001", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.211, "score": 0.003}}, "name": "CVE-2026-60001", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60002", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}, "epss": {"percentile": 0.221, "score": 0.003}}, "name": "CVE-2026-60002", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}, {"banner": "HTTP/1.1 403 Forbidden\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: \r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n", "banner_hash_sha256": "19ae3399290fabf66adfeaeafb625210012fe0e4a857cd3ff1f1ddc5c6c1d6fc", "endpoints": [{"banner": "HTTP/1.1 403 Forbidden\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: \r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n", "banner_hash_sha256": "19ae3399290fabf66adfeaeafb625210012fe0e4a857cd3ff1f1ddc5c6c1d6fc", "endpoint_type": "HTTP", "hostname": "204.76.203.7", "http": {"body": "\r\n403 Forbidden\r\n\r\n

403 Forbidden

\r\n
nginx/1.24.0 (Ubuntu)
\r\n\r\n\r\n", "body_hash_sha1": "323b3ebdc78e3e6f9581706771cbd61bfed318a4", "body_hash_sha256": "2de2499f4e5f896995ee7ebaa527a39b75f520f98e12110ec6c156a2433dbe75", "body_hash_tlsh": "d6c08c67351e3c0ce7a322b422c36aa0d08bd3b088da1a10c640025331c31278ac7315", "body_size": 162, "headers": {"Connection": {"headers": ["keep-alive"]}, "Content-Encoding": {"headers": ["gzip"]}, "Content-Type": {"headers": ["text/html"]}, "Date": {"headers": [""]}, "Server": {"headers": ["nginx/1.24.0 (Ubuntu)"]}, "Transfer-Encoding": {"headers": ["chunked"]}}, "html_tags": ["403 Forbidden"], "html_title": "403 Forbidden", "protocol": "HTTP/1.1", "status_code": 403, "status_reason": "Forbidden", "supported_versions": ["HTTP/1.1"], "uri": "http://204.76.203.7:9001/"}, "ip": "204.76.203.7", "path": "/", "port": 9001, "scan_time": "2026-08-31T04:23:34Z", "transport_protocol": "tcp"}], "ip": "204.76.203.7", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-8-16", "scan_time": "2026-08-29T00:48:26Z"}, "operating_systems": [{"confidence": 0.5, "cpe": "cpe:2.3:o:canonical:ubuntu:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.key", "found_value": "Server", "literal_match": "Server"}, {"data_path": "http.headers.value", "found_value": "Ubuntu"}], "part": "o", "product": "ubuntu", "source": "third_party", "vendor": "canonical"}], "port": 9001, "protocol": "HTTP", "scan_time": "2026-08-31T04:23:34Z", "software": [{"confidence": 0.5, "cpe": "cpe:2.3:a:f5:nginx:1.24.0:*:*:*:*:*:*:*", "evidence": [{"data_path": "http.headers.key", "found_value": "Server", "literal_match": "Server"}, {"data_path": "http.headers.value", "found_value": "nginx/1.24.0"}], "life_cycle": {"release_date": "2023-04-11T00:00:00Z"}, "part": "a", "product": "nginx", "source": "third_party", "vendor": "f5", "version": "1.24.0"}], "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:f5:nginx:1.24.0:*:*:*:*:*:*:*", "semver_expression": ">=1.9.5 && <=1.25.2"}], "id": "CVE-2023-44487", "kev": [{"date_added": "2023-10-10T00:00:00Z", "date_due": "2023-10-31T00:00:00Z", "source": "cisa"}, {"date_added": "2023-10-10T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 1, "score": 1}}, "name": "CVE-2023-44487", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:f5:nginx:1.24.0:*:*:*:*:*:*:*", "semver_expression": ">=1.11.0 && <1.34.2"}], "id": "CVE-2025-1695", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.3, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "cvss_v40": {"components": {"attack_complexity": "low", "attack_requirements": "none", "attack_vector": "network", "privileges_required": "none", "user_interaction": "none"}, "score": 6.9, "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}, "epss": {"percentile": 0.449, "score": 0.006}}, "name": "CVE-2025-1695", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:f5:nginx:1.24.0:*:*:*:*:*:*:*", "semver_expression": ">=1.11.4 && <1.26.3"}], "id": "CVE-2025-23419", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "none", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}, "cvss_v40": {"components": {"attack_complexity": "low", "attack_requirements": "none", "attack_vector": "network", "privileges_required": "low", "user_interaction": "none"}, "score": 5.3, "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}, "epss": {"percentile": 0.85, "score": 0.027}}, "name": "CVE-2025-23419", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:f5:nginx:1.24.0:*:*:*:*:*:*:*", "semver_expression": "<1.29.8"}], "id": "CVE-2026-49975", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 0.982, "score": 0.31}}, "name": "CVE-2026-49975", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}], "whois": {"network": {"allocation_type": "ALLOCATION", "cidrs": ["204.76.203.0/24"], "created": "2025-01-15T00:00:00Z", "handle": "INTEL-NET1-25", "name": "Intelligence Hosting LLC", "updated": "2025-08-05T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "ABUSE8542-ARIN", "name": "Abuse"}], "admin_contacts": [{"email": "admin@pfcloud.io", "handle": "ADMIN8226-ARIN", "name": "Admin"}], "city": "Eygelshoven", "country": "NL", "handle": "IHL-76", "name": "Intelligence Hosting LLC", "postal_code": "6471WV", "street": "Bart van Slobbestraat 16B", "tech_contacts": [{"email": "admin@pfcloud.io", "handle": "TECH1363-ARIN", "name": "Tech"}]}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-31T00:36:58.912589Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2026-08-02T18:27:51.550418Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T17:26:10.944201Z", "ip": "204.76.203.7", "port": "9001", "protocol": "HTTP", "start_time": "2026-08-05T11:01:58.291048Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-05T00:59:03.233243Z", "ip": "204.76.203.7", "port": "80", "protocol": "HTTP", "start_time": "2026-08-04T19:00:24.660869Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-20T23:13:00.27843Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2026-04-13T01:57:40.525712Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-20T22:41:15.954445Z", "ip": "204.76.203.7", "port": "631", "protocol": "IPP", "start_time": "2025-12-31T14:40:10.242137Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-14T12:31:10.595721Z", "ip": "204.76.203.7", "port": "27015", "protocol": "VALVE", "start_time": "2026-04-10T23:23:32.006147Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-13T19:31:28.808357Z", "ip": "204.76.203.7", "port": "53", "protocol": "DNS", "start_time": "2026-04-10T15:33:09.288174Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-10T17:52:12.943061Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2026-02-04T09:21:00.552446Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-04T05:31:37.648212Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2025-12-31T06:31:51.118589Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T22:13:19.908921Z", "ip": "204.76.203.7", "port": "631", "protocol": "IPP", "start_time": "2025-12-09T05:54:24.121285Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T05:48:51.407267Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2025-12-08T22:30:45.299411Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T13:07:45.123075Z", "ip": "204.76.203.7", "port": "631", "protocol": "IPP", "start_time": "2025-11-16T11:19:55.831603Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-07T21:31:56.172415Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2025-11-16T16:11:55.968141Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-16T05:05:23.573539Z", "ip": "204.76.203.7", "port": "631", "protocol": "IPP", "start_time": "2025-10-25T23:01:15.318546Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-15T11:36:11.459205Z", "ip": "204.76.203.7", "port": "22", "protocol": "SSH", "start_time": "2025-10-25T03:11:48.650242Z", "transport_protocol": "TCP"}]}}} +{"ip": "204.76.203.14", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 424, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "204.76.203.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"reverse_dns": {"names": ["204.76.203.14.ptr.pfcloud.network"], "resolve_time": "2026-08-23T06:45:12Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "AWS Configuration Scanner"}, {"name": "Carries HTTP Referer"}, {"name": "CrushFTP Scanner"}, {"name": "ENV Crawler"}, {"name": "F5 BIG-IP Crawler"}, {"name": "Generic /proc Enumeration Attempt"}, {"name": "Generic Login Attempt"}, {"name": "Generic PHPInfo Access Attempt"}, {"name": "Generic Path Traversal Attempt"}, {"name": "Generic SQL Commands in Request"}, {"name": "Generic Sensitive File Access Attempt"}, {"name": "Generic Suspicious Linux Command in Request"}, {"name": "Generic XSS Commands in Request"}, {"name": "Git Config Crawler"}, {"name": "Ivanti Connect Secure (ICS) Scanner"}, {"name": "Ivanti VTM Scanner"}, {"name": "Outlook Web Access Crawler"}, {"name": "Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"}, {"name": "Pulse Secure VPN Scanner"}, {"name": "Sophos XG Firewall User Portal Scanner"}, {"name": "Spring Boot Actuator Crawler"}, {"name": "TLS/SSL Crawler"}, {"name": "Vite Arbitrary File Disclosure CVE-2025-30208 Attempt"}, {"name": "Web Crawler"}, {"name": "Wordpress Enumeration"}]}, "ip": "204.76.203.14", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Eygelshoven", "continent": "Europe", "coordinates": {"latitude": 50.89394, "longitude": 6.0587}, "country": "Netherlands", "country_code": "NL", "postal_code": "6471", "province": "Limburg", "timezone": "Europe/Amsterdam"}, "network": [{"hosting": true, "source": "IPINFO"}], "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "whois": {"network": {"allocation_type": "ALLOCATION", "cidrs": ["204.76.203.0/24"], "created": "2025-01-15T00:00:00Z", "handle": "INTEL-NET1-25", "name": "Intelligence Hosting LLC", "updated": "2025-08-05T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "ABUSE8542-ARIN", "name": "Abuse"}], "admin_contacts": [{"email": "admin@pfcloud.io", "handle": "ADMIN8226-ARIN", "name": "Admin"}], "city": "Eygelshoven", "country": "NL", "handle": "IHL-76", "name": "Intelligence Hosting LLC", "postal_code": "6471WV", "street": "Bart van Slobbestraat 16B", "tech_contacts": [{"email": "admin@pfcloud.io", "handle": "TECH1363-ARIN", "name": "Tech"}]}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-27T16:32:07.491338Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2026-08-09T21:47:05.820745Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-10T01:31:59.502596Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-12-31T17:32:54.114183Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T19:28:55.684035Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-12-31T05:54:23.690691Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T19:25:15.458301Z", "ip": "204.76.203.14", "port": "6661", "protocol": "HTTP", "start_time": "2025-12-31T11:02:00.985028Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T16:06:39.295043Z", "ip": "204.76.203.14", "port": "7771", "protocol": "HTTP", "start_time": "2025-12-31T12:52:37.603701Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T16:04:23.715036Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-12-31T16:18:18.02257Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T11:21:57.537286Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-12-31T22:51:09.822806Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T09:27:35.367524Z", "ip": "204.76.203.14", "port": "9090", "protocol": "HTTP", "start_time": "2025-12-31T07:44:32.497925Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T09:27:23.46064Z", "ip": "204.76.203.14", "port": "9090", "protocol": "UNKNOWN", "start_time": "2025-12-31T07:44:18.475828Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-31T03:04:32.921751Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-12-09T18:01:47.570803Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T23:21:01.397645Z", "ip": "204.76.203.14", "port": "7771", "protocol": "HTTP", "start_time": "2025-12-29T19:21:46.048084Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T21:55:58.953856Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-12-09T01:33:50.324763Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T19:12:54.516066Z", "ip": "204.76.203.14", "port": "9090", "protocol": "HTTP", "start_time": "2025-12-09T00:03:03.512292Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T16:31:08.387004Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-12-09T13:32:16.390577Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T15:15:08.964512Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-12-09T16:55:32.982426Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T12:44:15.477675Z", "ip": "204.76.203.14", "port": "9090", "protocol": "UNKNOWN", "start_time": "2025-12-12T07:31:32.792976Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T10:23:20.041498Z", "ip": "204.76.203.14", "port": "6661", "protocol": "HTTP", "start_time": "2025-12-27T23:21:42.260369Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T17:09:52.761007Z", "ip": "204.76.203.14", "port": "9090", "protocol": "HTTP", "start_time": "2025-11-28T21:16:11.436292Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T17:06:24.517869Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-11-16T15:54:19.834371Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T16:38:27.216705Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-11-16T07:16:47.666993Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T15:46:54.532402Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-11-16T15:42:12.380467Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T12:30:59.777678Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-11-16T19:28:54.328909Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-07T23:35:48.990996Z", "ip": "204.76.203.14", "port": "9090", "protocol": "UNKNOWN", "start_time": "2025-11-28T21:15:57.816764Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-04T11:05:56.794605Z", "ip": "204.76.203.14", "port": "31210", "protocol": "HTTP", "start_time": "2025-11-16T17:54:23.026233Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-16T05:48:06.325853Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-10-25T00:57:30.596288Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-16T04:10:20.882915Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-10-25T06:00:09.990157Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-15T14:38:39.450768Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-10-25T09:12:06.696562Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-15T13:20:03.98947Z", "ip": "204.76.203.14", "port": "31210", "protocol": "HTTP", "start_time": "2025-10-25T01:41:00.727394Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-15T06:38:04.335943Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-10-24T23:53:49.128131Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-24T20:27:44.221976Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-10-03T07:31:55.473777Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-24T17:27:23.337529Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-10-02T18:16:57.54472Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-24T12:44:43.569972Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-10-02T11:30:38.477411Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-24T09:07:04.57467Z", "ip": "204.76.203.14", "port": "31210", "protocol": "HTTP", "start_time": "2025-10-03T07:44:20.933542Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-23T14:16:38.146422Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-10-03T03:46:20.32549Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-02T06:54:28.012997Z", "ip": "204.76.203.14", "port": "31210", "protocol": "HTTP", "start_time": "2025-09-13T19:35:54.224346Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-02T06:02:41.025814Z", "ip": "204.76.203.14", "port": "443", "protocol": "HTTP", "start_time": "2025-09-11T15:02:25.402242Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-02T02:45:59.278139Z", "ip": "204.76.203.14", "port": "80", "protocol": "HTTP", "start_time": "2025-09-11T17:20:51.555559Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-01T16:51:30.328372Z", "ip": "204.76.203.14", "port": "8080", "protocol": "HTTP", "start_time": "2025-09-11T17:34:33.864449Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-01T10:47:37.675564Z", "ip": "204.76.203.14", "port": "22", "protocol": "SSH", "start_time": "2025-09-10T23:09:01.5135Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-04T10:20:19.851871Z", "ip": "204.76.203.14", "port": "4084", "protocol": "HTTP", "start_time": "2025-08-19T09:58:28.919314Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-04T10:19:45.723481Z", "ip": "204.76.203.14", "port": "4085", "protocol": "HTTP", "start_time": "2025-08-19T12:30:33.019872Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T21:07:17.524497Z", "ip": "204.76.203.14", "port": "5917", "protocol": "VNC", "start_time": "2025-08-25T16:38:00.601156Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T21:06:28.318099Z", "ip": "204.76.203.14", "port": "5926", "protocol": "VNC", "start_time": "2025-08-21T10:15:03.177483Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T21:06:24.147852Z", "ip": "204.76.203.14", "port": "5924", "protocol": "VNC", "start_time": "2025-08-26T13:24:18.648994Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T19:15:58.582378Z", "ip": "204.76.203.14", "port": "4082", "protocol": "HTTP", "start_time": "2025-08-23T16:20:45.006131Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T16:45:22.772713Z", "ip": "204.76.203.14", "port": "5918", "protocol": "VNC", "start_time": "2025-08-26T11:28:59.889609Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T14:38:05.470186Z", "ip": "204.76.203.14", "port": "5901", "protocol": "VNC", "start_time": "2025-08-25T21:06:09.464648Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T13:16:55.229694Z", "ip": "204.76.203.14", "port": "4081", "protocol": "HTTP", "start_time": "2025-08-29T22:17:47.523614Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T07:41:23.916325Z", "ip": "204.76.203.14", "port": "5920", "protocol": "VNC", "start_time": "2025-09-01T06:12:08.558126Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T07:41:17.810059Z", "ip": "204.76.203.14", "port": "5906", "protocol": "VNC", "start_time": "2025-09-01T06:20:34.524637Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T07:41:10.279449Z", "ip": "204.76.203.14", "port": "5905", "protocol": "VNC", "start_time": "2025-09-01T06:12:08.278306Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-03T00:39:48.435469Z", "ip": "204.76.203.14", "port": "4343", "protocol": "SSH", "start_time": "2025-08-25T16:36:34.832227Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-02T23:39:10.275297Z", "ip": "204.76.203.14", "port": "5902", "protocol": "VNC", "start_time": "2025-08-18T22:36:24.327044Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-02T22:07:36.113143Z", "ip": "204.76.203.14", "port": "4083", "protocol": "HTTP", "start_time": "2025-08-20T11:46:02.760969Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-02T21:43:59.36743Z", "ip": "204.76.203.14", "port": "5903", "protocol": "VNC", "start_time": "2025-08-21T16:33:00.69731Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-02T21:43:27.138353Z", "ip": "204.76.203.14", "port": "5921", "protocol": "VNC", "start_time": "2025-08-26T11:45:23.629551Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-02T20:39:52.441029Z", "ip": "204.76.203.14", "port": "5913", "protocol": "VNC", "start_time": "2025-08-21T10:14:59.283235Z", "transport_protocol": "TCP"}]}}} +{"ip": "45.135.193.193", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 416, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "45.135.193.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"reverse_dns": {"names": ["45.135.193.193.ptr.pfcloud.network"], "resolve_time": "2026-08-30T16:35:37Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Generic Path Traversal Attempt"}, {"name": "Generic Sensitive File Access Attempt"}, {"name": "Generic XSS Commands in Request"}, {"name": "ICMPv4 Protocol"}, {"name": "Looks Like Debian server"}, {"name": "Open Proxy Scanner"}, {"name": "Ping Scanner"}, {"name": "TLS/SSL Crawler"}, {"name": "Web Crawler"}]}, "ip": "45.135.193.193", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Langen", "continent": "Europe", "coordinates": {"latitude": 49.98955, "longitude": 8.66852}, "country": "Germany", "country_code": "DE", "postal_code": "63225", "province": "Hesse", "timezone": "Europe/Berlin"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 1, "services": [{"banner": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16", "banner_hash_sha256": "8dbf398ecbec9e03f954155af43b811fbc66cad8f52b19c82de83c651475442b", "banner_hex": "5353482d322e302d4f70656e5353485f392e367031205562756e74752d337562756e747531332e3136", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "45.135.193.193", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-9-16", "scan_time": "2026-08-31T08:17:23Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-31T09:32:08Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}, {"confidence": 0.25, "cpe": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "a", "product": "openssh", "source": "recog", "vendor": "openbsd", "version": "9.6p1"}], "ssh": {"algorithm_selection": {"client_to_server_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}, "host_key_algorithm": "ecdsa-sha2-nistp256", "kex_algorithm": "curve25519-sha256@libssh.org", "server_to_client_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}}, "endpoint_id": {"comment": "Ubuntu-3ubuntu13.16", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16", "software_version": "OpenSSH_9.6p1"}, "hassh_fingerprint": "e42184b06d45385a906f0803d04c83da", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256", "ssh-ed25519"], "kex_algorithms": ["sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "ext-info-s", "kex-strict-s-v00@openssh.com"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}, "server_host_key": {"ecdsa_public_key": {"b": "WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=", "curve": "P-256", "gx": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=", "gy": "T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=", "length": 256, "n": "/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=", "p": "/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=", "x": "UZb4tdSYUpzpCpRs+dgt7eDL7+Kq99FMRqa+nEsINgI=", "y": "YpeuIH9iMpwrFd7o8WzV/xosEMVXq0Cu+iXoLrQ4GsE="}, "fingerprint_sha256": "bf2a0ebc24a49e1d4466e269eeabe0d8b9526c8b8deddc03fc208b1cba988e74"}}, "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.5p1 && <=9.7p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.6 && <=9.8"}], "id": "CVE-2024-6387", "kev": [{"date_added": "2024-07-17T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 8.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.999, "score": 0.995}}, "name": "CVE-2024-6387", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2024}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.8p1 && <=9.9p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.9 && <=9.8"}], "id": "CVE-2025-26465", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 6.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "epss": {"percentile": 0.942, "score": 0.076}}, "name": "CVE-2025-26465", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=9.5p1 && <=9.9p1"}], "id": "CVE-2025-26466", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 0.986, "score": 0.398}}, "name": "CVE-2025-26466", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=7.4 && <10.0"}], "id": "CVE-2025-32728", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "changed", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "epss": {"percentile": 0.085, "score": 0.002}}, "name": "CVE-2025-32728", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.443, "score": 0.006}}, "name": "CVE-2026-35385", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35386", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.6, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.242, "score": 0.003}}, "name": "CVE-2026-35386", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35387", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.146, "score": 0.002}}, "name": "CVE-2026-35387", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35388", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 2.5, "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.029, "score": 0.001}}, "name": "CVE-2026-35388", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35414", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.072, "score": 0.002}}, "name": "CVE-2026-35414", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59995", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59995", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59996", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59996", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59997", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.07, "score": 0.002}}, "name": "CVE-2026-59997", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59998", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 4.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.076, "score": 0.002}}, "name": "CVE-2026-59998", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59999", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.054, "score": 0.002}}, "name": "CVE-2026-59999", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60000", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 3.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "epss": {"percentile": 0.367, "score": 0.004}}, "name": "CVE-2026-60000", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60001", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.211, "score": 0.003}}, "name": "CVE-2026-60001", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60002", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}, "epss": {"percentile": 0.221, "score": 0.003}}, "name": "CVE-2026-60002", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}], "whois": {"network": {"cidrs": ["45.135.193.0/24"], "created": "2025-01-26T00:00:00Z", "handle": "PFCLOUD-NET", "name": "Pfcloud UG", "updated": "2025-09-01T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "AA42303-RIPE", "name": "Admin"}], "address": "Lilienstra\u00dfe 5\\n94051 Hauzenberg", "handle": "ORG-PU39-RIPE", "name": "Pfcloud UG"}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-30T08:33:09.819981Z", "ip": "45.135.193.193", "port": "22", "protocol": "SSH", "start_time": "2026-04-25T10:24:19.02431Z", "transport_protocol": "TCP"}]}}} +{"ip": "204.76.203.49", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 338, "host": {"_error": "truncated"}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-30T22:54:02.524393Z", "ip": "204.76.203.49", "port": "22", "protocol": "SSH", "start_time": "2026-07-14T23:47:32.178653Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T20:03:32.393966Z", "ip": "204.76.203.49", "port": "80", "protocol": "HTTP", "start_time": "2026-07-15T15:34:18.053498Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T14:52:00.936284Z", "ip": "204.76.203.49", "port": "443", "protocol": "HTTP", "start_time": "2026-08-08T03:57:25.178485Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-13T11:28:05.694557Z", "ip": "204.76.203.49", "port": "80", "protocol": "HTTP", "start_time": "2026-06-21T16:21:29.958187Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-13T10:31:28.301432Z", "ip": "204.76.203.49", "port": "22", "protocol": "SSH", "start_time": "2026-06-18T15:36:07.541491Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-08T00:57:12.851796Z", "ip": "204.76.203.49", "port": "22", "protocol": "SSH", "start_time": "2025-12-31T06:31:19.933557Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-18T00:34:10.336836Z", "ip": "204.76.203.49", "port": "2222", "protocol": "SSH", "start_time": "2026-01-18T04:02:38.523603Z", "transport_protocol": "TCP"}, {"end_time": "2026-01-30T03:37:43.692582Z", "ip": "204.76.203.49", "port": "80", "protocol": "HTTP", "start_time": "2026-01-27T13:05:42.680668Z", "transport_protocol": "TCP"}, {"end_time": "2026-01-17T19:35:26.043791Z", "ip": "204.76.203.49", "port": "2222", "protocol": "SSH", "start_time": "2026-01-01T02:34:28.69705Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-31T02:23:14.611832Z", "ip": "204.76.203.49", "port": "2222", "protocol": "SSH", "start_time": "2025-12-22T16:45:14.367472Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T06:18:43.719466Z", "ip": "204.76.203.49", "port": "22", "protocol": "SSH", "start_time": "2025-12-09T04:48:11.418406Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T16:56:19.18789Z", "ip": "204.76.203.49", "port": "22", "protocol": "SSH", "start_time": "2025-12-08T16:56:18.18789Z", "transport_protocol": "TCP"}]}}} +{"ip": "45.135.194.113", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 264, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "45.135.194.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"forward_dns": {"45.135.194.113.ptr.pfcloud.network": {"name": "45.135.194.113.ptr.pfcloud.network", "record_type": "a", "resolve_time": "2026-08-31T04:16:57Z"}}, "names": ["45.135.194.113.ptr.pfcloud.network"], "reverse_dns": {"names": ["45.135.194.113.ptr.pfcloud.network"], "resolve_time": "2026-08-31T07:54:58Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Carries HTTP Referer"}, {"name": "Go HTTP Client"}, {"name": "ICMPv4 Protocol"}, {"name": "Looks Like Debian server"}, {"name": "Open Proxy Scanner"}, {"name": "Ping Scanner"}, {"name": "SOCKS5 Proxy Scanner"}, {"name": "Web Crawler"}]}, "ip": "45.135.194.113", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Langen", "continent": "Europe", "coordinates": {"latitude": 49.98955, "longitude": 8.66852}, "country": "Germany", "country_code": "DE", "postal_code": "63225", "province": "Hesse", "timezone": "Europe/Berlin"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 1, "services": [{"banner": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13", "banner_hash_sha256": "6696bfc0b643975c307fb5453c2544456d934b0e2939af20acf0711f2aa24665", "banner_hex": "5353482d322e302d4f70656e5353485f392e367031205562756e74752d337562756e74753133", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "45.135.194.113", "ja4tscan": {"fingerprint": "31856_2-4-8-1-3_1460_7_1-2-4-9-16", "scan_time": "2026-08-29T11:12:05Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-31T00:32:18Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}, {"confidence": 0.25, "cpe": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "a", "product": "openssh", "source": "recog", "vendor": "openbsd", "version": "9.6p1"}], "ssh": {"endpoint_id": {"comment": "Ubuntu-3ubuntu13", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13", "software_version": "OpenSSH_9.6p1"}, "hassh_fingerprint": "e42184b06d45385a906f0803d04c83da", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256"], "kex_algorithms": ["sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "ext-info-s", "kex-strict-s-v00@openssh.com"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}}, "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.5p1 && <=9.7p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.6 && <=9.8"}], "id": "CVE-2024-6387", "kev": [{"date_added": "2024-07-17T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 8.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.999, "score": 0.995}}, "name": "CVE-2024-6387", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2024}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.8p1 && <=9.9p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.9 && <=9.8"}], "id": "CVE-2025-26465", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 6.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "epss": {"percentile": 0.941, "score": 0.076}}, "name": "CVE-2025-26465", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=9.5p1 && <=9.9p1"}], "id": "CVE-2025-26466", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 0.985, "score": 0.398}}, "name": "CVE-2025-26466", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=7.4 && <10.0"}], "id": "CVE-2025-32728", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "changed", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "epss": {"percentile": 0.085, "score": 0.002}}, "name": "CVE-2025-32728", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.468, "score": 0.006}}, "name": "CVE-2026-35385", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35386", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.6, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.242, "score": 0.003}}, "name": "CVE-2026-35386", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35387", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.145, "score": 0.002}}, "name": "CVE-2026-35387", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35388", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 2.5, "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.029, "score": 0.001}}, "name": "CVE-2026-35388", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35414", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.072, "score": 0.002}}, "name": "CVE-2026-35414", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59995", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59995", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59996", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59996", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59997", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.07, "score": 0.002}}, "name": "CVE-2026-59997", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59998", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 4.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.075, "score": 0.002}}, "name": "CVE-2026-59998", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59999", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.054, "score": 0.002}}, "name": "CVE-2026-59999", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60000", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 3.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "epss": {"percentile": 0.367, "score": 0.004}}, "name": "CVE-2026-60000", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60001", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.211, "score": 0.003}}, "name": "CVE-2026-60001", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60002", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}, "epss": {"percentile": 0.221, "score": 0.003}}, "name": "CVE-2026-60002", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}], "whois": {"network": {"cidrs": ["45.135.194.0/24"], "created": "2025-01-26T00:00:00Z", "handle": "PFCLOUD-NET", "name": "Pfcloud UG", "updated": "2025-09-01T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "AA42303-RIPE", "name": "Admin"}], "address": "Lilienstra\u00dfe 5\\n94051 Hauzenberg", "handle": "ORG-PU39-RIPE", "name": "Pfcloud UG"}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-31T00:32:19.41593Z", "ip": "45.135.194.113", "port": "22", "protocol": "SSH", "start_time": "2026-04-04T19:06:05.232152Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-10T15:31:29.702084Z", "ip": "45.135.194.113", "port": "22", "protocol": "SSH", "start_time": "2025-10-08T14:05:35.808042Z", "transport_protocol": "TCP"}]}}} +{"ip": "45.135.193.198", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 192, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "45.135.193.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"reverse_dns": {"names": ["45.135.193.198.ptr.pfcloud.network"], "resolve_time": "2026-08-27T16:37:07Z"}}, "greynoise": {"actor": "unknown", "classification": "suspicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Generic XSS Commands in Request"}, {"name": "ICMPv4 Protocol"}, {"name": "Looks Like Debian server"}, {"name": "Ping Scanner"}, {"name": "TLS/SSL Crawler"}, {"name": "Web Crawler"}]}, "ip": "45.135.193.198", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Langen", "continent": "Europe", "coordinates": {"latitude": 49.98955, "longitude": 8.66852}, "country": "Germany", "country_code": "DE", "postal_code": "63225", "province": "Hesse", "timezone": "Europe/Berlin"}, "network": [{"hosting": true, "source": "IPINFO"}], "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 1, "services": [{"banner": "SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u10", "banner_hash_sha256": "2a8b0f7a2e893d5e76ae53eb3d06394a5c26cb86fe0e0d5e8cc377afdc5b43e0", "banner_hex": "5353482d322e302d4f70656e5353485f392e3270312044656269616e2d322b6465623132753130", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "45.135.193.198", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-8-16", "scan_time": "2026-08-31T01:59:16Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-30T20:01:35Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}], "ssh": {"algorithm_selection": {"client_to_server_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}, "host_key_algorithm": "ecdsa-sha2-nistp256", "kex_algorithm": "curve25519-sha256@libssh.org", "server_to_client_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}}, "endpoint_id": {"comment": "Debian-2+deb12u10", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u10", "software_version": "OpenSSH_9.2p1"}, "hassh_fingerprint": "425d29fe50d8e4f5e37efb6e24bcf660", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256", "ssh-ed25519"], "kex_algorithms": ["sntrup761x25519-sha512", "sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "kex-strict-s-v00@openssh.com"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}, "server_host_key": {"ecdsa_public_key": {"b": "WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=", "curve": "P-256", "gx": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=", "gy": "T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=", "length": 256, "n": "/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=", "p": "/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=", "x": "g0oUOYcov5eIU8Ji2gLTU3BfG8B82Vg3CMUnoi/VtLo=", "y": "VnWDSu1ug15uI+6MAxnc4hMG26Ke0D3l6BFRQ9tt1Hk="}, "fingerprint_sha256": "6e619be4e1624236fd199261c15b48d2ef25b877d0bac3381b8c0fa559baf32f"}}, "transport_protocol": "tcp"}], "whois": {"network": {"cidrs": ["45.135.193.0/24"], "created": "2025-01-26T00:00:00Z", "handle": "PFCLOUD-NET", "name": "Pfcloud UG", "updated": "2025-09-01T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "AA42303-RIPE", "name": "Admin"}], "address": "Lilienstra\u00dfe 5\\n94051 Hauzenberg", "handle": "ORG-PU39-RIPE", "name": "Pfcloud UG"}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-30T20:01:36.236264Z", "ip": "45.135.193.198", "port": "22", "protocol": "SSH", "start_time": "2026-08-23T22:52:14.030106Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-13T16:37:34.477837Z", "ip": "45.135.193.198", "port": "80", "protocol": "HTTP", "start_time": "2026-07-13T21:07:46.449201Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-13T11:32:39.266721Z", "ip": "45.135.193.198", "port": "22", "protocol": "SSH", "start_time": "2026-07-16T01:45:35.031395Z", "transport_protocol": "TCP"}]}}} +{"ip": "204.76.203.4", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 171, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "204.76.203.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"forward_dns": {"protect2.pfcloud.io": {"name": "protect2.pfcloud.io", "record_type": "a", "resolve_time": "2026-08-30T22:51:07Z"}}, "names": ["protect2.pfcloud.io"], "reverse_dns": {"names": ["204.76.203.4.ptr.pfcloud.network"], "resolve_time": "2026-08-24T15:44:29Z"}}, "greynoise": {"actor": "unknown", "classification": "unknown", "last_observed_time": "2026-08-30T00:00:00Z"}, "ip": "204.76.203.4", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Eygelshoven", "continent": "Europe", "coordinates": {"latitude": 50.89394, "longitude": 6.0587}, "country": "Netherlands", "country_code": "NL", "postal_code": "6471", "province": "Limburg", "timezone": "Europe/Amsterdam"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 1, "services": [{"banner": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18", "banner_hash_sha256": "b04692223bd773fee5925703ef034b57925f84bbb50484fb653f809efe00baca", "banner_hex": "5353482d322e302d4f70656e5353485f392e367031205562756e74752d337562756e747531332e3138", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "204.76.203.4", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-9-16", "scan_time": "2026-08-31T00:19:58Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-30T15:05:45Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}, {"confidence": 0.25, "cpe": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "a", "product": "openssh", "source": "recog", "vendor": "openbsd", "version": "9.6p1"}], "ssh": {"algorithm_selection": {"client_to_server_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}, "host_key_algorithm": "ecdsa-sha2-nistp256", "kex_algorithm": "curve25519-sha256@libssh.org", "server_to_client_alg_group": {"cipher": "aes128-ctr", "compression": "none", "mac": "hmac-sha2-256"}}, "endpoint_id": {"comment": "Ubuntu-3ubuntu13.18", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18", "software_version": "OpenSSH_9.6p1"}, "hassh_fingerprint": "e42184b06d45385a906f0803d04c83da", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256", "ssh-ed25519"], "kex_algorithms": ["sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "ext-info-s", "kex-strict-s-v00@openssh.com"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}, "server_host_key": {"ecdsa_public_key": {"b": "WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=", "curve": "P-256", "gx": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=", "gy": "T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=", "length": 256, "n": "/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=", "p": "/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=", "x": "iEdiWZmg10DSdIEivNhKTgRYMLfsMQc114Zi5H19Zl4=", "y": "WjCGRcp9AStq3Vay+y/wuu8xPGbXh3ZUAXB+R+aGGp4="}, "fingerprint_sha256": "22f0d4166644f984615902ff745eebca78b5f19ce7bcbe482e0cdc0af84995bd"}}, "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.5p1 && <=9.7p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=8.6 && <=9.8"}], "id": "CVE-2024-6387", "kev": [{"date_added": "2024-07-17T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 8.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.999, "score": 0.995}}, "name": "CVE-2024-6387", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2024}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.8p1 && <=9.9p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=6.9 && <=9.8"}], "id": "CVE-2025-26465", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 6.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "epss": {"percentile": 0.942, "score": 0.076}}, "name": "CVE-2025-26465", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=9.5p1 && <=9.9p1"}], "id": "CVE-2025-26466", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "epss": {"percentile": 0.986, "score": 0.398}}, "name": "CVE-2025-26466", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": ">=7.4 && <10.0"}], "id": "CVE-2025-32728", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "changed", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "epss": {"percentile": 0.085, "score": 0.002}}, "name": "CVE-2025-32728", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.466, "score": 0.006}}, "name": "CVE-2026-35385", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35386", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.6, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.242, "score": 0.003}}, "name": "CVE-2026-35386", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35387", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.146, "score": 0.002}}, "name": "CVE-2026-35387", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35388", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 2.5, "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.029, "score": 0.001}}, "name": "CVE-2026-35388", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35414", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.072, "score": 0.002}}, "name": "CVE-2026-35414", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59995", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59995", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59996", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59996", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59997", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.07, "score": 0.002}}, "name": "CVE-2026-59997", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59998", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 4.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.075, "score": 0.002}}, "name": "CVE-2026-59998", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59999", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.054, "score": 0.002}}, "name": "CVE-2026-59999", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60000", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 3.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "epss": {"percentile": 0.366, "score": 0.004}}, "name": "CVE-2026-60000", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60001", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.211, "score": 0.003}}, "name": "CVE-2026-60001", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:9.6p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60002", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}, "epss": {"percentile": 0.221, "score": 0.003}}, "name": "CVE-2026-60002", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}], "whois": {"network": {"allocation_type": "ALLOCATION", "cidrs": ["204.76.203.0/24"], "created": "2025-01-15T00:00:00Z", "handle": "INTEL-NET1-25", "name": "Intelligence Hosting LLC", "updated": "2025-08-05T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "ABUSE8542-ARIN", "name": "Abuse"}], "admin_contacts": [{"email": "admin@pfcloud.io", "handle": "ADMIN8226-ARIN", "name": "Admin"}], "city": "Eygelshoven", "country": "NL", "handle": "IHL-76", "name": "Intelligence Hosting LLC", "postal_code": "6471WV", "street": "Bart van Slobbestraat 16B", "tech_contacts": [{"email": "admin@pfcloud.io", "handle": "TECH1363-ARIN", "name": "Tech"}]}}}}}, "services": {"result": {"next_page_token": "", "ranges": [{"end_time": "2026-08-30T15:05:46.055921Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2026-08-30T15:05:45.055921Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-17T22:22:36.331685Z", "ip": "204.76.203.4", "port": "902", "protocol": "SMTP", "start_time": "2026-06-18T07:33:09.846165Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-17T11:01:33.543272Z", "ip": "204.76.203.4", "port": "9080", "protocol": "HTTP", "start_time": "2026-06-17T21:13:38.419072Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-17T09:48:35.852835Z", "ip": "204.76.203.4", "port": "443", "protocol": "HTTP", "start_time": "2026-06-18T09:35:12.519209Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-17T08:53:19.612241Z", "ip": "204.76.203.4", "port": "80", "protocol": "HTTP", "start_time": "2026-05-21T22:25:15.006898Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-17T08:22:23.341701Z", "ip": "204.76.203.4", "port": "9080", "protocol": "UNKNOWN", "start_time": "2026-06-17T21:13:28.105485Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-22T02:51:57.397676Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2026-06-21T19:18:02.240578Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-17T08:32:16.438316Z", "ip": "204.76.203.4", "port": "443", "protocol": "UNKNOWN", "start_time": "2026-05-21T22:11:32.023785Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-17T03:05:57.762709Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2026-05-21T00:00:24.600671Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-22T00:12:03.979388Z", "ip": "204.76.203.4", "port": "443", "protocol": "HTTP", "start_time": "2026-05-22T00:12:02.979388Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-14T19:45:53.494621Z", "ip": "204.76.203.4", "port": "80", "protocol": "HTTP", "start_time": "2026-05-13T19:42:10.705404Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-14T19:34:14.853175Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2026-04-26T11:27:12.00625Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-07T07:37:08.453213Z", "ip": "204.76.203.4", "port": "27015", "protocol": "VALVE", "start_time": "2026-05-07T07:37:07.453213Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-29T21:25:14.610151Z", "ip": "204.76.203.4", "port": "27015", "protocol": "VALVE", "start_time": "2026-04-29T21:25:13.610151Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-27T21:02:12.711535Z", "ip": "204.76.203.4", "port": "27015", "protocol": "VALVE", "start_time": "2026-04-26T05:04:55.159709Z", "transport_protocol": "UDP"}, {"end_time": "2026-04-25T02:27:08.183691Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-12-31T19:31:08.931128Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-14T07:52:35.975394Z", "ip": "204.76.203.4", "port": "27015", "protocol": "VALVE", "start_time": "2026-04-14T07:52:34.975394Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-30T18:31:05.460098Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-12-09T16:31:02.167827Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T16:17:31.506772Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-11-17T13:54:18.366171Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-30T17:13:14.955208Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-10-25T21:39:35.342112Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-24T09:02:14.505932Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-10-02T21:32:20.592531Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-01T20:32:10.064001Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-09-10T01:35:55.46924Z", "transport_protocol": "TCP"}, {"end_time": "2025-09-09T10:21:05.139254Z", "ip": "204.76.203.4", "port": "22", "protocol": "SSH", "start_time": "2025-09-08T21:04:27.780559Z", "transport_protocol": "TCP"}]}}} +{"ip": "176.120.22.43", "asn": "AS198953", "name": "PROTON66", "honeylabs_events": 134, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 198953, "bgp_prefix": "176.120.22.0/24", "country_code": "RU", "description": "proton66 - Proton66 OOO", "name": "proton66 - Proton66 OOO"}, "dns": {"reverse_dns": {"resolve_time": "2026-08-30T20:53:21Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Cisco ASA Scanner"}, {"name": "Cisco SSL VPN Bruteforcer"}, {"name": "ConnectWise ScreenConnect Auth Bypass Check"}, {"name": "CrushFTP Scanner"}, {"name": "F5 BIG-IP Crawler"}, {"name": "Generic Login Attempt"}, {"name": "Generic Path Traversal Attempt"}, {"name": "Looks Like Windows 10 laptop"}, {"name": "PAN-OS CVE-2026-0257 Authentication Bypass Attempt"}, {"name": "Palo Alto Networks Login Scanner"}, {"name": "Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"}, {"name": "TLS/SSL Crawler"}, {"name": "Web Crawler"}]}, "ip": "176.120.22.43", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Saint Petersburg", "continent": "Europe", "coordinates": {"latitude": 59.93863, "longitude": 30.31413}, "country": "Russia", "country_code": "RU", "postal_code": "195213", "province": "St.-Petersburg", "timezone": "Europe/Moscow"}, "network": [{"hosting": true, "source": "IPINFO"}], "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 1, "services": [{"cert": {"added_at": "2026-08-05T08:56:21Z", "ever_seen_in_scan": true, "fingerprint_md5": "f1e0262ff49135794f5cedb3b645b0ed", "fingerprint_sha1": "aafb6a3b2c772bd4d63e1809c799c5640163417d", "fingerprint_sha256": "45698b4840a0aa52c95154108e1acf013b1ae4f65deca1851798ed1ed8ae7fac", "modified_at": "2026-08-05T08:56:21Z", "names": ["DESKTOP-AGLA913"], "parse_status": "success", "parsed": {"extensions": {"extended_key_usage": {"server_auth": true}, "key_usage": {"data_encipherment": true, "key_encipherment": true, "value": 12}}, "issuer": {"common_name": ["DESKTOP-AGLA913"]}, "issuer_dn": "CN=DESKTOP-AGLA913", "ja4x": "7022c563de38_7022c563de38_e73b053161df", "serial_number": "35314202516191734875055970526662751169", "serial_number_hex": "1a91449c39ad2685406912a0702bf3c1", "signature": {"self_signed": true, "signature_algorithm": {"name": "SHA256-RSA", "oid": "1.2.840.113549.1.1.11"}, "valid": true, "value": "6a9f5554fdc4917b6dc485e7e179788476832d33885b496fa531a576f842d5d7c3f98ce3e7992772ae457acbc15fc901cbab7bfe91c31e7f72572242e58d38285593cfc7b8f93278db1c38dc8dd596ada2d9c8326f743441b0c6eae1a83864f293abe7bfa01b29c63faac60cceb371f4e29f3c09312d64597c5cf8ff9b2b6247b6f2460a904ab6b5269e52e2d9154bb89892a08a7e83d73a6328bfa8b7dc0e2d3e7d6acb20eb883719b52f19e05e1e94d717c10087c086b9de1b58cb24af32881f5293a64087ab6c504225523afaf69a6668eae269cb191c3e5aa18b0a1c7bf88a941001e77cdf363c191fa47f21341b3bfb1da2b3a75a8d4721a98ef9b79b2a"}, "subject": {"common_name": ["DESKTOP-AGLA913"]}, "subject_dn": "CN=DESKTOP-AGLA913", "subject_key_info": {"fingerprint_sha256": "8386d4fc4e085c3ca396f0ac50bed132b6cfdb691d77752e067facb10f5a1d26", "key_algorithm": {"name": "RSA", "oid": "1.2.840.113549.1.1.1"}, "rsa": {"exponent": 65537, "length": 2048, "modulus": "be6ae0b496c200e7268ed67950a9eac40b1e6ac83bdc16108d8b43cb7904e75027e7744a123e770121e10ed0a8e2a1452261e38e4cb1f6f33c40eccaa5c017bdf61a800cba0402d2ffe4866b1d87e0a81ccd95cfd89611c65df2c5b7b9d0107d800bd7e9786efdf666eb0387a653d0f7396f76f5373ec9aea7ad764eb60b92ea7121036d7b3de662cc5cf3371b78c5cf7f64be52c424a5f3031748a7ad08459682c8dadd2c09e0086981ac65fbce418f8c0b34e4fe5aaf668b9dc9d580ecd75a7073267482b22fc50f21e4d5303f9e6f4e2f6cc8fa6b270ed08b58a37516608b80830f4730094fe18db0eb415242f7d20c5dc6dbb15d0ab621225de60b9644c9"}}, "validity_period": {"length_seconds": 15811201, "not_after": "2026-12-28T03:15:11Z", "not_before": "2026-06-28T03:15:11Z"}, "version": 3}, "revocation": {"crl": {}, "ocsp": {}}, "spki_fingerprint_sha256": "7ba82c761f1c751cb7918015c8e1dce7be2e8cd51b7c3baabdf083d96eeec288", "spki_subject_fingerprint_sha256": "7ba82c761f1c751cb7918015c8e1dce7be2e8cd51b7c3baabdf083d96eeec288", "tbs_fingerprint_sha256": "ddf275d66d3484493956549341f6e1869a3557980554f53548ba55d7d606693c", "tbs_no_ct_fingerprint_sha256": "ddf275d66d3484493956549341f6e1869a3557980554f53548ba55d7d606693c", "validated_at": "2026-08-30T22:21:38Z", "validation": {"apple": {}, "chrome": {}, "microsoft": {}, "nss": {}}, "zlint": {"errors_present": true, "failed_lints": ["e_ext_san_missing", "e_sub_cert_aia_does_not_contain_ocsp_url", "e_sub_cert_aia_missing", "e_sub_cert_cert_policy_empty", "e_sub_cert_certificate_policies_missing", "e_subject_common_name_not_exactly_from_san", "n_subject_common_name_included", "w_ext_key_usage_not_critical", "w_ext_subject_key_identifier_missing_sub_cert"], "notices_present": true, "timestamp": "2026-08-05T08:56:21Z", "version": 3, "warnings_present": true}}, "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "id": "CENSYS-2022-1054", "metrics": {}, "name": "Exposed RDP Service", "risk_source": "censys", "severity": "high", "source": "censys", "year": 2022}], "ip": "176.120.22.43", "ja4tscan": {"fingerprint": "64000_2-1-3-1-1-4_1460_0_1-2-4-8", "scan_time": "2026-08-29T00:22:39Z"}, "jarm": {"cipher_and_version_fingerprint": "14d14d16d14d14d08c14d14d14d14d", "fingerprint": "14d14d16d14d14d08c14d14d14d14dfd9c9d14e4f4f67f94f0359f8b28f532", "ip": "176.120.22.43", "is_success": true, "port": 3389, "scan_time": "2026-08-27T22:16:18Z", "tls_extensions_sha256": "fd9c9d14e4f4f67f94f0359f8b28f532", "transport_protocol": "tcp"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "source": "censys", "value": "REMOTE_ACCESS"}], "misconfigs": [{"confidence": 0.5, "evidence": [{"data_path": "service.tls.cipher_selected", "found_value": "TLS_RSA_WITH_AES_256_GCM_SHA384", "literal_match": "TLS_RSA_WITH_AES_256_GCM_SHA384"}], "id": "CENSYS-2026-1193", "metrics": {}, "name": "Weak TLS Cipher Selected", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2026}, {"confidence": 1, "evidence": [{"data_path": "cert.parsed.signature.self_signed", "found_value": "true"}], "id": "CENSYS-2026-1196", "metrics": {}, "name": "Self-Signed Certificate", "risk_source": "censys", "severity": "low", "source": "censys", "year": 2026}], "port": 3389, "protocol": "RDP", "rdp": {"certificate_info": {}, "connect_response": {"domain_parameters": {"domain_protocol_version": 2, "max_channel_ids": 34, "max_mcspdu_size": 65528, "max_provider_height": 1, "max_user_id_channels": 3, "num_priorities": 1}}, "protocol_flags": {"dynvc_graphics_pipeline": true, "extended_client_data_supported": true, "neg_resp_reserved": true, "restricted_admin_mode": true, "restricted_auth_mode": true}, "selected_security_protocol": {"raw_value": 1, "standard_rdp": true, "tls": true}, "version": {"major": -1, "minor": -1, "raw": "00000000"}, "x224_cc_pdu_dstref": 51966, "x224_cc_pdu_srcref": 13330}, "scan_time": "2026-08-30T15:31:46Z", "screenshots": [{"extracted_text": "", "handle": "25f48c3acdbf45ae90026dfb5a36d2e2", "phash": "0000000000000000"}], "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "RDP", "literal_match": "RDP"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}], "tls": {"cipher_selected": "TLS_RSA_WITH_AES_256_GCM_SHA384", "fingerprint_sha256": "45698b4840a0aa52c95154108e1acf013b1ae4f65deca1851798ed1ed8ae7fac", "ja3s": "f75082535b4a79c07b31bdd0e2b7eb87", "ja4s": "t120100_009d_bc98f8e001b5", "version_selected": "tlsv1_2", "versions": [{"ja3s": "f75082535b4a79c07b31bdd0e2b7eb87", "ja4s": "t120100_009d_bc98f8e001b5", "version": "tlsv1_2"}, {"ja3s": "9f2e2080c0409c26ea913d9273e88773", "ja4s": "t110100_0035_bc98f8e001b5", "version": "tlsv1_1"}, {"ja3s": "91589ea825a2ee41810c85fab06d2ef6", "ja4s": "t100100_0035_bc98f8e001b5", "version": "tlsv1_0"}]}, "transport_protocol": "tcp"}], "whois": {"network": {"cidrs": ["176.120.22.0/24"], "created": "2024-08-27T00:00:00Z", "handle": "RU-PROTON66-20240827", "name": "Proton66 OOO", "updated": "2024-08-27T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@proton66.ru", "handle": "AR70098-RIPE", "name": "Abuse-C Role"}], "address": "DISTRICT No. 54, ISKROVSKY PR-KT, D. 21, LIT. U, kv.218\\n193230\\nST. PETERSBURG\\nRUSSIAN FEDERATION", "admin_contacts": [{"email": "mail@proton66.ru", "handle": "TD6653-RIPE", "name": "Tech dept."}], "handle": "ORG-PO84-RIPE", "name": "Proton66 OOO"}}}}}, "services": {"result": {"next_page_token": "cbb917a301abae5309d9712f:PQ5N/lXUrnO+qwEay0+9UOgfj8/gSbsWMBXDtGzyRLnExhMO449iSg3vNltQ+xEInMzRbTxnVqa/B6UvtqnO9kn9YA/lBedCtjisS/d9TG+72w8+jiTANsriccXQ+pGLlrfYm3ooFe77lIvROt4nu2xuiyfpV9rrzmerK9LvfRPSTUzrtG34dWNDxPa8hTZ5sJMMRniDS8yaL9EFhRcS1mZpVB7F7yeBlLKqd8mAq86maEAhG+qM/o4OJBiIGLZd3uhLAOt2/OkdSzeHDjZ9FX56cHzttcOtOWME+8kSpWwqL8XVVRTye/va/hDBTeQnxi590p0THBCzWm1tLF8u+iAbMq+Qc3QoUU0N8xcAjMfvTsB8Rdo06uuUVXU/A/HnOEY5NXWeg4hYnEw1p5jcZg5xL94Ji0/pNqyanVgSGibONkE7cnbvVp1udmStRvx6ZfBxITibVDql1Ru1q52hNavEgESCBMeyr+KuIx5FSzXS7to0FQ2gPwZlZoxTkdnZfAWJiokrRqAs4572HzYCPS2rGdm41D5VwhnWqaj0lkgqqd/8SWGaRganXH7mE8kJvwnhw9EWocr9+sQBSIDz4i1WjBGCJikv4tFHHse4wGOpHFoeSE93zK/92mTGtKrLCdbrosjBZaQvPYg1q1ILmyxSPbBUkc4tIP/6i4Hfq6JiMRQgNb7IDRALyKx7Wy/o2zmn2c6w+PaS7HkIq2b7Ww/VdcgvHkDSvObKsJ6e6iodJQag5JmU/Y3P1kjmgwo8o60vesR7", "ranges": [{"end_time": "2026-08-30T15:31:47.904152Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-08-06T18:04:54.713786Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-28T08:39:31.574586Z", "ip": "176.120.22.43", "port": "2222", "protocol": "SSH", "start_time": "2026-08-06T18:40:04.588173Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-05T09:55:41.919496Z", "ip": "176.120.22.43", "port": "2222", "protocol": "SSH", "start_time": "2026-08-05T09:55:40.919496Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-05T08:56:13.01543Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-08-05T08:56:12.01543Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-04T17:01:57.115053Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-06-04T17:01:56.115053Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-02T20:18:26.941613Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-06-02T20:18:25.941613Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-01T12:00:09.475638Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-06-01T12:00:08.475638Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-30T18:30:09.168164Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-05-30T18:30:08.168164Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-29T10:08:47.860302Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-05-29T10:08:46.860302Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-29T09:55:52.2321Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-29T09:55:51.2321Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-28T00:35:22.10442Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-25T22:35:19.4074Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-20T01:20:22.247456Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-20T01:20:21.247456Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-19T21:35:57.132068Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-05-19T21:35:56.132068Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-18T21:11:25.641317Z", "ip": "176.120.22.43", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-05-18T21:11:24.641317Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-18T21:11:03.150726Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-18T21:11:02.150726Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-17T22:12:00.465128Z", "ip": "176.120.22.43", "port": "22", "protocol": "UNKNOWN", "start_time": "2026-05-17T22:11:59.465128Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-15T19:55:12.823723Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-05-15T19:55:11.823723Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-14T10:33:53.562704Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-05-14T10:33:52.562704Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-13T09:35:30.207679Z", "ip": "176.120.22.43", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-05-13T09:35:29.207679Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-12T09:13:46.182244Z", "ip": "176.120.22.43", "port": "3389", "protocol": "UNKNOWN", "start_time": "2026-05-12T09:13:45.182244Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-07T17:45:31.5799Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-07T17:45:30.5799Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-06T04:49:06.444241Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-06T04:49:05.444241Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-05T04:33:29.970563Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-05-05T04:33:28.970563Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-04T04:12:05.099742Z", "ip": "176.120.22.43", "port": "22", "protocol": "UNKNOWN", "start_time": "2026-05-04T04:12:04.099742Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-29T01:26:02.400218Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-29T01:26:01.400218Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-27T04:52:21.91487Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-27T04:52:20.91487Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-26T15:34:39.46526Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-25T15:01:38.563944Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-25T23:32:06.742959Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-24T22:33:09.877381Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-25T05:56:09.353184Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-25T05:56:08.353184Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-24T00:42:55.923006Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-20T22:27:51.747418Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-23T14:00:37.149054Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-23T14:00:36.149054Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-21T13:30:09.713506Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-21T13:30:08.713506Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-20T01:18:39.824804Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-20T01:18:38.824804Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-19T09:58:54.860379Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-19T09:58:53.860379Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-18T12:03:33.441355Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-18T12:03:32.441355Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-18T01:17:36.979116Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-18T01:17:35.979116Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-17T17:26:04.91615Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-17T17:26:03.91615Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-16T21:40:22.242206Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-15T21:09:01.243186Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-16T00:36:19.434162Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-14T23:38:46.833812Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-13T23:34:30.96172Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-13T23:34:29.96172Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-13T19:13:14.188572Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-13T19:13:13.188572Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-12T14:55:17.473144Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-12T14:55:16.473144Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-12T14:33:04.242991Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-11T14:21:58.140396Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-11T03:27:11.362627Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-11T03:27:10.362627Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-10T09:48:24.044407Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-10T09:48:23.044407Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-09T18:40:08.451169Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-06T15:33:04.258551Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-09T04:40:41.10597Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-09T04:40:40.10597Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-07T08:36:36.138946Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-06T08:00:13.623684Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-04T14:42:31.74082Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-04T14:42:30.74082Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-04T14:30:59.220612Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-03T13:33:35.312386Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-03T05:34:22.013178Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-04-02T04:36:33.653145Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-02T08:33:35.777491Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-04-01T07:43:54.32199Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-31T23:33:24.070551Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-30T23:11:51.579659Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-30T23:06:04.325638Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-30T23:06:03.325638Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-29T06:44:31.530172Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-29T06:44:30.530172Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-27T21:59:36.199266Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-27T21:59:35.199266Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-27T02:18:46.635367Z", "ip": "176.120.22.43", "port": "22", "protocol": "UNKNOWN", "start_time": "2026-03-27T02:18:45.635367Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-27T00:09:11.080846Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-27T00:09:10.080846Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-25T03:38:08.069535Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-25T03:38:07.069535Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-24T03:32:24.523921Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-21T08:32:28.397408Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T22:59:31.881459Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-23T15:20:24.338884Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-21T22:41:41.390339Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-21T22:41:40.390339Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-20T18:16:59.344662Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-20T18:16:58.344662Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-20T03:55:17.823415Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-20T03:55:16.823415Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-19T13:32:18.195868Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-17T11:44:38.498309Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-18T18:36:03.722678Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-17T17:36:42.738572Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-16T06:33:49.903523Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-15T05:32:18.647811Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-15T20:31:15.847369Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-14T19:53:12.742287Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-14T01:25:16.694816Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-14T01:25:15.694816Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-13T03:32:55.866484Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-11T01:44:51.111153Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-12T09:08:27.657275Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-12T09:08:26.657275Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-10T05:04:32.565077Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-10T05:04:31.565077Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-09T20:34:31.256936Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-08T20:00:15.373422Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-08T11:30:56.259252Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-08T11:30:55.259252Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-07T14:46:02.20181Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-07T14:46:01.20181Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-07T02:47:01.539547Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-07T02:47:00.539547Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-06T09:43:04.899918Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-06T09:43:03.899918Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-05T21:36:24.8316Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-05T21:36:23.8316Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-04T21:22:58.029361Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-04T21:22:57.029361Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-04T08:36:50.770445Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-04T08:36:49.770445Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-03T07:36:57.42704Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-03-01T05:33:34.274134Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-02T21:08:23.033716Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-03-02T21:08:22.033716Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-01T00:33:02.946439Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-23T20:27:41.202724Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-28T00:36:46.043827Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-25T23:29:35.346679Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-22T08:32:44.672988Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-22T08:32:43.672988Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-22T02:36:40.471815Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-21T01:57:47.381879Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-21T07:56:48.814386Z", "ip": "176.120.22.43", "port": "22", "protocol": "UNKNOWN", "start_time": "2026-02-21T07:56:47.814386Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-20T10:03:03.126017Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-20T10:03:02.126017Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-19T00:37:30.465747Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-19T00:37:29.465747Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-18T22:14:17.985611Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-18T22:14:16.985611Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-17T15:35:16.75724Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-16T14:56:59.448106Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-17T13:32:41.48919Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-15T11:35:35.405886Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-14T13:36:54.754036Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-11T11:25:15.767907Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-14T06:53:56.488259Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-14T06:53:55.488259Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-12T14:08:19.656862Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-12T14:08:18.656862Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-11T01:30:51.539884Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-10T00:42:47.873839Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-09T23:07:55.7667Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-09T23:07:54.7667Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-08T19:31:57.003628Z", "ip": "176.120.22.43", "port": "22", "protocol": "SSH", "start_time": "2026-02-06T18:02:28.571076Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-07T18:40:33.797077Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-07T18:40:32.797077Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-06T09:34:58.911724Z", "ip": "176.120.22.43", "port": "3389", "protocol": "RDP", "start_time": "2026-02-05T09:20:55.417626Z", "transport_protocol": "TCP"}]}}} +{"ip": "176.65.148.226", "asn": "AS51396", "name": "PFCLOUD (Pfcloud UG)", "honeylabs_events": 111, "host": {"result": {"extensions": {}, "resource": {"autonomous_system": {"asn": 51396, "bgp_prefix": "176.65.148.0/24", "country_code": "DE", "description": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)", "name": "PFCLOUD - Pfcloud UG (haftungsbeschrankt)"}, "dns": {"reverse_dns": {"names": ["176.65.148.226.ptr.pfcloud.network"], "resolve_time": "2026-08-25T20:11:44Z"}}, "greynoise": {"actor": "unknown", "classification": "malicious", "last_observed_time": "2026-08-30T00:00:00Z", "tags": [{"name": "Carries HTTP Referer"}, {"name": "ConnectWise ScreenConnect Auth Bypass Check"}, {"name": "CrushFTP Scanner"}, {"name": "DNS Protocol"}, {"name": "F5 BIG-IP Crawler"}, {"name": "Generic Sensitive File Access Attempt"}, {"name": "Generic XSS Commands in Request"}, {"name": "ICMPv4 Protocol"}, {"name": "Ivanti Connect Secure (ICS) Scanner"}, {"name": "LDAP Protocol"}, {"name": "Looks Like Debian server"}, {"name": "Metabase RCE Attempt"}, {"name": "Outlook Web Access Crawler"}, {"name": "Outlook Web Access Login Crawler"}, {"name": "Palo Alto Networks PAN-OS CVE-2020-2034 Crawler"}, {"name": "Ping Scanner"}, {"name": "Pulse Secure VPN Scanner"}, {"name": "SSH Bruteforcer"}, {"name": "SSH Connection Attempt"}, {"name": "Sophos XG Firewall User Portal Scanner"}, {"name": "TLS/SSL Crawler"}, {"name": "Web Crawler"}, {"name": "Wordpress Enumeration"}]}, "ip": "176.65.148.226", "labels": [{"confidence": 0.75, "source": "censys", "value": "BULLETPROOF"}], "location": {"city": "Eygelshoven", "continent": "Europe", "coordinates": {"latitude": 50.89394, "longitude": 6.0587}, "country": "Netherlands", "country_code": "NL", "postal_code": "6471", "province": "Limburg", "timezone": "Europe/Amsterdam"}, "network": [{"hosting": true, "source": "IPINFO"}], "operating_system": {"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}, "privacy": [{"source": "IPINFO"}], "reputation": {"evidence": [{"additional_fields": [{"field": "label", "value": "BULLETPROOF"}], "category": "network_infra", "evidence_score": 1}], "model_version": "0.1.0", "score": 0.42, "score_level": "medium_risk"}, "service_count": 2, "services": [{"banner": "SSH-2.0-OpenSSH_8.9p1 Ubuntu-3", "banner_hash_sha256": "7dccf9b301dd45a86d3a287b510e93214c74d5faf513f0cf72143960afd46669", "banner_hex": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d33", "exposures": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "id": "CENSYS-2022-1066", "metrics": {}, "name": "Exposed SSH Service", "risk_source": "censys", "severity": "medium", "source": "censys", "year": 2022}], "ip": "176.65.148.226", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4-8-16", "scan_time": "2026-08-28T09:28:52Z"}, "labels": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "source": "censys", "value": "REMOTE_ACCESS"}], "operating_systems": [{"confidence": 0.25, "cpe": "cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "o", "product": "linux", "source": "recog", "vendor": "canonical"}], "port": 22, "protocol": "SSH", "scan_time": "2026-08-31T10:32:04Z", "software": [{"confidence": 1, "evidence": [{"data_path": "protocol", "found_value": "SSH", "literal_match": "SSH"}], "part": "a", "source": "censys", "type": ["REMOTE_ACCESS"]}, {"confidence": 0.25, "cpe": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "evidence": [{"data_path": "ssh.endpoint_id.raw"}], "part": "a", "product": "openssh", "source": "recog", "vendor": "openbsd", "version": "8.9p1"}], "ssh": {"endpoint_id": {"comment": "Ubuntu-3", "protocol_version": "2.0", "raw": "SSH-2.0-OpenSSH_8.9p1 Ubuntu-3", "software_version": "OpenSSH_8.9p1"}, "hassh_fingerprint": "699519fdcc30cbcd093d5cd01e4b1d56", "kex_init_message": {"client_to_server_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "client_to_server_compression": ["none", "zlib@openssh.com"], "client_to_server_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"], "host_key_algorithms": ["rsa-sha2-512", "rsa-sha2-256"], "kex_algorithms": ["curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "sntrup761x25519-sha512@openssh.com", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256"], "server_to_client_ciphers": ["chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"], "server_to_client_compression": ["none", "zlib@openssh.com"], "server_to_client_macs": ["umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1"]}}, "transport_protocol": "tcp", "vulns": [{"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=8.9 && <9.3"}], "id": "CVE-2023-28531", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.816, "score": 0.023}}, "name": "CVE-2023-28531", "risk_source": "cve", "severity": "critical", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<9.3"}], "id": "CVE-2023-38408", "kev": [{"date_added": "2023-07-26T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.996, "score": 0.797}}, "name": "CVE-2023-38408", "risk_source": "cve", "severity": "critical", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<9.6"}], "id": "CVE-2023-48795", "kev": [{"date_added": "2025-02-05T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.998, "score": 0.933}}, "name": "CVE-2023-48795", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=8.9 && <9.6"}], "id": "CVE-2023-51384", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "high", "integrity": "none", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 5.5, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "epss": {"percentile": 0.354, "score": 0.004}}, "name": "CVE-2023-51384", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<9.6"}], "id": "CVE-2023-51385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.973, "score": 0.198}}, "name": "CVE-2023-51385", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2023}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=8.5p1 && <=9.7p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=8.6 && <=9.8"}], "id": "CVE-2024-6387", "kev": [{"date_added": "2024-07-17T00:00:00Z", "source": "third_party"}], "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 8.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.999, "score": 0.995}}, "name": "CVE-2024-6387", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2024}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=6.8p1 && <=9.9p1"}, {"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=6.9 && <=9.8"}], "id": "CVE-2025-26465", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 6.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "epss": {"percentile": 0.942, "score": 0.076}}, "name": "CVE-2025-26465", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": ">=7.4 && <10.0"}], "id": "CVE-2025-32728", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "changed", "user_interaction": "none"}, "score": 4.3, "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "epss": {"percentile": 0.085, "score": 0.002}}, "name": "CVE-2025-32728", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2025}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35385", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "high", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "epss": {"percentile": 0.443, "score": 0.006}}, "name": "CVE-2026-35385", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35386", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.6, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.242, "score": 0.003}}, "name": "CVE-2026-35386", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35387", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 3.1, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.146, "score": 0.002}}, "name": "CVE-2026-35387", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35388", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "local", "availability": "none", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 2.5, "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}, "epss": {"percentile": 0.029, "score": 0.001}}, "name": "CVE-2026-35388", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.3"}], "id": "CVE-2026-35414", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "low", "scope": "unchanged", "user_interaction": "none"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.072, "score": 0.002}}, "name": "CVE-2026-35414", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59995", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59995", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59996", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.162, "score": 0.002}}, "name": "CVE-2026-59996", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59997", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "required"}, "score": 4.2, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.07, "score": 0.002}}, "name": "CVE-2026-59997", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59998", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "low", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 4.8, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "epss": {"percentile": 0.076, "score": 0.002}}, "name": "CVE-2026-59998", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-59999", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "none", "confidentiality": "none", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 5.9, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "epss": {"percentile": 0.054, "score": 0.002}}, "name": "CVE-2026-59999", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60000", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "none", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 3.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "epss": {"percentile": 0.367, "score": 0.004}}, "name": "CVE-2026-60000", "risk_source": "cve", "severity": "low", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60001", "metrics": {"cvss_v31": {"components": {"attack_complexity": "low", "attack_vector": "network", "availability": "low", "confidentiality": "none", "integrity": "low", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "epss": {"percentile": 0.211, "score": 0.003}}, "name": "CVE-2026-60001", "risk_source": "cve", "severity": "medium", "source": "third_party", "year": 2026}, {"confidence": 0.25, "evidence": [{"found_value": "cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*", "semver_expression": "<10.4"}], "id": "CVE-2026-60002", "metrics": {"cvss_v31": {"components": {"attack_complexity": "high", "attack_vector": "network", "availability": "low", "confidentiality": "high", "integrity": "high", "privileges_required": "none", "scope": "unchanged", "user_interaction": "none"}, "score": 7.7, "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}, "epss": {"percentile": 0.221, "score": 0.003}}, "name": "CVE-2026-60002", "risk_source": "cve", "severity": "high", "source": "third_party", "year": 2026}]}, {"banner": "HTTP/1.0 200 OK\r\nContent-Type: text/css\r\n", "banner_hash_sha256": "126c23a7f1051a583bdc0b9ef401a476db4d570e1de664443b47eca8b0ca8bb1", "endpoints": [{"banner": "HTTP/1.0 200 OK\r\nContent-Type: text/css\r\n", "banner_hash_sha256": "126c23a7f1051a583bdc0b9ef401a476db4d570e1de664443b47eca8b0ca8bb1", "endpoint_type": "HTTP", "hostname": "176.65.148.226", "http": {"body": "body{margin:0}\n", "body_hash_sha1": "a36c1c732510cc4b48afc5a654029d0a45deab76", "body_hash_sha256": "6d6068180a5c710c68c8ee0e290cb9b37b3450492d3f9e3ae46083deb152fbcf", "body_size": 15, "headers": {"Connection": {"headers": ["close"]}, "Content-Type": {"headers": ["text/css"]}}, "protocol": "HTTP/1.0", "status_code": 200, "status_reason": "OK", "supported_versions": ["HTTP/1.0"], "uri": "http://176.65.148.226/"}, "ip": "176.65.148.226", "path": "/", "port": 80, "scan_time": "2026-08-30T22:50:00Z", "transport_protocol": "tcp"}], "ip": "176.65.148.226", "ja4tscan": {"fingerprint": "65160_2-4-8-1-3_1460_7_1-2-4", "scan_time": "2026-08-31T08:53:38Z"}, "port": 80, "protocol": "HTTP", "scan_time": "2026-08-30T22:50:00Z", "transport_protocol": "tcp"}], "whois": {"network": {"cidrs": ["176.65.148.0/24"], "created": "2025-04-09T00:00:00Z", "handle": "PF-CLOUD-NET-1", "name": "Pfcloud UG", "updated": "2025-09-08T00:00:00Z"}, "organization": {"abuse_contacts": [{"email": "abuse@pfcloud.io", "handle": "AA42303-RIPE", "name": "Admin"}], "address": "Lilienstra\u00dfe 5\\n94051 Hauzenberg", "handle": "ORG-PU39-RIPE", "name": "Pfcloud UG"}}}}}, "services": {"result": {"next_page_token": "c41c92998b11213c855736e7:O8Qn/5IgfTvpe3ipDgCd9UNiYqaz9DCJDOHleNB8hEho1xHTVQhOCnspVFpbnE6cAhyK33ovgLe+yuLTEKW9hUoLfKExqfC9JGeiFz21C/mWIs1WkNk6eYXBloTv61Mh65g1hbhotjtOxgK519TBQlvNSd+/cOjEWQb9JQgS4aFiEtpFePBocNQxtuwYrN5Udu806ZFeNe/4K6gCGq6TdwhdT4p6K8OXRQCHqbmouDBawsKlu0uCrX+6nK8YhHfS6bBwmFksujx5E0JWLjsQjXoK3xB9ON9SiyRHVn/djIrBrtqU23me9HZvpWBU3T/+1fls/3+zYzwoUJI9ww7lsJlT+i64ycKg3pSgR/fTvsNqvLXDfYhJA5T9LJMkpCaTFjfSQ/GNap5vYFYRQZoUwWR29KU2v7+kUO05IjwGMrIH8yoD/nUi7XqKRMvPC6l+JGjqHwKju8sMpKencd2y+IaOJlIjLmqICdUGSBZOY0CYcKTDmIriUatWgTZ29P/tarHV9iVmVsBLt3BrsJ+f+Xc03iXPLEryjWOQn/pu6S7DviE4Zp2g9HZL3qC7H1NvyFtPbnF7vICiYsCpGpwHTz3EvmB0+/vEhSQ7qiI5jYsVRRrC9p+GCWBCmKCWaDeb8ozOeVhTCELQj2mKBjtlV4QK4evZpFkUIs0J1VNwJXBp7DkEoyOcEY+oAag3lHk95ax+Nf1n+gVy+Oqae99oRcY+UervAaZoh4htPnbZe5zE+CMngqE4pJfwtlNNxaT0aeNavrh8", "ranges": [{"end_time": "2026-08-30T22:50:01.694659Z", "ip": "176.65.148.226", "port": "80", "protocol": "HTTP", "start_time": "2026-08-27T17:41:47.632553Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-30T05:11:16.517085Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-08-24T14:49:08.385041Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-21T10:01:49.554088Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-07-16T21:39:36.225009Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-20T21:01:37.559263Z", "ip": "176.65.148.226", "port": "80", "protocol": "HTTP", "start_time": "2026-08-18T16:05:28.469515Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-18T11:19:29.003179Z", "ip": "176.65.148.226", "port": "8444", "protocol": "HTTP", "start_time": "2026-08-13T20:06:13.031072Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-18T11:19:11.981449Z", "ip": "176.65.148.226", "port": "8444", "protocol": "UNKNOWN", "start_time": "2026-08-13T20:05:59.903487Z", "transport_protocol": "TCP"}, {"end_time": "2026-08-18T07:57:01.084126Z", "ip": "176.65.148.226", "port": "8443", "protocol": "HTTP", "start_time": "2026-08-11T23:17:25.353304Z", "transport_protocol": "TCP"}, {"end_time": "2026-07-12T03:32:09.27197Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-06-09T21:58:37.332687Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-08T16:41:01.386314Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-06-04T02:02:02.712005Z", "transport_protocol": "TCP"}, {"end_time": "2026-06-08T02:31:24.782996Z", "ip": "176.65.148.226", "port": "1080", "protocol": "SOCKS", "start_time": "2026-06-04T20:02:04.571684Z", "transport_protocol": "TCP"}, {"end_time": "2026-05-12T00:08:27.77647Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-05-09T21:59:05.380145Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-05T22:37:02.664125Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-03-20T13:00:21.561535Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-05T21:11:33.235667Z", "ip": "176.65.148.226", "port": "25", "protocol": "SMTP", "start_time": "2026-03-19T18:20:02.579056Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-05T21:08:14.928159Z", "ip": "176.65.148.226", "port": "80", "protocol": "HTTP", "start_time": "2026-03-23T17:32:24.02035Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-05T19:08:48.085995Z", "ip": "176.65.148.226", "port": "8080", "protocol": "HTTP", "start_time": "2026-04-05T16:38:22.120284Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-03T20:01:46.231001Z", "ip": "176.65.148.226", "port": "3000", "protocol": "HTTP", "start_time": "2026-03-28T19:37:59.211318Z", "transport_protocol": "TCP"}, {"end_time": "2026-04-03T05:05:12.061303Z", "ip": "176.65.148.226", "port": "23", "protocol": "TELNET", "start_time": "2026-04-03T05:05:11.061303Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-31T22:52:53.642611Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-31T22:52:52.642611Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-31T22:52:49.955491Z", "ip": "176.65.148.226", "port": "4444", "protocol": "UNKNOWN", "start_time": "2026-03-31T22:52:48.955491Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-29T23:53:55.47516Z", "ip": "176.65.148.226", "port": "8080", "protocol": "UNKNOWN", "start_time": "2026-03-29T23:53:54.47516Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-26T03:44:29.300596Z", "ip": "176.65.148.226", "port": "8080", "protocol": "HTTP", "start_time": "2026-03-26T01:49:19.178075Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-26T02:40:00.079456Z", "ip": "176.65.148.226", "port": "4444", "protocol": "UNKNOWN", "start_time": "2026-03-26T02:39:59.079456Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T21:02:49.493026Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-23T21:02:48.493026Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T21:02:47.262144Z", "ip": "176.65.148.226", "port": "8080", "protocol": "HTTP", "start_time": "2026-03-23T06:13:58.298706Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T21:02:30.471856Z", "ip": "176.65.148.226", "port": "4444", "protocol": "UNKNOWN", "start_time": "2026-03-23T05:45:46.431493Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T17:25:34.718209Z", "ip": "176.65.148.226", "port": "23", "protocol": "TELNET", "start_time": "2026-03-23T17:25:33.718209Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-23T02:32:44.237207Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-23T02:32:43.237207Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-16T13:27:16.422361Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2026-03-05T12:02:30.597537Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-15T02:19:05.555933Z", "ip": "176.65.148.226", "port": "8080", "protocol": "HTTP", "start_time": "2026-03-13T19:48:13.836935Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-15T01:44:25.687934Z", "ip": "176.65.148.226", "port": "4444", "protocol": "UNKNOWN", "start_time": "2026-03-15T01:44:24.687934Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-15T01:43:26.045084Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-14T22:31:45.669727Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-13T18:24:33.131582Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-13T18:24:32.131582Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-12T04:35:36.88889Z", "ip": "176.65.148.226", "port": "8080", "protocol": "HTTP", "start_time": "2026-03-10T18:07:02.142343Z", "transport_protocol": "TCP"}, {"end_time": "2026-03-12T02:27:52.72858Z", "ip": "176.65.148.226", "port": "23", "protocol": "UNKNOWN", "start_time": "2026-03-12T02:27:51.72858Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-20T16:15:04.444581Z", "ip": "176.65.148.226", "port": "3389", "protocol": "RDP", "start_time": "2026-02-11T01:06:32.925788Z", "transport_protocol": "TCP"}, {"end_time": "2026-02-07T20:52:21.645478Z", "ip": "176.65.148.226", "port": "3389", "protocol": "RDP", "start_time": "2026-01-31T03:33:01.359761Z", "transport_protocol": "TCP"}, {"end_time": "2026-01-29T03:15:00.530345Z", "ip": "176.65.148.226", "port": "80", "protocol": "HTTP", "start_time": "2026-01-01T00:51:36.889911Z", "transport_protocol": "TCP"}, {"end_time": "2026-01-28T05:29:30.707884Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-31T11:31:28.079875Z", "transport_protocol": "TCP"}, {"end_time": "2026-01-07T23:31:46.743592Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2026-01-06T23:08:47.61419Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-30T23:48:55.54976Z", "ip": "176.65.148.226", "port": "80", "protocol": "HTTP", "start_time": "2025-12-26T21:56:09.044778Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-30T10:31:05.587841Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-26T20:57:08.442711Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-26T15:33:47.923913Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-25T14:58:48.095642Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-26T04:31:57.122208Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-21T17:53:46.413175Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-24T23:32:47.585073Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-23T23:28:03.784249Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-23T15:31:20.426933Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-22T14:55:00.624035Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-21T15:36:00.772792Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-19T01:13:05.269801Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-21T14:32:11.536799Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-17T20:13:49.398862Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-21T13:31:37.326041Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-16T01:18:25.801625Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-16T23:31:45.101586Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-14T21:42:54.314423Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-16T12:37:09.566017Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-14T11:04:23.716296Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-15T21:33:22.92686Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-13T15:02:25.367875Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-14T13:32:14.972411Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-10T22:34:32.321982Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-14T10:37:35.689404Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-13T10:02:15.993988Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-13T11:31:07.659152Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-12T05:18:23.001437Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-12T22:36:12.938497Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-10T20:31:17.842766Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-12T01:31:57.328646Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-08T23:36:01.916194Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-10T11:31:33.39918Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-09T10:32:35.448294Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-10T00:36:38.001955Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-08T23:30:39.887941Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-08T15:35:59.639234Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-07T15:22:27.78215Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-08T14:57:53.741847Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-12-08T04:20:53.452195Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-08T09:31:31.959811Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-04T19:33:22.807195Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-08T00:31:39.248772Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-11-30T09:56:28.432962Z", "transport_protocol": "TCP"}, {"end_time": "2025-12-07T11:39:52.003234Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-04T09:19:07.774709Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-04T15:31:24.082926Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-03T14:48:53.686237Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-04T01:36:57.452815Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-12-02T00:15:56.549769Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-03T10:31:42.798948Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-12-01T08:54:51.572251Z", "transport_protocol": "UDP"}, {"end_time": "2025-12-01T04:31:55.759313Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-11-30T03:41:54.957914Z", "transport_protocol": "UDP"}, {"end_time": "2025-11-30T05:31:09.846034Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-11-17T00:33:05.565383Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-15T23:41:46.52722Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-11-11T19:18:00.813714Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-11T21:43:12.263668Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-11-08T12:46:47.96044Z", "transport_protocol": "UDP"}, {"end_time": "2025-11-11T15:33:38.526382Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-11-07T02:40:28.645253Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-08T00:34:15.042292Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-11-06T22:10:54.972343Z", "transport_protocol": "UDP"}, {"end_time": "2025-11-06T18:35:36.824446Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-10-25T03:07:17.429068Z", "transport_protocol": "TCP"}, {"end_time": "2025-11-06T08:47:12.685982Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-11-03T17:16:05.229344Z", "transport_protocol": "UDP"}, {"end_time": "2025-11-03T13:12:39.592373Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-31T19:43:39.308505Z", "transport_protocol": "UDP"}, {"end_time": "2025-11-02T08:00:06.905549Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-11-02T08:00:05.905549Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-31T12:08:13.950716Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-29T18:24:42.284291Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-30T06:04:58.717967Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-30T00:59:09.120868Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-28T23:54:08.394035Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-28T16:56:39.049368Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-28T23:45:00.424163Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-28T16:22:10.104029Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-27T20:24:26.295789Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-26T18:02:18.661242Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-27T12:47:10.682705Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-26T11:45:12.74926Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-24T19:13:51.17001Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-24T19:13:50.17001Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-24T14:38:50.777997Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-24T14:38:49.777997Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-24T07:03:22.868353Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-22T17:33:25.72241Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-24T06:51:27.730773Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-20T15:35:48.772053Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-24T05:23:52.857888Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-10-08T23:37:11.030479Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-21T21:08:01.857784Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-20T19:29:47.200249Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-20T14:35:37.431075Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-18T13:23:26.299863Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-19T23:52:43.086669Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-15T19:15:54.220946Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-18T01:05:13.949317Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-13T17:56:20.457098Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-14T22:27:23.831438Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-13T20:34:57.925373Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-13T10:32:37.08059Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-11T08:50:42.951622Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-13T00:42:51.994252Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-10T23:10:38.775735Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-10T20:55:26.73465Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-09T19:42:38.745713Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-10T19:28:08.725196Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-08T17:26:50.983126Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-08T19:33:48.837657Z", "ip": "176.65.148.226", "port": "22", "protocol": "SSH", "start_time": "2025-10-04T01:14:10.659248Z", "transport_protocol": "TCP"}, {"end_time": "2025-10-08T18:31:51.05918Z", "ip": "176.65.148.226", "port": "53", "protocol": "DNS", "start_time": "2025-10-07T18:13:45.068788Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-08T13:34:37.985798Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-07T12:43:40.143279Z", "transport_protocol": "UDP"}, {"end_time": "2025-10-06T21:43:10.412856Z", "ip": "176.65.148.226", "port": "27015", "protocol": "VALVE", "start_time": "2025-10-05T21:02:07.697037Z", "transport_protocol": "UDP"}]}}} -- cgit v1.2.3