From de4c2e99a969eb10708b02d8f2b6f31495eacce8 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 7 Sep 2026 06:03:32 -0400 Subject: chore: weekly BPH update --- kevlar/2026-09-07/censys/agg-summary.json | 5692 ++++++++++++++++++++ .../2026-09-07/censys/aggregations-AS138915.ndjson | 5 + .../2026-09-07/censys/aggregations-AS140666.ndjson | 5 + .../2026-09-07/censys/aggregations-AS14956.ndjson | 5 + .../2026-09-07/censys/aggregations-AS198953.ndjson | 5 + .../2026-09-07/censys/aggregations-AS200593.ndjson | 5 + .../2026-09-07/censys/aggregations-AS200651.ndjson | 5 + .../2026-09-07/censys/aggregations-AS202685.ndjson | 5 + .../2026-09-07/censys/aggregations-AS206728.ndjson | 5 + .../2026-09-07/censys/aggregations-AS209847.ndjson | 5 + .../2026-09-07/censys/aggregations-AS210644.ndjson | 5 + .../2026-09-07/censys/aggregations-AS211720.ndjson | 5 + .../2026-09-07/censys/aggregations-AS213702.ndjson | 5 + .../2026-09-07/censys/aggregations-AS214351.ndjson | 5 + .../2026-09-07/censys/aggregations-AS214940.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216139.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216246.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216309.ndjson | 5 + .../2026-09-07/censys/aggregations-AS30823.ndjson | 5 + .../2026-09-07/censys/aggregations-AS33993.ndjson | 5 + .../2026-09-07/censys/aggregations-AS394711.ndjson | 5 + .../2026-09-07/censys/aggregations-AS400992.ndjson | 5 + .../2026-09-07/censys/aggregations-AS51396.ndjson | 5 + .../2026-09-07/censys/aggregations-AS51852.ndjson | 5 + .../2026-09-07/censys/aggregations-AS57043.ndjson | 5 + .../2026-09-07/censys/aggregations-AS58854.ndjson | 5 + kevlar/2026-09-07/censys/enrichment-summary.json | 217 + kevlar/2026-09-07/censys/fleet-correlation.csv | 7 + kevlar/2026-09-07/censys/ip-enrichments.ndjson | 10 + 29 files changed, 6051 insertions(+) create mode 100644 kevlar/2026-09-07/censys/agg-summary.json create mode 100644 kevlar/2026-09-07/censys/aggregations-AS138915.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS140666.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS14956.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS198953.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS200593.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS200651.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS202685.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS206728.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS209847.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS210644.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS211720.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS213702.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS214351.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS214940.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216139.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216246.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216309.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS30823.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS33993.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS394711.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS400992.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS51396.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS51852.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS57043.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS58854.ndjson create mode 100644 kevlar/2026-09-07/censys/enrichment-summary.json create mode 100644 kevlar/2026-09-07/censys/fleet-correlation.csv create mode 100644 kevlar/2026-09-07/censys/ip-enrichments.ndjson (limited to 'kevlar/2026-09-07/censys') diff --git a/kevlar/2026-09-07/censys/agg-summary.json b/kevlar/2026-09-07/censys/agg-summary.json new file mode 100644 index 0000000..508af7f --- /dev/null +++ b/kevlar/2026-09-07/censys/agg-summary.json @@ -0,0 +1,5692 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "fields": { + "port": { + "total": 101919, + "buckets": [ + { + "count": 77184, + "key": "22" + }, + { + "count": 50237, + "key": "443" + }, + { + "count": 33035, + "key": "80" + }, + { + "count": 14781, + "key": "2096" + }, + { + "count": 8370, + "key": "8443" + }, + { + "count": 4740, + "key": "111" + }, + { + "count": 2942, + "key": "8080" + }, + { + "count": 2599, + "key": "2222" + }, + { + "count": 2592, + "key": "2053" + }, + { + "count": 2487, + "key": "53" + }, + { + "count": 2409, + "key": "9100" + }, + { + "count": 1869, + "key": "2212" + }, + { + "count": 1864, + "key": "6767" + }, + { + "count": 1840, + "key": "21" + }, + { + "count": 1838, + "key": "1881" + } + ] + }, + "software": { + "total": 101918, + "buckets": [ + { + "count": 76988, + "key": "openssh" + }, + { + "count": 61500, + "key": "nginx" + }, + { + "count": 8740, + "key": "google_web_services" + }, + { + "count": 8740, + "key": "web_server" + }, + { + "count": 6293, + "key": "ghost" + }, + { + "count": 6289, + "key": "app_and_api_protector" + }, + { + "count": 5413, + "key": "express" + }, + { + "count": 4095, + "key": "caddy" + }, + { + "count": 3938, + "key": "dovecot" + }, + { + "count": 3609, + "key": "waf" + }, + { + "count": 3453, + "key": "cloudflare_load_balancer" + }, + { + "count": 3042, + "key": "http_server" + }, + { + "count": 3024, + "key": "next.js" + }, + { + "count": 2218, + "key": "uvicorn" + }, + { + "count": 2008, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 101918, + "buckets": [ + { + "count": 101918, + "key": "BULLETPROOF" + }, + { + "count": 7, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 101918, + "buckets": [ + { + "count": 15470, + "key": "YE2" + }, + { + "count": 13541, + "key": "YE1" + }, + { + "count": 8815, + "key": "invalid2.invalid" + }, + { + "count": 7505, + "key": "YR1" + }, + { + "count": 3903, + "key": "YR2" + }, + { + "count": 2294, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2053, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 1922, + "key": "hypervisor.hv" + }, + { + "count": 1821, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 1535, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1269, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 1221, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 1163, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1007, + "key": "HARICA DV TLS RSA" + }, + { + "count": 996, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ] + }, + "os": { + "total": 101918, + "buckets": [ + { + "count": 72787, + "key": "linux" + }, + { + "count": 834, + "key": "ubuntu" + }, + { + "count": 572, + "key": "windows" + }, + { + "count": 299, + "key": "routeros" + }, + { + "count": 271, + "key": "debian_linux" + }, + { + "count": 175, + "key": "proxmox" + }, + { + "count": 133, + "key": "linux_kernel" + }, + { + "count": 112, + "key": "adaptive_security_appliance_software" + }, + { + "count": 54, + "key": "freebsd" + }, + { + "count": 43, + "key": "centos" + }, + { + "count": 40, + "key": "ios" + }, + { + "count": 38, + "key": "vmware_esxi_server" + }, + { + "count": 21, + "key": "enterprise_linux" + }, + { + "count": 10, + "key": "windows_server" + }, + { + "count": 8, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS209847", + "name": "THE", + "fields": { + "port": { + "total": 1458, + "buckets": [ + { + "count": 884, + "key": "22" + }, + { + "count": 423, + "key": "443" + }, + { + "count": 413, + "key": "8080" + }, + { + "count": 404, + "key": "53" + }, + { + "count": 370, + "key": "1030" + }, + { + "count": 370, + "key": "1050" + }, + { + "count": 370, + "key": "24442" + }, + { + "count": 368, + "key": "1234" + }, + { + "count": 368, + "key": "1235" + }, + { + "count": 337, + "key": "80" + }, + { + "count": 207, + "key": "1500" + }, + { + "count": 200, + "key": "21" + }, + { + "count": 182, + "key": "1501" + }, + { + "count": 109, + "key": "2096" + }, + { + "count": 92, + "key": "25" + } + ] + }, + "software": { + "total": 1458, + "buckets": [ + { + "count": 1126, + "key": "python" + }, + { + "count": 1116, + "key": "openssh" + }, + { + "count": 1112, + "key": "aiohttp" + }, + { + "count": 670, + "key": "nginx" + }, + { + "count": 357, + "key": "bind" + }, + { + "count": 291, + "key": "dovecot" + }, + { + "count": 204, + "key": "exim" + }, + { + "count": 195, + "key": "proftpd" + }, + { + "count": 133, + "key": "google_web_services" + }, + { + "count": 133, + "key": "web_server" + }, + { + "count": 45, + "key": "app_and_api_protector" + }, + { + "count": 45, + "key": "express" + }, + { + "count": 45, + "key": "ghost" + }, + { + "count": 42, + "key": "bootstrap" + }, + { + "count": 38, + "key": "http_server" + } + ] + }, + "labels": { + "total": 1458, + "buckets": [ + { + "count": 1458, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 1458, + "buckets": [ + { + "count": 217, + "key": "YR2" + }, + { + "count": 184, + "key": "YR1" + }, + { + "count": 133, + "key": "invalid2.invalid" + }, + { + "count": 127, + "key": "YE2" + }, + { + "count": 116, + "key": "YE1" + }, + { + "count": 34, + "key": "server" + }, + { + "count": 24, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 20, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 15, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 14, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 14, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 13, + "key": "vm15882839.example.com" + }, + { + "count": 11, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 10, + "key": "R13" + }, + { + "count": 9, + "key": "dmitrievd1.example.com" + } + ] + }, + "os": { + "total": 1458, + "buckets": [ + { + "count": 1098, + "key": "linux" + }, + { + "count": 14, + "key": "windows" + }, + { + "count": 7, + "key": "ubuntu" + }, + { + "count": 5, + "key": "routeros" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "debian_linux" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "fields": { + "port": { + "total": 71701, + "buckets": [ + { + "count": 62026, + "key": "22" + }, + { + "count": 35342, + "key": "443" + }, + { + "count": 18338, + "key": "80" + }, + { + "count": 12259, + "key": "2096" + }, + { + "count": 8310, + "key": "8443" + }, + { + "count": 6116, + "key": "8080" + }, + { + "count": 3493, + "key": "2053" + }, + { + "count": 2001, + "key": "2222" + }, + { + "count": 1715, + "key": "3389" + }, + { + "count": 1172, + "key": "53" + }, + { + "count": 1165, + "key": "51821" + }, + { + "count": 1085, + "key": "25" + }, + { + "count": 1068, + "key": "3000" + }, + { + "count": 1062, + "key": "8000" + }, + { + "count": 862, + "key": "9443" + } + ] + }, + "software": { + "total": 71701, + "buckets": [ + { + "count": 61391, + "key": "openssh" + }, + { + "count": 30077, + "key": "nginx" + }, + { + "count": 7276, + "key": "google_web_services" + }, + { + "count": 7275, + "key": "web_server" + }, + { + "count": 5365, + "key": "ghost" + }, + { + "count": 5360, + "key": "app_and_api_protector" + }, + { + "count": 4102, + "key": "express" + }, + { + "count": 3511, + "key": "caddy" + }, + { + "count": 3140, + "key": "waf" + }, + { + "count": 2924, + "key": "cloudflare_load_balancer" + }, + { + "count": 2008, + "key": "uvicorn" + }, + { + "count": 1919, + "key": "next.js" + }, + { + "count": 1629, + "key": "http_server" + }, + { + "count": 1582, + "key": "python" + }, + { + "count": 1578, + "key": "jquery" + } + ] + }, + "labels": { + "total": 71701, + "buckets": [ + { + "count": 71701, + "key": "BULLETPROOF" + }, + { + "count": 499, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 71701, + "buckets": [ + { + "count": 14987, + "key": "YE2" + }, + { + "count": 12936, + "key": "YE1" + }, + { + "count": 7359, + "key": "invalid2.invalid" + }, + { + "count": 3525, + "key": "HARICA DV TLS RSA" + }, + { + "count": 3217, + "key": "YR1" + }, + { + "count": 2129, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1981, + "key": "YR2" + }, + { + "count": 1750, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1301, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1278, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 1025, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 965, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 916, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 774, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 760, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ] + }, + "os": { + "total": 71701, + "buckets": [ + { + "count": 59980, + "key": "linux" + }, + { + "count": 740, + "key": "ubuntu" + }, + { + "count": 561, + "key": "windows" + }, + { + "count": 201, + "key": "debian_linux" + }, + { + "count": 92, + "key": "routeros" + }, + { + "count": 90, + "key": "linux_kernel" + }, + { + "count": 33, + "key": "adaptive_security_appliance_software" + }, + { + "count": 16, + "key": "linux_ami" + }, + { + "count": 14, + "key": "centos" + }, + { + "count": 11, + "key": "windows_server" + }, + { + "count": 7, + "key": "freebsd" + }, + { + "count": 3, + "key": "dsm" + }, + { + "count": 2, + "key": "enterprise_linux" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "macos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "fields": { + "port": { + "total": 12308, + "buckets": [ + { + "count": 6621, + "key": "22" + }, + { + "count": 2412, + "key": "32080" + }, + { + "count": 2381, + "key": "443" + }, + { + "count": 2357, + "key": "43080" + }, + { + "count": 2255, + "key": "80" + }, + { + "count": 2242, + "key": "40003" + }, + { + "count": 2236, + "key": "40801" + }, + { + "count": 2233, + "key": "40803" + }, + { + "count": 2228, + "key": "40804" + }, + { + "count": 2198, + "key": "40810" + }, + { + "count": 872, + "key": "123" + }, + { + "count": 559, + "key": "8080" + }, + { + "count": 502, + "key": "3389" + }, + { + "count": 477, + "key": "135" + }, + { + "count": 475, + "key": "3081" + } + ] + }, + "software": { + "total": 12308, + "buckets": [ + { + "count": 7058, + "key": "openssh" + }, + { + "count": 6333, + "key": "openresty" + }, + { + "count": 4660, + "key": "tengine" + }, + { + "count": 2975, + "key": "nginx" + }, + { + "count": 866, + "key": "http_api" + }, + { + "count": 452, + "key": "http_server" + }, + { + "count": 384, + "key": "express" + }, + { + "count": 344, + "key": "jquery" + }, + { + "count": 249, + "key": "bootstrap" + }, + { + "count": 246, + "key": "openvpn_access_server" + }, + { + "count": 208, + "key": "python" + }, + { + "count": 205, + "key": "squid" + }, + { + "count": 199, + "key": "node_exporter" + }, + { + "count": 188, + "key": "litespeed_web_server" + }, + { + "count": 185, + "key": "moment" + } + ] + }, + "labels": { + "total": 12308, + "buckets": [ + { + "count": 12308, + "key": "BULLETPROOF" + }, + { + "count": 100, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 12308, + "buckets": [ + { + "count": 4572, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 2333, + "key": "localhost" + }, + { + "count": 2290, + "key": "prod-vpn.example.com" + }, + { + "count": 2266, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 2123, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 1190, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 427, + "key": "NONE" + }, + { + "count": 412, + "key": "WoTrus RSA DV SSL CA 2" + }, + { + "count": 313, + "key": "WIN-9QFKHJ39QE9" + }, + { + "count": 312, + "key": "YR1" + }, + { + "count": 277, + "key": "QY" + }, + { + "count": 232, + "key": "YR2" + }, + { + "count": 211, + "key": "YE1" + }, + { + "count": 209, + "key": "YE2" + }, + { + "count": 172, + "key": "tls.internal.ypc.org" + } + ] + }, + "os": { + "total": 12308, + "buckets": [ + { + "count": 5600, + "key": "linux" + }, + { + "count": 538, + "key": "windows" + }, + { + "count": 86, + "key": "routeros" + }, + { + "count": 30, + "key": "ubuntu" + }, + { + "count": 22, + "key": "centos" + }, + { + "count": 19, + "key": "debian_linux" + }, + { + "count": 11, + "key": "adaptive_security_appliance_software" + }, + { + "count": 10, + "key": "proxmox" + }, + { + "count": 4, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "freebsd" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "junos" + }, + { + "count": 1, + "key": "netscaler" + }, + { + "count": 1, + "key": "pulse_connect_secure" + }, + { + "count": 1, + "key": "usg6655e_firmware" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "fields": { + "port": { + "total": 25632, + "buckets": [ + { + "count": 15454, + "key": "22" + }, + { + "count": 8555, + "key": "443" + }, + { + "count": 7568, + "key": "80" + }, + { + "count": 7553, + "key": "3389" + }, + { + "count": 1143, + "key": "5985" + }, + { + "count": 1122, + "key": "2096" + }, + { + "count": 951, + "key": "135" + }, + { + "count": 870, + "key": "8443" + }, + { + "count": 812, + "key": "445" + }, + { + "count": 782, + "key": "53" + }, + { + "count": 666, + "key": "25" + }, + { + "count": 615, + "key": "139" + }, + { + "count": 599, + "key": "8080" + }, + { + "count": 582, + "key": "21" + }, + { + "count": 545, + "key": "111" + } + ] + }, + "software": { + "total": 25632, + "buckets": [ + { + "count": 14517, + "key": "openssh" + }, + { + "count": 10237, + "key": "nginx" + }, + { + "count": 2654, + "key": "express" + }, + { + "count": 1598, + "key": "http_server" + }, + { + "count": 1224, + "key": "dovecot" + }, + { + "count": 1155, + "key": "http_api" + }, + { + "count": 997, + "key": "next.js" + }, + { + "count": 906, + "key": "google_web_services" + }, + { + "count": 895, + "key": "web_server" + }, + { + "count": 751, + "key": "caddy" + }, + { + "count": 690, + "key": "jquery" + }, + { + "count": 599, + "key": "internet_information_services" + }, + { + "count": 570, + "key": "php" + }, + { + "count": 566, + "key": "bootstrap" + }, + { + "count": 503, + "key": "python" + } + ] + }, + "labels": { + "total": 25632, + "buckets": [ + { + "count": 25632, + "key": "BULLETPROOF" + }, + { + "count": 206, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 25632, + "buckets": [ + { + "count": 2338, + "key": "YE2" + }, + { + "count": 1976, + "key": "YE1" + }, + { + "count": 993, + "key": "windows-Dallas0" + }, + { + "count": 985, + "key": "YR1" + }, + { + "count": 933, + "key": "YR2" + }, + { + "count": 915, + "key": "invalid2.invalid" + }, + { + "count": 481, + "key": "windows-Utah-4g" + }, + { + "count": 389, + "key": "windows-Amsterd" + }, + { + "count": 379, + "key": "www.example.com" + }, + { + "count": 351, + "key": "windows-Utah-4H" + }, + { + "count": 341, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 320, + "key": "windows-Utah-2g" + }, + { + "count": 288, + "key": "AnyDesk Client" + }, + { + "count": 278, + "key": "Plesk" + }, + { + "count": 238, + "key": "windows-LasVega" + } + ] + }, + "os": { + "total": 25632, + "buckets": [ + { + "count": 13719, + "key": "linux" + }, + { + "count": 5476, + "key": "windows" + }, + { + "count": 210, + "key": "ubuntu" + }, + { + "count": 135, + "key": "debian_linux" + }, + { + "count": 97, + "key": "routeros" + }, + { + "count": 30, + "key": "freebsd" + }, + { + "count": 21, + "key": "windows_server" + }, + { + "count": 19, + "key": "linux_kernel" + }, + { + "count": 8, + "key": "adaptive_security_appliance_software" + }, + { + "count": 7, + "key": "centos" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "proxmox" + }, + { + "count": 3, + "key": "windows_server_2012_r2" + }, + { + "count": 2, + "key": "openbsd" + }, + { + "count": 1, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "fields": { + "port": { + "total": 8797, + "buckets": [ + { + "count": 5381, + "key": "22" + }, + { + "count": 3417, + "key": "443" + }, + { + "count": 2110, + "key": "80" + }, + { + "count": 928, + "key": "51821" + }, + { + "count": 787, + "key": "53" + }, + { + "count": 641, + "key": "21" + }, + { + "count": 606, + "key": "2096" + }, + { + "count": 463, + "key": "25" + }, + { + "count": 455, + "key": "993" + }, + { + "count": 444, + "key": "143" + }, + { + "count": 428, + "key": "3306" + }, + { + "count": 416, + "key": "110" + }, + { + "count": 399, + "key": "587" + }, + { + "count": 369, + "key": "8443" + }, + { + "count": 348, + "key": "1500" + } + ] + }, + "software": { + "total": 8797, + "buckets": [ + { + "count": 4419, + "key": "openssh" + }, + { + "count": 3457, + "key": "nginx" + }, + { + "count": 1467, + "key": "dovecot" + }, + { + "count": 932, + "key": "exim" + }, + { + "count": 901, + "key": "wg-easy" + }, + { + "count": 711, + "key": "express" + }, + { + "count": 656, + "key": "google_web_services" + }, + { + "count": 656, + "key": "web_server" + }, + { + "count": 553, + "key": "ddos-guard" + }, + { + "count": 429, + "key": "http_server" + }, + { + "count": 390, + "key": "bind" + }, + { + "count": 338, + "key": "app_and_api_protector" + }, + { + "count": 338, + "key": "ghost" + }, + { + "count": 292, + "key": "php" + }, + { + "count": 283, + "key": "mysql" + } + ] + }, + "labels": { + "total": 8797, + "buckets": [ + { + "count": 8797, + "key": "BULLETPROOF" + }, + { + "count": 4, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 8797, + "buckets": [ + { + "count": 751, + "key": "YE2" + }, + { + "count": 710, + "key": "invalid2.invalid" + }, + { + "count": 618, + "key": "YE1" + }, + { + "count": 459, + "key": "GlobalSign GCC R6 AlphaSSL CA 2025" + }, + { + "count": 262, + "key": "idrac" + }, + { + "count": 231, + "key": "YR1" + }, + { + "count": 219, + "key": "YR2" + }, + { + "count": 216, + "key": "isp13.eurobyte.ru" + }, + { + "count": 193, + "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate" + }, + { + "count": 141, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 140, + "key": "vps1.dev.mchost.ru" + }, + { + "count": 116, + "key": "vps1.dev.eurobyte.ru" + }, + { + "count": 113, + "key": "etc" + }, + { + "count": 98, + "key": "isp15.eurobyte.ru" + }, + { + "count": 94, + "key": "GeoTrust TLS RSA CA G1" + } + ] + }, + "os": { + "total": 8797, + "buckets": [ + { + "count": 3705, + "key": "linux" + }, + { + "count": 190, + "key": "ubuntu" + }, + { + "count": 67, + "key": "routeros" + }, + { + "count": 53, + "key": "enterprise_linux" + }, + { + "count": 39, + "key": "debian_linux" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 11, + "key": "adaptive_security_appliance_software" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 3, + "key": "linux_ami" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "windows" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "fields": { + "port": { + "total": 8634, + "buckets": [ + { + "count": 4334, + "key": "443" + }, + { + "count": 4041, + "key": "22" + }, + { + "count": 3586, + "key": "161" + }, + { + "count": 2811, + "key": "80" + }, + { + "count": 1892, + "key": "123" + }, + { + "count": 1547, + "key": "53" + }, + { + "count": 845, + "key": "500" + }, + { + "count": 794, + "key": "21" + }, + { + "count": 793, + "key": "143" + }, + { + "count": 786, + "key": "993" + }, + { + "count": 783, + "key": "110" + }, + { + "count": 771, + "key": "25" + }, + { + "count": 660, + "key": "1194" + }, + { + "count": 627, + "key": "587" + }, + { + "count": 587, + "key": "8082" + } + ] + }, + "software": { + "total": 8634, + "buckets": [ + { + "count": 4673, + "key": "nginx" + }, + { + "count": 4060, + "key": "openssh" + }, + { + "count": 2414, + "key": "dovecot" + }, + { + "count": 1224, + "key": "exim" + }, + { + "count": 837, + "key": "cpanel" + }, + { + "count": 815, + "key": "openvpn_access_server" + }, + { + "count": 760, + "key": "http_server" + }, + { + "count": 757, + "key": "bind" + }, + { + "count": 601, + "key": "ceph" + }, + { + "count": 517, + "key": "webmail" + }, + { + "count": 374, + "key": "php" + }, + { + "count": 359, + "key": "proftpd" + }, + { + "count": 336, + "key": "express" + }, + { + "count": 326, + "key": "virtual_environment" + }, + { + "count": 324, + "key": "pve" + } + ] + }, + "labels": { + "total": 8634, + "buckets": [ + { + "count": 8634, + "key": "BULLETPROOF" + }, + { + "count": 38, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 8634, + "buckets": [ + { + "count": 1716, + "key": "server" + }, + { + "count": 1497, + "key": "YR2" + }, + { + "count": 894, + "key": "Hydra Authentication RSA SubCA #154" + }, + { + "count": 861, + "key": "YR1" + }, + { + "count": 773, + "key": "server.domain.com" + }, + { + "count": 523, + "key": "YE2" + }, + { + "count": 416, + "key": "YE1" + }, + { + "count": 342, + "key": "server.ibras.eu" + }, + { + "count": 278, + "key": "''" + }, + { + "count": 261, + "key": "invalid2.invalid" + }, + { + "count": 163, + "key": "Proxmox Virtual Environment" + }, + { + "count": 160, + "key": "Hydra Authentication RSA SubCA #156" + }, + { + "count": 142, + "key": "Plesk" + }, + { + "count": 110, + "key": "server.xtreme-results.net" + }, + { + "count": 99, + "key": "Hydra Authentication RSA SubCA #155" + } + ] + }, + "os": { + "total": 8634, + "buckets": [ + { + "count": 3027, + "key": "linux" + }, + { + "count": 201, + "key": "windows" + }, + { + "count": 156, + "key": "proxmox" + }, + { + "count": 129, + "key": "enterprise_linux" + }, + { + "count": 49, + "key": "ubuntu" + }, + { + "count": 41, + "key": "debian_linux" + }, + { + "count": 35, + "key": "freebsd" + }, + { + "count": 25, + "key": "centos" + }, + { + "count": 21, + "key": "routeros" + }, + { + "count": 17, + "key": "vmware_esxi_server" + }, + { + "count": 4, + "key": "idrac_linux" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "windows_server" + }, + { + "count": 3, + "key": "windows_server_2012_r2" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT-COMMUNICATIONS", + "fields": { + "port": { + "total": 7982, + "buckets": [ + { + "count": 6772, + "key": "22" + }, + { + "count": 3333, + "key": "443" + }, + { + "count": 1402, + "key": "80" + }, + { + "count": 1044, + "key": "2096" + }, + { + "count": 513, + "key": "8443" + }, + { + "count": 200, + "key": "2222" + }, + { + "count": 192, + "key": "8080" + }, + { + "count": 180, + "key": "2053" + }, + { + "count": 179, + "key": "3389" + }, + { + "count": 144, + "key": "25" + }, + { + "count": 115, + "key": "53" + }, + { + "count": 85, + "key": "8000" + }, + { + "count": 83, + "key": "500" + }, + { + "count": 82, + "key": "1080" + }, + { + "count": 79, + "key": "587" + } + ] + }, + "software": { + "total": 7982, + "buckets": [ + { + "count": 5827, + "key": "openssh" + }, + { + "count": 2076, + "key": "nginx" + }, + { + "count": 939, + "key": "google_web_services" + }, + { + "count": 937, + "key": "web_server" + }, + { + "count": 421, + "key": "app_and_api_protector" + }, + { + "count": 421, + "key": "ghost" + }, + { + "count": 281, + "key": "waf" + }, + { + "count": 274, + "key": "caddy" + }, + { + "count": 268, + "key": "cloudflare_load_balancer" + }, + { + "count": 219, + "key": "express" + }, + { + "count": 217, + "key": "traffic_server" + }, + { + "count": 157, + "key": "http_server" + }, + { + "count": 134, + "key": "bootstrap" + }, + { + "count": 134, + "key": "jquery" + }, + { + "count": 130, + "key": "dovecot" + } + ] + }, + "labels": { + "total": 7982, + "buckets": [ + { + "count": 7982, + "key": "BULLETPROOF" + }, + { + "count": 41, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 7982, + "buckets": [ + { + "count": 1110, + "key": "YE2" + }, + { + "count": 944, + "key": "invalid2.invalid" + }, + { + "count": 925, + "key": "YE1" + }, + { + "count": 281, + "key": "YR1" + }, + { + "count": 260, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 189, + "key": "YR2" + }, + { + "count": 127, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 103, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 99, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 98, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 96, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 93, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 82, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 81, + "key": "HARICA DV TLS RSA" + }, + { + "count": 68, + "key": "TRAEFIK DEFAULT CERT" + } + ] + }, + "os": { + "total": 7982, + "buckets": [ + { + "count": 5596, + "key": "linux" + }, + { + "count": 84, + "key": "ubuntu" + }, + { + "count": 47, + "key": "windows" + }, + { + "count": 27, + "key": "debian_linux" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 9, + "key": "adaptive_security_appliance_software" + }, + { + "count": 5, + "key": "freebsd" + }, + { + "count": 5, + "key": "linux_kernel" + }, + { + "count": 4, + "key": "centos" + }, + { + "count": 1, + "key": "linux_ami" + }, + { + "count": 1, + "key": "windows_server_2012" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "fields": { + "port": { + "total": 4692, + "buckets": [ + { + "count": 3082, + "key": "22" + }, + { + "count": 1914, + "key": "443" + }, + { + "count": 1900, + "key": "80" + }, + { + "count": 1295, + "key": "53" + }, + { + "count": 654, + "key": "21" + }, + { + "count": 592, + "key": "3000" + }, + { + "count": 506, + "key": "1500" + }, + { + "count": 497, + "key": "25" + }, + { + "count": 489, + "key": "65534" + }, + { + "count": 475, + "key": "993" + }, + { + "count": 466, + "key": "143" + }, + { + "count": 463, + "key": "587" + }, + { + "count": 457, + "key": "110" + }, + { + "count": 427, + "key": "1501" + }, + { + "count": 288, + "key": "2096" + } + ] + }, + "software": { + "total": 4692, + "buckets": [ + { + "count": 3541, + "key": "nginx" + }, + { + "count": 3202, + "key": "openssh" + }, + { + "count": 1488, + "key": "dovecot" + }, + { + "count": 1026, + "key": "bind" + }, + { + "count": 1015, + "key": "exim" + }, + { + "count": 514, + "key": "proftpd" + }, + { + "count": 363, + "key": "express" + }, + { + "count": 291, + "key": "python" + }, + { + "count": 227, + "key": "aiohttp" + }, + { + "count": 209, + "key": "caddy" + }, + { + "count": 180, + "key": "http_server" + }, + { + "count": 163, + "key": "bootstrap" + }, + { + "count": 143, + "key": "jquery" + }, + { + "count": 130, + "key": "next.js" + }, + { + "count": 116, + "key": "traefik_proxy" + } + ] + }, + "labels": { + "total": 4692, + "buckets": [ + { + "count": 4692, + "key": "BULLETPROOF" + }, + { + "count": 10, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 4692, + "buckets": [ + { + "count": 598, + "key": "YR1" + }, + { + "count": 553, + "key": "YR2" + }, + { + "count": 552, + "key": "YE2" + }, + { + "count": 480, + "key": "YE1" + }, + { + "count": 309, + "key": "ssl.by" + }, + { + "count": 238, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 191, + "key": "HARICA DV TLS RSA" + }, + { + "count": 155, + "key": "issssrt.ru" + }, + { + "count": 116, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 98, + "key": "invalid2.invalid" + }, + { + "count": 82, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 81, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 53, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 49, + "key": "etc" + }, + { + "count": 46, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + } + ] + }, + "os": { + "total": 4692, + "buckets": [ + { + "count": 2914, + "key": "linux" + }, + { + "count": 57, + "key": "windows" + }, + { + "count": 52, + "key": "ubuntu" + }, + { + "count": 38, + "key": "enterprise_linux" + }, + { + "count": 25, + "key": "debian_linux" + }, + { + "count": 20, + "key": "routeros" + }, + { + "count": 8, + "key": "freebsd" + }, + { + "count": 4, + "key": "centos" + }, + { + "count": 4, + "key": "windows_server" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 1, + "key": "ios" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "fields": { + "port": { + "total": 2005, + "buckets": [ + { + "count": 841, + "key": "22" + }, + { + "count": 357, + "key": "80" + }, + { + "count": 275, + "key": "443" + }, + { + "count": 121, + "key": "3389" + }, + { + "count": 100, + "key": "1407" + }, + { + "count": 99, + "key": "11407" + }, + { + "count": 87, + "key": "135" + }, + { + "count": 85, + "key": "445" + }, + { + "count": 80, + "key": "5985" + }, + { + "count": 79, + "key": "139" + }, + { + "count": 74, + "key": "53" + }, + { + "count": 73, + "key": "8080" + }, + { + "count": 69, + "key": "2096" + }, + { + "count": 64, + "key": "47001" + }, + { + "count": 61, + "key": "6239" + } + ] + }, + "software": { + "total": 2005, + "buckets": [ + { + "count": 753, + "key": "openssh" + }, + { + "count": 398, + "key": "nginx" + }, + { + "count": 185, + "key": "http_server" + }, + { + "count": 110, + "key": "http_api" + }, + { + "count": 102, + "key": "express" + }, + { + "count": 72, + "key": "php" + }, + { + "count": 56, + "key": "python" + }, + { + "count": 43, + "key": "dovecot" + }, + { + "count": 43, + "key": "pve" + }, + { + "count": 42, + "key": "next.js" + }, + { + "count": 42, + "key": "virtual_environment" + }, + { + "count": 35, + "key": "node_exporter" + }, + { + "count": 35, + "key": "simplehttp" + }, + { + "count": 30, + "key": "drupal" + }, + { + "count": 30, + "key": "tinyproxy" + } + ] + }, + "labels": { + "total": 2005, + "buckets": [ + { + "count": 2005, + "key": "BULLETPROOF" + }, + { + "count": 15, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 2005, + "buckets": [ + { + "count": 124, + "key": "YE1" + }, + { + "count": 109, + "key": "YE2" + }, + { + "count": 49, + "key": "YR2" + }, + { + "count": 31, + "key": "YR1" + }, + { + "count": 27, + "key": "WIN-9QL4SDRB93L" + }, + { + "count": 21, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 18, + "key": "Proxmox Virtual Environment" + }, + { + "count": 17, + "key": "WIN-IK7N6SD2UBU" + }, + { + "count": 17, + "key": "localhost" + }, + { + "count": 11, + "key": "Cloudbase-Init WinRM" + }, + { + "count": 11, + "key": "invalid2.invalid" + }, + { + "count": 10, + "key": "hosting12.coolsshservers.com" + }, + { + "count": 9, + "key": "WIN-OU0SUKQBJN2" + }, + { + "count": 9, + "key": "imap.example.com" + }, + { + "count": 9, + "key": "srv1.dedusapp.icu" + } + ] + }, + "os": { + "total": 2005, + "buckets": [ + { + "count": 678, + "key": "linux" + }, + { + "count": 82, + "key": "windows" + }, + { + "count": 36, + "key": "debian_linux" + }, + { + "count": 19, + "key": "proxmox" + }, + { + "count": 14, + "key": "ubuntu" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "vmware_esxi_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "fields": { + "port": { + "total": 7681, + "buckets": [ + { + "count": 6701, + "key": "22" + }, + { + "count": 4574, + "key": "443" + }, + { + "count": 2232, + "key": "2222" + }, + { + "count": 2163, + "key": "80" + }, + { + "count": 775, + "key": "8443" + }, + { + "count": 678, + "key": "2096" + }, + { + "count": 371, + "key": "3389" + }, + { + "count": 236, + "key": "8080" + }, + { + "count": 199, + "key": "2053" + }, + { + "count": 171, + "key": "9443" + }, + { + "count": 129, + "key": "3000" + }, + { + "count": 124, + "key": "4443" + }, + { + "count": 93, + "key": "8000" + }, + { + "count": 89, + "key": "445" + }, + { + "count": 81, + "key": "2083" + } + ] + }, + "software": { + "total": 7681, + "buckets": [ + { + "count": 6428, + "key": "openssh" + }, + { + "count": 3432, + "key": "nginx" + }, + { + "count": 643, + "key": "caddy" + }, + { + "count": 479, + "key": "google_web_services" + }, + { + "count": 479, + "key": "web_server" + }, + { + "count": 449, + "key": "app_and_api_protector" + }, + { + "count": 449, + "key": "ghost" + }, + { + "count": 297, + "key": "waf" + }, + { + "count": 285, + "key": "cloudflare_load_balancer" + }, + { + "count": 261, + "key": "express" + }, + { + "count": 235, + "key": "next.js" + }, + { + "count": 200, + "key": "openresty" + }, + { + "count": 188, + "key": "uvicorn" + }, + { + "count": 132, + "key": "http_server" + }, + { + "count": 127, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 7681, + "buckets": [ + { + "count": 7681, + "key": "BULLETPROOF" + }, + { + "count": 18, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 7681, + "buckets": [ + { + "count": 1384, + "key": "YE2" + }, + { + "count": 1093, + "key": "YE1" + }, + { + "count": 775, + "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo" + }, + { + "count": 498, + "key": "invalid2.invalid" + }, + { + "count": 310, + "key": "NvJhHp68p5mjSuW_EK9Lab6bH9" + }, + { + "count": 300, + "key": "GlobalSign Atlas R3 DV TLS CA 2026 Q2" + }, + { + "count": 235, + "key": "YR1" + }, + { + "count": 227, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 220, + "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5" + }, + { + "count": 188, + "key": "YR2" + }, + { + "count": 181, + "key": "HARICA DV TLS RSA" + }, + { + "count": 145, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 139, + "key": "WR1" + }, + { + "count": 122, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 110, + "key": "GlobalSign ECC OV SSL CA 2018" + } + ] + }, + "os": { + "total": 7681, + "buckets": [ + { + "count": 6310, + "key": "linux" + }, + { + "count": 65, + "key": "ubuntu" + }, + { + "count": 65, + "key": "windows" + }, + { + "count": 12, + "key": "debian_linux" + }, + { + "count": 10, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "enterprise_linux" + }, + { + "count": 1, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "fields": { + "port": { + "total": 6960, + "buckets": [ + { + "count": 5620, + "key": "22" + }, + { + "count": 4211, + "key": "443" + }, + { + "count": 3289, + "key": "80" + }, + { + "count": 688, + "key": "8443" + }, + { + "count": 657, + "key": "2096" + }, + { + "count": 389, + "key": "8080" + }, + { + "count": 331, + "key": "2222" + }, + { + "count": 305, + "key": "3389" + }, + { + "count": 194, + "key": "3000" + }, + { + "count": 172, + "key": "3478" + }, + { + "count": 162, + "key": "25" + }, + { + "count": 162, + "key": "53" + }, + { + "count": 130, + "key": "2053" + }, + { + "count": 128, + "key": "993" + }, + { + "count": 127, + "key": "5985" + } + ] + }, + "software": { + "total": 6960, + "buckets": [ + { + "count": 5168, + "key": "openssh" + }, + { + "count": 4990, + "key": "nginx" + }, + { + "count": 672, + "key": "caddy" + }, + { + "count": 498, + "key": "express" + }, + { + "count": 455, + "key": "next.js" + }, + { + "count": 271, + "key": "dovecot" + }, + { + "count": 240, + "key": "ghost" + }, + { + "count": 239, + "key": "app_and_api_protector" + }, + { + "count": 235, + "key": "traefik_proxy" + }, + { + "count": 183, + "key": "fastpanel" + }, + { + "count": 182, + "key": "waf" + }, + { + "count": 177, + "key": "http_server" + }, + { + "count": 175, + "key": "uvicorn" + }, + { + "count": 174, + "key": "google_web_services" + }, + { + "count": 174, + "key": "web_server" + } + ] + }, + "labels": { + "total": 6960, + "buckets": [ + { + "count": 6960, + "key": "BULLETPROOF" + }, + { + "count": 133, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 6960, + "buckets": [ + { + "count": 1428, + "key": "YE2" + }, + { + "count": 1332, + "key": "YE1" + }, + { + "count": 261, + "key": "YR1" + }, + { + "count": 235, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 231, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 224, + "key": "HARICA DV TLS RSA" + }, + { + "count": 180, + "key": "invalid2.invalid" + }, + { + "count": 176, + "key": "YR2" + }, + { + "count": 143, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 128, + "key": "WR1" + }, + { + "count": 86, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 85, + "key": "etc" + }, + { + "count": 81, + "key": "WIN-4NFSE1QOBMS" + }, + { + "count": 69, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 58, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + } + ] + }, + "os": { + "total": 6960, + "buckets": [ + { + "count": 5015, + "key": "linux" + }, + { + "count": 246, + "key": "ubuntu" + }, + { + "count": 134, + "key": "windows" + }, + { + "count": 31, + "key": "debian_linux" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 7, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "windows_server" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "freebsd" + }, + { + "count": 1, + "key": "megarac_spx" + }, + { + "count": 1, + "key": "windows_server_2012_r2" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "fields": { + "port": { + "total": 3824, + "buckets": [ + { + "count": 2849, + "key": "22" + }, + { + "count": 2126, + "key": "443" + }, + { + "count": 1919, + "key": "80" + }, + { + "count": 385, + "key": "53" + }, + { + "count": 281, + "key": "25" + }, + { + "count": 235, + "key": "587" + }, + { + "count": 222, + "key": "993" + }, + { + "count": 192, + "key": "111" + }, + { + "count": 185, + "key": "143" + }, + { + "count": 167, + "key": "110" + }, + { + "count": 162, + "key": "8080" + }, + { + "count": 144, + "key": "2096" + }, + { + "count": 143, + "key": "8443" + }, + { + "count": 135, + "key": "21" + }, + { + "count": 97, + "key": "9001" + } + ] + }, + "software": { + "total": 3824, + "buckets": [ + { + "count": 2797, + "key": "nginx" + }, + { + "count": 2571, + "key": "openssh" + }, + { + "count": 554, + "key": "dovecot" + }, + { + "count": 449, + "key": "http_server" + }, + { + "count": 357, + "key": "cpanel" + }, + { + "count": 288, + "key": "express" + }, + { + "count": 270, + "key": "caddy" + }, + { + "count": 255, + "key": "exim" + }, + { + "count": 251, + "key": "openresty" + }, + { + "count": 197, + "key": "authoritative_server" + }, + { + "count": 183, + "key": "next.js" + }, + { + "count": 166, + "key": "jquery" + }, + { + "count": 159, + "key": "postfix" + }, + { + "count": 157, + "key": "webmail" + }, + { + "count": 133, + "key": "traefik_proxy" + } + ] + }, + "labels": { + "total": 3824, + "buckets": [ + { + "count": 3824, + "key": "BULLETPROOF" + }, + { + "count": 130, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 3824, + "buckets": [ + { + "count": 705, + "key": "YE1" + }, + { + "count": 650, + "key": "YE2" + }, + { + "count": 599, + "key": "YR2" + }, + { + "count": 580, + "key": "YR1" + }, + { + "count": 133, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 102, + "key": "invalid2.invalid" + }, + { + "count": 59, + "key": "localhost" + }, + { + "count": 41, + "key": "www.example.com" + }, + { + "count": 40, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 34, + "key": "fin01.m-cr.org" + }, + { + "count": 30, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 28, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 26, + "key": "protect@DDoS-Filter.domain" + }, + { + "count": 25, + "key": "E7" + }, + { + "count": 25, + "key": "Proxmox Virtual Environment" + } + ] + }, + "os": { + "total": 3824, + "buckets": [ + { + "count": 2155, + "key": "linux" + }, + { + "count": 65, + "key": "ubuntu" + }, + { + "count": 45, + "key": "debian_linux" + }, + { + "count": 30, + "key": "proxmox" + }, + { + "count": 24, + "key": "windows" + }, + { + "count": 10, + "key": "freebsd" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "openbsd" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 3, + "key": "windows_server_2008_r2" + }, + { + "count": 1, + "key": "ilo_3" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "openmediavault" + }, + { + "count": 1, + "key": "sonicos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "fields": { + "port": { + "total": 2178, + "buckets": [ + { + "count": 1274, + "key": "22" + }, + { + "count": 855, + "key": "443" + }, + { + "count": 651, + "key": "80" + }, + { + "count": 476, + "key": "53" + }, + { + "count": 379, + "key": "27015" + }, + { + "count": 300, + "key": "3389" + }, + { + "count": 122, + "key": "8443" + }, + { + "count": 120, + "key": "25" + }, + { + "count": 99, + "key": "2096" + }, + { + "count": 80, + "key": "8080" + }, + { + "count": 63, + "key": "135" + }, + { + "count": 61, + "key": "111" + }, + { + "count": 61, + "key": "5985" + }, + { + "count": 55, + "key": "445" + }, + { + "count": 52, + "key": "2222" + } + ] + }, + "software": { + "total": 2178, + "buckets": [ + { + "count": 1148, + "key": "openssh" + }, + { + "count": 850, + "key": "nginx" + }, + { + "count": 201, + "key": "express" + }, + { + "count": 134, + "key": "http_server" + }, + { + "count": 104, + "key": "google_web_services" + }, + { + "count": 104, + "key": "web_server" + }, + { + "count": 100, + "key": "http_api" + }, + { + "count": 92, + "key": "dovecot" + }, + { + "count": 73, + "key": "next.js" + }, + { + "count": 70, + "key": "caddy" + }, + { + "count": 70, + "key": "postfix" + }, + { + "count": 69, + "key": "app_and_api_protector" + }, + { + "count": 69, + "key": "ghost" + }, + { + "count": 67, + "key": "cloudflare_load_balancer" + }, + { + "count": 67, + "key": "waf" + } + ] + }, + "labels": { + "total": 2178, + "buckets": [ + { + "count": 2178, + "key": "BULLETPROOF" + }, + { + "count": 29, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 2178, + "buckets": [ + { + "count": 237, + "key": "YE2" + }, + { + "count": 222, + "key": "YE1" + }, + { + "count": 112, + "key": "invalid2.invalid" + }, + { + "count": 99, + "key": "YR2" + }, + { + "count": 83, + "key": "YR1" + }, + { + "count": 60, + "key": "windows-DE-Fran" + }, + { + "count": 57, + "key": "172.86.93" + }, + { + "count": 52, + "key": "GoGetSSL RSA DV CA" + }, + { + "count": 51, + "key": "windows-Frankfu" + }, + { + "count": 27, + "key": "localhost" + }, + { + "count": 25, + "key": "WIN-8OA3CCQAE4D" + }, + { + "count": 24, + "key": "Plesk" + }, + { + "count": 22, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 21, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 21, + "key": "RapidSSL TLS RSA CA G1" + } + ] + }, + "os": { + "total": 2178, + "buckets": [ + { + "count": 1080, + "key": "linux" + }, + { + "count": 159, + "key": "windows" + }, + { + "count": 20, + "key": "proxmox" + }, + { + "count": 19, + "key": "routeros" + }, + { + "count": 15, + "key": "ubuntu" + }, + { + "count": 14, + "key": "debian_linux" + }, + { + "count": 9, + "key": "centos" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "megarac_spx" + }, + { + "count": 3, + "key": "windows_server" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "vmware_esxi_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "fields": { + "port": { + "total": 6562, + "buckets": [ + { + "count": 4367, + "key": "443" + }, + { + "count": 4199, + "key": "80" + }, + { + "count": 2445, + "key": "22" + }, + { + "count": 1504, + "key": "4667" + }, + { + "count": 510, + "key": "0" + }, + { + "count": 376, + "key": "6004" + }, + { + "count": 376, + "key": "6011" + }, + { + "count": 375, + "key": "6001" + }, + { + "count": 375, + "key": "6006" + }, + { + "count": 375, + "key": "6007" + }, + { + "count": 375, + "key": "6010" + }, + { + "count": 375, + "key": "6012" + }, + { + "count": 375, + "key": "6013" + }, + { + "count": 375, + "key": "6014" + }, + { + "count": 375, + "key": "6016" + } + ] + }, + "software": { + "total": 6562, + "buckets": [ + { + "count": 8935, + "key": "nginx" + }, + { + "count": 3801, + "key": "openssh" + }, + { + "count": 140, + "key": "openresty" + }, + { + "count": 125, + "key": "http_api" + }, + { + "count": 80, + "key": "jquery" + }, + { + "count": 76, + "key": "internet_information_services" + }, + { + "count": 56, + "key": "tengine" + }, + { + "count": 52, + "key": "bootstrap" + }, + { + "count": 41, + "key": "node_exporter" + }, + { + "count": 36, + "key": "express" + }, + { + "count": 34, + "key": "app_and_api_protector" + }, + { + "count": 34, + "key": "ghost" + }, + { + "count": 34, + "key": "wordpress" + }, + { + "count": 29, + "key": "python" + }, + { + "count": 28, + "key": "http_server" + } + ] + }, + "labels": { + "total": 6562, + "buckets": [ + { + "count": 6562, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 6562, + "buckets": [ + { + "count": 3804, + "key": "USDTCDN" + }, + { + "count": 347, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 182, + "key": "NONE" + }, + { + "count": 132, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 123, + "key": "tudog_node_agent._reserved.bytefcdn.com" + }, + { + "count": 108, + "key": "RTCTS" + }, + { + "count": 97, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 97, + "key": "QY" + }, + { + "count": 65, + "key": "RapidSSL TLS ECC CA G1" + }, + { + "count": 61, + "key": "tls.internal.ypc.org" + }, + { + "count": 48, + "key": "SG CA" + }, + { + "count": 47, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 34, + "key": "YR1" + }, + { + "count": 33, + "key": "Root CA" + }, + { + "count": 32, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + } + ] + }, + "os": { + "total": 6562, + "buckets": [ + { + "count": 1100, + "key": "linux" + }, + { + "count": 94, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "windows_server_2008_r2" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "proxmox" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "fields": { + "port": { + "total": 744, + "buckets": [ + { + "count": 564, + "key": "80" + }, + { + "count": 559, + "key": "22" + }, + { + "count": 363, + "key": "443" + }, + { + "count": 103, + "key": "21" + }, + { + "count": 99, + "key": "53" + }, + { + "count": 97, + "key": "25" + }, + { + "count": 90, + "key": "587" + }, + { + "count": 89, + "key": "143" + }, + { + "count": 89, + "key": "993" + }, + { + "count": 87, + "key": "8085" + }, + { + "count": 86, + "key": "110" + }, + { + "count": 86, + "key": "22509" + }, + { + "count": 78, + "key": "3389" + }, + { + "count": 49, + "key": "8888" + }, + { + "count": 41, + "key": "7777" + } + ] + }, + "software": { + "total": 744, + "buckets": [ + { + "count": 841, + "key": "nginx" + }, + { + "count": 610, + "key": "openssh" + }, + { + "count": 296, + "key": "express" + }, + { + "count": 228, + "key": "dovecot" + }, + { + "count": 173, + "key": "fastpanel" + }, + { + "count": 155, + "key": "exim" + }, + { + "count": 107, + "key": "next.js" + }, + { + "count": 84, + "key": "http_server" + }, + { + "count": 62, + "key": "proftpd" + }, + { + "count": 40, + "key": "http_api" + }, + { + "count": 29, + "key": "bootstrap" + }, + { + "count": 25, + "key": "php" + }, + { + "count": 25, + "key": "uvicorn" + }, + { + "count": 21, + "key": "jquery" + }, + { + "count": 20, + "key": "bind" + } + ] + }, + "labels": { + "total": 744, + "buckets": [ + { + "count": 744, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 744, + "buckets": [ + { + "count": 110, + "key": "etc" + }, + { + "count": 58, + "key": "YR1" + }, + { + "count": 55, + "key": "YR2" + }, + { + "count": 52, + "key": "vm4660.defhost.co" + }, + { + "count": 45, + "key": "FASTPANEL" + }, + { + "count": 43, + "key": "parking" + }, + { + "count": 39, + "key": "YE2" + }, + { + "count": 34, + "key": "YE1" + }, + { + "count": 30, + "key": "misp.goodip" + }, + { + "count": 14, + "key": "vm4980.defhost.co" + }, + { + "count": 12, + "key": "tech0.test" + }, + { + "count": 10, + "key": "localhost" + }, + { + "count": 9, + "key": "amgel.yop.nail" + }, + { + "count": 9, + "key": "def.host.vm" + }, + { + "count": 9, + "key": "info.devser.loc" + } + ] + }, + "os": { + "total": 744, + "buckets": [ + { + "count": 538, + "key": "linux" + }, + { + "count": 34, + "key": "windows" + }, + { + "count": 6, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "ubuntu" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + }, + { + "count": 1, + "key": "windows_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "fields": { + "port": { + "total": 359, + "buckets": [ + { + "count": 167, + "key": "22" + }, + { + "count": 163, + "key": "3389" + }, + { + "count": 84, + "key": "80" + }, + { + "count": 81, + "key": "443" + }, + { + "count": 53, + "key": "135" + }, + { + "count": 42, + "key": "137" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 37, + "key": "5985" + }, + { + "count": 36, + "key": "139" + }, + { + "count": 24, + "key": "21" + }, + { + "count": 24, + "key": "123" + }, + { + "count": 24, + "key": "47001" + }, + { + "count": 22, + "key": "25" + }, + { + "count": 20, + "key": "993" + }, + { + "count": 19, + "key": "110" + } + ] + }, + "software": { + "total": 359, + "buckets": [ + { + "count": 125, + "key": "openssh" + }, + { + "count": 124, + "key": "nginx" + }, + { + "count": 60, + "key": "dovecot" + }, + { + "count": 43, + "key": "http_api" + }, + { + "count": 33, + "key": "express" + }, + { + "count": 31, + "key": "fastpanel" + }, + { + "count": 30, + "key": "http_server" + }, + { + "count": 24, + "key": "exim" + }, + { + "count": 23, + "key": "requirejs" + }, + { + "count": 20, + "key": "parallels_plesk_panel" + }, + { + "count": 20, + "key": "prototype" + }, + { + "count": 17, + "key": "proftpd" + }, + { + "count": 14, + "key": "plesk" + }, + { + "count": 12, + "key": "bind" + }, + { + "count": 11, + "key": "postfix" + } + ] + }, + "labels": { + "total": 359, + "buckets": [ + { + "count": 359, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 359, + "buckets": [ + { + "count": 23, + "key": "Plesk" + }, + { + "count": 19, + "key": "YR1" + }, + { + "count": 19, + "key": "etc" + }, + { + "count": 11, + "key": "localhost" + }, + { + "count": 9, + "key": "AnyDesk Client" + }, + { + "count": 9, + "key": "R11" + }, + { + "count": 8, + "key": "FASTPANEL" + }, + { + "count": 8, + "key": "R12" + }, + { + "count": 8, + "key": "parking" + }, + { + "count": 7, + "key": "YR2" + }, + { + "count": 7, + "key": "dev-1.secure.host" + }, + { + "count": 6, + "key": "akrud-1.example.com" + }, + { + "count": 6, + "key": "mail.the-slasher.com" + }, + { + "count": 6, + "key": "xmoney-1.example.com" + }, + { + "count": 5, + "key": "DESKTOP-TCRDU4C" + } + ] + }, + "os": { + "total": 359, + "buckets": [ + { + "count": 118, + "key": "linux" + }, + { + "count": 40, + "key": "windows" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 2, + "key": "ubuntu" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "freenas_firmware" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "routeros" + }, + { + "count": 1, + "key": "vmware_esxi_server" + }, + { + "count": 1, + "key": "windows_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "fields": { + "port": { + "total": 340, + "buckets": [ + { + "count": 193, + "key": "22" + }, + { + "count": 133, + "key": "3389" + }, + { + "count": 107, + "key": "80" + }, + { + "count": 80, + "key": "443" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 29, + "key": "135" + }, + { + "count": 26, + "key": "5985" + }, + { + "count": 22, + "key": "21" + }, + { + "count": 21, + "key": "25" + }, + { + "count": 21, + "key": "143" + }, + { + "count": 21, + "key": "993" + }, + { + "count": 19, + "key": "110" + }, + { + "count": 17, + "key": "137" + }, + { + "count": 17, + "key": "139" + }, + { + "count": 16, + "key": "8443" + } + ] + }, + "software": { + "total": 340, + "buckets": [ + { + "count": 141, + "key": "nginx" + }, + { + "count": 133, + "key": "openssh" + }, + { + "count": 59, + "key": "dovecot" + }, + { + "count": 34, + "key": "http_server" + }, + { + "count": 32, + "key": "parallels_plesk_panel" + }, + { + "count": 32, + "key": "prototype" + }, + { + "count": 32, + "key": "requirejs" + }, + { + "count": 29, + "key": "http_api" + }, + { + "count": 27, + "key": "express" + }, + { + "count": 22, + "key": "plesk" + }, + { + "count": 21, + "key": "exim" + }, + { + "count": 15, + "key": "cpanel" + }, + { + "count": 14, + "key": "proftpd" + }, + { + "count": 11, + "key": "postfix" + }, + { + "count": 10, + "key": "authoritative_server" + } + ] + }, + "labels": { + "total": 340, + "buckets": [ + { + "count": 340, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 340, + "buckets": [ + { + "count": 37, + "key": "Plesk" + }, + { + "count": 36, + "key": "YR1" + }, + { + "count": 27, + "key": "YR2" + }, + { + "count": 9, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 9, + "key": "YE1" + }, + { + "count": 8, + "key": "R13" + }, + { + "count": 8, + "key": "blankilamalice-4.example.com" + }, + { + "count": 8, + "key": "devin-coo-1.example.com" + }, + { + "count": 7, + "key": "DESKTOP-GKGI28A" + }, + { + "count": 7, + "key": "R12" + }, + { + "count": 7, + "key": "ads-grab-2.example.com" + }, + { + "count": 7, + "key": "ckicksp-1.example.com" + }, + { + "count": 5, + "key": "benjamin-b-2.example.com" + }, + { + "count": 4, + "key": "AnyDesk Client" + }, + { + "count": 4, + "key": "etc" + } + ] + }, + "os": { + "total": 340, + "buckets": [ + { + "count": 133, + "key": "linux" + }, + { + "count": 25, + "key": "windows" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "ubuntu" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS214940", + "name": "KPRONET", + "fields": { + "port": { + "total": 0, + "buckets": [] + }, + "software": { + "total": 0, + "buckets": [] + }, + "labels": { + "total": 0, + "buckets": [] + }, + "cert_issuer": { + "total": 0, + "buckets": [] + }, + "os": { + "total": 0, + "buckets": [] + } + }, + "errors": [] + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "fields": { + "port": { + "total": 15, + "buckets": [ + { + "count": 5, + "key": "443" + }, + { + "count": 3, + "key": "22" + }, + { + "count": 2, + "key": "80" + }, + { + "count": 1, + "key": "111" + }, + { + "count": 1, + "key": "137" + }, + { + "count": 1, + "key": "3389" + }, + { + "count": 1, + "key": "5900" + }, + { + "count": 1, + "key": "5902" + }, + { + "count": 1, + "key": "5903" + }, + { + "count": 1, + "key": "8080" + } + ] + }, + "software": { + "total": 15, + "buckets": [ + { + "count": 4, + "key": "nginx" + }, + { + "count": 2, + "key": "openssh" + } + ] + }, + "labels": { + "total": 15, + "buckets": [ + { + "count": 15, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 15, + "buckets": [ + { + "count": 2, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1, + "key": "WIN-UKID351J32A" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "invalid2.invalid" + } + ] + }, + "os": { + "total": 15, + "buckets": [ + { + "count": 1, + "key": "linux" + }, + { + "count": 1, + "key": "routeros" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS211720", + "name": "Datashield", + "fields": { + "port": { + "total": 49, + "buckets": [ + { + "count": 28, + "key": "22" + }, + { + "count": 18, + "key": "3389" + }, + { + "count": 14, + "key": "179" + }, + { + "count": 9, + "key": "80" + }, + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "111" + }, + { + "count": 6, + "key": "5985" + }, + { + "count": 3, + "key": "8080" + }, + { + "count": 3, + "key": "8081" + }, + { + "count": 2, + "key": "135" + }, + { + "count": 2, + "key": "137" + }, + { + "count": 2, + "key": "5357" + }, + { + "count": 1, + "key": "53" + }, + { + "count": 1, + "key": "139" + }, + { + "count": 1, + "key": "445" + } + ] + }, + "software": { + "total": 49, + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 11, + "key": "nginx" + }, + { + "count": 6, + "key": "http_api" + }, + { + "count": 2, + "key": "next.js" + }, + { + "count": 2, + "key": "tor" + }, + { + "count": 1, + "key": "caddy" + }, + { + "count": 1, + "key": "dropbear_ssh" + }, + { + "count": 1, + "key": "gunicorn" + }, + { + "count": 1, + "key": "http_server" + }, + { + "count": 1, + "key": "libupnp" + }, + { + "count": 1, + "key": "mariadb" + } + ] + }, + "labels": { + "total": 49, + "buckets": [ + { + "count": 49, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 49, + "buckets": [ + { + "count": 3, + "key": "IPMI" + }, + { + "count": 2, + "key": "FREE" + }, + { + "count": 2, + "key": "YE1" + }, + { + "count": 1, + "key": "WIN-JDCEOBUFJUS" + }, + { + "count": 1, + "key": "WIN-JP7KUDECHOR" + }, + { + "count": 1, + "key": "YE2" + }, + { + "count": 1, + "key": "YR2" + }, + { + "count": 1, + "key": "agent-ca@1757674441" + }, + { + "count": 1, + "key": "agent-ca@1757925038" + }, + { + "count": 1, + "key": "agent-ca@1759158944" + }, + { + "count": 1, + "key": "bad-raven-crab" + }, + { + "count": 1, + "key": "bright-magenta-" + }, + { + "count": 1, + "key": "eth0" + }, + { + "count": 1, + "key": "gentle-red-bee" + }, + { + "count": 1, + "key": "greedy-cream-ha" + } + ] + }, + "os": { + "total": 49, + "buckets": [ + { + "count": 10, + "key": "linux" + }, + { + "count": 4, + "key": "windows" + }, + { + "count": 1, + "key": "debian_linux" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "fields": { + "port": { + "total": 37, + "buckets": [ + { + "count": 35, + "key": "22" + }, + { + "count": 13, + "key": "80" + }, + { + "count": 8, + "key": "443" + }, + { + "count": 4, + "key": "111" + }, + { + "count": 2, + "key": "25" + }, + { + "count": 2, + "key": "53" + }, + { + "count": 2, + "key": "110" + }, + { + "count": 2, + "key": "143" + }, + { + "count": 2, + "key": "161" + }, + { + "count": 2, + "key": "993" + }, + { + "count": 2, + "key": "3306" + }, + { + "count": 2, + "key": "4190" + }, + { + "count": 2, + "key": "5060" + }, + { + "count": 2, + "key": "8087" + }, + { + "count": 2, + "key": "8443" + } + ] + }, + "software": { + "total": 37, + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 16, + "key": "nginx" + }, + { + "count": 10, + "key": "http_server" + }, + { + "count": 9, + "key": "express" + }, + { + "count": 7, + "key": "dovecot" + }, + { + "count": 6, + "key": "bootstrap" + }, + { + "count": 6, + "key": "php" + }, + { + "count": 5, + "key": "prototype" + }, + { + "count": 4, + "key": "jquery" + }, + { + "count": 4, + "key": "openssl" + }, + { + "count": 3, + "key": "parallels_plesk_panel" + }, + { + "count": 3, + "key": "requirejs" + }, + { + "count": 2, + "key": "lodash" + }, + { + "count": 2, + "key": "plesk" + }, + { + "count": 2, + "key": "pve" + } + ] + }, + "labels": { + "total": 37, + "buckets": [ + { + "count": 37, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 37, + "buckets": [ + { + "count": 11, + "key": "YR2" + }, + { + "count": 4, + "key": "Plesk" + }, + { + "count": 3, + "key": "YR1" + }, + { + "count": 2, + "key": "YE1" + }, + { + "count": 2, + "key": "YE2" + }, + { + "count": 2, + "key": "pbx.invisiontech.eu" + }, + { + "count": 1, + "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate" + }, + { + "count": 1, + "key": "OpenWrt" + }, + { + "count": 1, + "key": "www.fxzjqfcj6dilr.com" + } + ] + }, + "os": { + "total": 37, + "buckets": [ + { + "count": 12, + "key": "linux" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "proxmox" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS58854", + "name": "KAOPY", + "fields": { + "port": { + "total": 614, + "buckets": [ + { + "count": 181, + "key": "8887" + }, + { + "count": 175, + "key": "80" + }, + { + "count": 158, + "key": "443" + }, + { + "count": 113, + "key": "0" + }, + { + "count": 85, + "key": "18893" + }, + { + "count": 84, + "key": "18891" + }, + { + "count": 79, + "key": "111" + }, + { + "count": 78, + "key": "8888" + }, + { + "count": 77, + "key": "8081" + }, + { + "count": 74, + "key": "18890" + }, + { + "count": 74, + "key": "18892" + }, + { + "count": 74, + "key": "25001" + }, + { + "count": 73, + "key": "16257" + }, + { + "count": 73, + "key": "16259" + }, + { + "count": 73, + "key": "26257" + } + ] + }, + "software": { + "total": 614, + "buckets": [ + { + "count": 1191, + "key": "mysql" + }, + { + "count": 402, + "key": "nginx" + }, + { + "count": 291, + "key": "python" + }, + { + "count": 173, + "key": "wsgiserver" + }, + { + "count": 165, + "key": "jquery" + }, + { + "count": 155, + "key": "bootstrap" + }, + { + "count": 115, + "key": "simplehttp" + }, + { + "count": 103, + "key": "node_exporter" + }, + { + "count": 79, + "key": "openssh" + }, + { + "count": 77, + "key": "kestrel_web_server" + }, + { + "count": 76, + "key": "cadvisor" + }, + { + "count": 41, + "key": "http_api" + }, + { + "count": 36, + "key": "tengine" + }, + { + "count": 24, + "key": "openresty" + }, + { + "count": 16, + "key": "internet_information_services" + } + ] + }, + "labels": { + "total": 614, + "buckets": [ + { + "count": 614, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 614, + "buckets": [ + { + "count": 47, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 12, + "key": "TrustAsia DV TLS RSA CA 2025" + }, + { + "count": 11, + "key": "YR1" + }, + { + "count": 10, + "key": "FtpServer" + }, + { + "count": 8, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 7, + "key": "TrustAsia DV TLS RSA CA 2024" + }, + { + "count": 5, + "key": "IPMI" + }, + { + "count": 5, + "key": "WIN-RIK6D08VRRQ" + }, + { + "count": 4, + "key": "Firecloud Root Client Certification Authority" + }, + { + "count": 4, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 4, + "key": "宝塔面板" + }, + { + "count": 3, + "key": "DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1" + }, + { + "count": 3, + "key": "TrustAsia TLS RSA CA" + }, + { + "count": 3, + "key": "WIN-M7O7840CVAH" + }, + { + "count": 2, + "key": "Certum DV TLS G2 R39 CA" + } + ] + }, + "os": { + "total": 614, + "buckets": [ + { + "count": 33, + "key": "linux" + }, + { + "count": 27, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "centos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "fields": { + "port": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "80" + }, + { + "count": 2, + "key": "443" + } + ] + }, + "software": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "internet_information_services" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "http_api" + } + ] + }, + "labels": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 4, + "buckets": [ + { + "count": 1, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1, + "key": "YR1" + } + ] + }, + "os": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "windows" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS394711", + "name": "KORGRID", + "fields": { + "port": { + "total": 3, + "buckets": [ + { + "count": 2, + "key": "80" + }, + { + "count": 2, + "key": "443" + }, + { + "count": 1, + "key": "3389" + } + ] + }, + "software": { + "total": 3, + "buckets": [ + { + "count": 4, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 3, + "buckets": [ + { + "count": 3, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 3, + "buckets": [ + { + "count": 2, + "key": "vergeos.local.root" + }, + { + "count": 1, + "key": "pcmrp-test" + } + ] + }, + "os": { + "total": 3, + "buckets": [] + } + }, + "errors": [] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson b/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson new file mode 100644 index 0000000..210f587 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS138915","field":"host.services.port","total":12308,"buckets":[{"count":6621,"key":"22"},{"count":2412,"key":"32080"},{"count":2381,"key":"443"},{"count":2357,"key":"43080"},{"count":2255,"key":"80"},{"count":2242,"key":"40003"},{"count":2236,"key":"40801"},{"count":2233,"key":"40803"},{"count":2228,"key":"40804"},{"count":2198,"key":"40810"},{"count":872,"key":"123"},{"count":559,"key":"8080"},{"count":502,"key":"3389"},{"count":477,"key":"135"},{"count":475,"key":"3081"}]} +{"asn":"AS138915","field":"host.services.software.product","total":12308,"buckets":[{"count":7058,"key":"openssh"},{"count":6333,"key":"openresty"},{"count":4660,"key":"tengine"},{"count":2975,"key":"nginx"},{"count":866,"key":"http_api"},{"count":452,"key":"http_server"},{"count":384,"key":"express"},{"count":344,"key":"jquery"},{"count":249,"key":"bootstrap"},{"count":246,"key":"openvpn_access_server"},{"count":208,"key":"python"},{"count":205,"key":"squid"},{"count":199,"key":"node_exporter"},{"count":188,"key":"litespeed_web_server"},{"count":185,"key":"moment"}]} +{"asn":"AS138915","field":"host.labels.value","total":12308,"buckets":[{"count":12308,"key":"BULLETPROOF"},{"count":100,"key":"IPV6"}]} +{"asn":"AS138915","field":"host.services.cert.parsed.issuer.common_name","total":12308,"buckets":[{"count":4572,"key":"GlobalSign GCC R3 OV TLS CA 2024"},{"count":2333,"key":"localhost"},{"count":2290,"key":"prod-vpn.example.com"},{"count":2266,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":2123,"key":"GlobalSign GCC R46 OV TLS CA 2025"},{"count":1190,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":427,"key":"NONE"},{"count":412,"key":"WoTrus RSA DV SSL CA 2"},{"count":313,"key":"WIN-9QFKHJ39QE9"},{"count":312,"key":"YR1"},{"count":277,"key":"QY"},{"count":232,"key":"YR2"},{"count":211,"key":"YE1"},{"count":209,"key":"YE2"},{"count":172,"key":"tls.internal.ypc.org"}]} +{"asn":"AS138915","field":"host.operating_system.product","total":12308,"buckets":[{"count":5600,"key":"linux"},{"count":538,"key":"windows"},{"count":86,"key":"routeros"},{"count":30,"key":"ubuntu"},{"count":22,"key":"centos"},{"count":19,"key":"debian_linux"},{"count":11,"key":"adaptive_security_appliance_software"},{"count":10,"key":"proxmox"},{"count":4,"key":"linux_kernel"},{"count":1,"key":"freebsd"},{"count":1,"key":"ios"},{"count":1,"key":"junos"},{"count":1,"key":"netscaler"},{"count":1,"key":"pulse_connect_secure"},{"count":1,"key":"usg6655e_firmware"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson b/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson new file mode 100644 index 0000000..31c88fb --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS140666","field":"host.services.port","total":6562,"buckets":[{"count":4367,"key":"443"},{"count":4199,"key":"80"},{"count":2445,"key":"22"},{"count":1504,"key":"4667"},{"count":510,"key":"0"},{"count":376,"key":"6004"},{"count":376,"key":"6011"},{"count":375,"key":"6001"},{"count":375,"key":"6006"},{"count":375,"key":"6007"},{"count":375,"key":"6010"},{"count":375,"key":"6012"},{"count":375,"key":"6013"},{"count":375,"key":"6014"},{"count":375,"key":"6016"}]} +{"asn":"AS140666","field":"host.services.software.product","total":6562,"buckets":[{"count":8935,"key":"nginx"},{"count":3801,"key":"openssh"},{"count":140,"key":"openresty"},{"count":125,"key":"http_api"},{"count":80,"key":"jquery"},{"count":76,"key":"internet_information_services"},{"count":56,"key":"tengine"},{"count":52,"key":"bootstrap"},{"count":41,"key":"node_exporter"},{"count":36,"key":"express"},{"count":34,"key":"app_and_api_protector"},{"count":34,"key":"ghost"},{"count":34,"key":"wordpress"},{"count":29,"key":"python"},{"count":28,"key":"http_server"}]} +{"asn":"AS140666","field":"host.labels.value","total":6562,"buckets":[{"count":6562,"key":"BULLETPROOF"}]} +{"asn":"AS140666","field":"host.services.cert.parsed.issuer.common_name","total":6562,"buckets":[{"count":3804,"key":"USDTCDN"},{"count":347,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":182,"key":"NONE"},{"count":132,"key":"RapidSSL TLS RSA CA G1"},{"count":123,"key":"tudog_node_agent._reserved.bytefcdn.com"},{"count":108,"key":"RTCTS"},{"count":97,"key":"GeoTrust TLS RSA CA G1"},{"count":97,"key":"QY"},{"count":65,"key":"RapidSSL TLS ECC CA G1"},{"count":61,"key":"tls.internal.ypc.org"},{"count":48,"key":"SG CA"},{"count":47,"key":"GlobalSign GCC R3 OV TLS CA 2024"},{"count":34,"key":"YR1"},{"count":33,"key":"Root CA"},{"count":32,"key":"GlobalSign GCC R46 OV TLS CA 2025"}]} +{"asn":"AS140666","field":"host.operating_system.product","total":6562,"buckets":[{"count":1100,"key":"linux"},{"count":94,"key":"windows"},{"count":13,"key":"ubuntu"},{"count":3,"key":"routeros"},{"count":2,"key":"adaptive_security_appliance_software"},{"count":2,"key":"debian_linux"},{"count":2,"key":"windows_server_2008_r2"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"proxmox"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson b/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson new file mode 100644 index 0000000..315f15c --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS14956","field":"host.services.port","total":25632,"buckets":[{"count":15454,"key":"22"},{"count":8555,"key":"443"},{"count":7568,"key":"80"},{"count":7553,"key":"3389"},{"count":1143,"key":"5985"},{"count":1122,"key":"2096"},{"count":951,"key":"135"},{"count":870,"key":"8443"},{"count":812,"key":"445"},{"count":782,"key":"53"},{"count":666,"key":"25"},{"count":615,"key":"139"},{"count":599,"key":"8080"},{"count":582,"key":"21"},{"count":545,"key":"111"}]} +{"asn":"AS14956","field":"host.services.software.product","total":25632,"buckets":[{"count":14517,"key":"openssh"},{"count":10237,"key":"nginx"},{"count":2654,"key":"express"},{"count":1598,"key":"http_server"},{"count":1224,"key":"dovecot"},{"count":1155,"key":"http_api"},{"count":997,"key":"next.js"},{"count":906,"key":"google_web_services"},{"count":895,"key":"web_server"},{"count":751,"key":"caddy"},{"count":690,"key":"jquery"},{"count":599,"key":"internet_information_services"},{"count":570,"key":"php"},{"count":566,"key":"bootstrap"},{"count":503,"key":"python"}]} +{"asn":"AS14956","field":"host.labels.value","total":25632,"buckets":[{"count":25632,"key":"BULLETPROOF"},{"count":206,"key":"IPV6"}]} +{"asn":"AS14956","field":"host.services.cert.parsed.issuer.common_name","total":25632,"buckets":[{"count":2338,"key":"YE2"},{"count":1976,"key":"YE1"},{"count":993,"key":"windows-Dallas0"},{"count":985,"key":"YR1"},{"count":933,"key":"YR2"},{"count":915,"key":"invalid2.invalid"},{"count":481,"key":"windows-Utah-4g"},{"count":389,"key":"windows-Amsterd"},{"count":379,"key":"www.example.com"},{"count":351,"key":"windows-Utah-4H"},{"count":341,"key":"TRAEFIK DEFAULT CERT"},{"count":320,"key":"windows-Utah-2g"},{"count":288,"key":"AnyDesk Client"},{"count":278,"key":"Plesk"},{"count":238,"key":"windows-LasVega"}]} +{"asn":"AS14956","field":"host.operating_system.product","total":25632,"buckets":[{"count":13719,"key":"linux"},{"count":5476,"key":"windows"},{"count":210,"key":"ubuntu"},{"count":135,"key":"debian_linux"},{"count":97,"key":"routeros"},{"count":30,"key":"freebsd"},{"count":21,"key":"windows_server"},{"count":19,"key":"linux_kernel"},{"count":8,"key":"adaptive_security_appliance_software"},{"count":7,"key":"centos"},{"count":6,"key":"enterprise_linux"},{"count":6,"key":"proxmox"},{"count":3,"key":"windows_server_2012_r2"},{"count":2,"key":"openbsd"},{"count":1,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson b/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson new file mode 100644 index 0000000..38b73cf --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS198953","field":"host.services.port","total":359,"buckets":[{"count":167,"key":"22"},{"count":163,"key":"3389"},{"count":84,"key":"80"},{"count":81,"key":"443"},{"count":53,"key":"135"},{"count":42,"key":"137"},{"count":38,"key":"53"},{"count":37,"key":"5985"},{"count":36,"key":"139"},{"count":24,"key":"21"},{"count":24,"key":"123"},{"count":24,"key":"47001"},{"count":22,"key":"25"},{"count":20,"key":"993"},{"count":19,"key":"110"}]} +{"asn":"AS198953","field":"host.services.software.product","total":359,"buckets":[{"count":125,"key":"openssh"},{"count":124,"key":"nginx"},{"count":60,"key":"dovecot"},{"count":43,"key":"http_api"},{"count":33,"key":"express"},{"count":31,"key":"fastpanel"},{"count":30,"key":"http_server"},{"count":24,"key":"exim"},{"count":23,"key":"requirejs"},{"count":20,"key":"parallels_plesk_panel"},{"count":20,"key":"prototype"},{"count":17,"key":"proftpd"},{"count":14,"key":"plesk"},{"count":12,"key":"bind"},{"count":11,"key":"postfix"}]} +{"asn":"AS198953","field":"host.labels.value","total":359,"buckets":[{"count":359,"key":"BULLETPROOF"}]} +{"asn":"AS198953","field":"host.services.cert.parsed.issuer.common_name","total":359,"buckets":[{"count":23,"key":"Plesk"},{"count":19,"key":"YR1"},{"count":19,"key":"etc"},{"count":11,"key":"localhost"},{"count":9,"key":"AnyDesk Client"},{"count":9,"key":"R11"},{"count":8,"key":"FASTPANEL"},{"count":8,"key":"R12"},{"count":8,"key":"parking"},{"count":7,"key":"YR2"},{"count":7,"key":"dev-1.secure.host"},{"count":6,"key":"akrud-1.example.com"},{"count":6,"key":"mail.the-slasher.com"},{"count":6,"key":"xmoney-1.example.com"},{"count":5,"key":"DESKTOP-TCRDU4C"}]} +{"asn":"AS198953","field":"host.operating_system.product","total":359,"buckets":[{"count":118,"key":"linux"},{"count":40,"key":"windows"},{"count":2,"key":"debian_linux"},{"count":2,"key":"proxmox"},{"count":2,"key":"ubuntu"},{"count":1,"key":"adaptive_security_appliance_software"},{"count":1,"key":"freenas_firmware"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"routeros"},{"count":1,"key":"vmware_esxi_server"},{"count":1,"key":"windows_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson b/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson new file mode 100644 index 0000000..041390f --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS200593","field":"host.services.port","total":340,"buckets":[{"count":193,"key":"22"},{"count":133,"key":"3389"},{"count":107,"key":"80"},{"count":80,"key":"443"},{"count":38,"key":"53"},{"count":29,"key":"135"},{"count":26,"key":"5985"},{"count":22,"key":"21"},{"count":21,"key":"25"},{"count":21,"key":"143"},{"count":21,"key":"993"},{"count":19,"key":"110"},{"count":17,"key":"137"},{"count":17,"key":"139"},{"count":16,"key":"8443"}]} +{"asn":"AS200593","field":"host.services.software.product","total":340,"buckets":[{"count":141,"key":"nginx"},{"count":133,"key":"openssh"},{"count":59,"key":"dovecot"},{"count":34,"key":"http_server"},{"count":32,"key":"parallels_plesk_panel"},{"count":32,"key":"prototype"},{"count":32,"key":"requirejs"},{"count":29,"key":"http_api"},{"count":27,"key":"express"},{"count":22,"key":"plesk"},{"count":21,"key":"exim"},{"count":15,"key":"cpanel"},{"count":14,"key":"proftpd"},{"count":11,"key":"postfix"},{"count":10,"key":"authoritative_server"}]} +{"asn":"AS200593","field":"host.labels.value","total":340,"buckets":[{"count":340,"key":"BULLETPROOF"}]} +{"asn":"AS200593","field":"host.services.cert.parsed.issuer.common_name","total":340,"buckets":[{"count":37,"key":"Plesk"},{"count":36,"key":"YR1"},{"count":27,"key":"YR2"},{"count":9,"key":"TRAEFIK DEFAULT CERT"},{"count":9,"key":"YE1"},{"count":8,"key":"R13"},{"count":8,"key":"blankilamalice-4.example.com"},{"count":8,"key":"devin-coo-1.example.com"},{"count":7,"key":"DESKTOP-GKGI28A"},{"count":7,"key":"R12"},{"count":7,"key":"ads-grab-2.example.com"},{"count":7,"key":"ckicksp-1.example.com"},{"count":5,"key":"benjamin-b-2.example.com"},{"count":4,"key":"AnyDesk Client"},{"count":4,"key":"etc"}]} +{"asn":"AS200593","field":"host.operating_system.product","total":340,"buckets":[{"count":133,"key":"linux"},{"count":25,"key":"windows"},{"count":3,"key":"proxmox"},{"count":2,"key":"debian_linux"},{"count":2,"key":"ubuntu"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson b/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson new file mode 100644 index 0000000..d9cdd01 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS200651","field":"host.services.port","total":3824,"buckets":[{"count":2849,"key":"22"},{"count":2126,"key":"443"},{"count":1919,"key":"80"},{"count":385,"key":"53"},{"count":281,"key":"25"},{"count":235,"key":"587"},{"count":222,"key":"993"},{"count":192,"key":"111"},{"count":185,"key":"143"},{"count":167,"key":"110"},{"count":162,"key":"8080"},{"count":144,"key":"2096"},{"count":143,"key":"8443"},{"count":135,"key":"21"},{"count":97,"key":"9001"}]} +{"asn":"AS200651","field":"host.services.software.product","total":3824,"buckets":[{"count":2797,"key":"nginx"},{"count":2571,"key":"openssh"},{"count":554,"key":"dovecot"},{"count":449,"key":"http_server"},{"count":357,"key":"cpanel"},{"count":288,"key":"express"},{"count":270,"key":"caddy"},{"count":255,"key":"exim"},{"count":251,"key":"openresty"},{"count":197,"key":"authoritative_server"},{"count":183,"key":"next.js"},{"count":166,"key":"jquery"},{"count":159,"key":"postfix"},{"count":157,"key":"webmail"},{"count":133,"key":"traefik_proxy"}]} +{"asn":"AS200651","field":"host.labels.value","total":3824,"buckets":[{"count":3824,"key":"BULLETPROOF"},{"count":130,"key":"IPV6"}]} +{"asn":"AS200651","field":"host.services.cert.parsed.issuer.common_name","total":3824,"buckets":[{"count":705,"key":"YE1"},{"count":650,"key":"YE2"},{"count":599,"key":"YR2"},{"count":580,"key":"YR1"},{"count":133,"key":"TRAEFIK DEFAULT CERT"},{"count":102,"key":"invalid2.invalid"},{"count":59,"key":"localhost"},{"count":41,"key":"www.example.com"},{"count":40,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":34,"key":"fin01.m-cr.org"},{"count":30,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":28,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":26,"key":"protect@DDoS-Filter.domain"},{"count":25,"key":"E7"},{"count":25,"key":"Proxmox Virtual Environment"}]} +{"asn":"AS200651","field":"host.operating_system.product","total":3824,"buckets":[{"count":2155,"key":"linux"},{"count":65,"key":"ubuntu"},{"count":45,"key":"debian_linux"},{"count":30,"key":"proxmox"},{"count":24,"key":"windows"},{"count":10,"key":"freebsd"},{"count":8,"key":"routeros"},{"count":6,"key":"enterprise_linux"},{"count":6,"key":"openbsd"},{"count":5,"key":"centos"},{"count":3,"key":"windows_server_2008_r2"},{"count":1,"key":"ilo_3"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"openmediavault"},{"count":1,"key":"sonicos"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson b/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson new file mode 100644 index 0000000..b19c59b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS202685","field":"host.services.port","total":4,"buckets":[{"count":4,"key":"80"},{"count":2,"key":"443"}]} +{"asn":"AS202685","field":"host.services.software.product","total":4,"buckets":[{"count":4,"key":"internet_information_services"},{"count":2,"key":"asp.net"},{"count":2,"key":"http_api"}]} +{"asn":"AS202685","field":"host.labels.value","total":4,"buckets":[{"count":4,"key":"BULLETPROOF"}]} +{"asn":"AS202685","field":"host.services.cert.parsed.issuer.common_name","total":4,"buckets":[{"count":1,"key":"GeoTrust TLS RSA CA G1"},{"count":1,"key":"YR1"}]} +{"asn":"AS202685","field":"host.operating_system.product","total":4,"buckets":[{"count":4,"key":"windows"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson b/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson new file mode 100644 index 0000000..edc1abc --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS206728","field":"host.services.port","total":15,"buckets":[{"count":5,"key":"443"},{"count":3,"key":"22"},{"count":2,"key":"80"},{"count":1,"key":"111"},{"count":1,"key":"137"},{"count":1,"key":"3389"},{"count":1,"key":"5900"},{"count":1,"key":"5902"},{"count":1,"key":"5903"},{"count":1,"key":"8080"}]} +{"asn":"AS206728","field":"host.services.software.product","total":15,"buckets":[{"count":4,"key":"nginx"},{"count":2,"key":"openssh"}]} +{"asn":"AS206728","field":"host.labels.value","total":15,"buckets":[{"count":15,"key":"BULLETPROOF"},{"count":5,"key":"IPV6"}]} +{"asn":"AS206728","field":"host.services.cert.parsed.issuer.common_name","total":15,"buckets":[{"count":2,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1,"key":"WIN-UKID351J32A"},{"count":1,"key":"YE1"},{"count":1,"key":"invalid2.invalid"}]} +{"asn":"AS206728","field":"host.operating_system.product","total":15,"buckets":[{"count":1,"key":"linux"},{"count":1,"key":"routeros"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson b/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson new file mode 100644 index 0000000..f4ea3cd --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS209847","field":"host.services.port","total":1458,"buckets":[{"count":884,"key":"22"},{"count":423,"key":"443"},{"count":413,"key":"8080"},{"count":404,"key":"53"},{"count":370,"key":"1030"},{"count":370,"key":"1050"},{"count":370,"key":"24442"},{"count":368,"key":"1234"},{"count":368,"key":"1235"},{"count":337,"key":"80"},{"count":207,"key":"1500"},{"count":200,"key":"21"},{"count":182,"key":"1501"},{"count":109,"key":"2096"},{"count":92,"key":"25"}]} +{"asn":"AS209847","field":"host.services.software.product","total":1458,"buckets":[{"count":1126,"key":"python"},{"count":1116,"key":"openssh"},{"count":1112,"key":"aiohttp"},{"count":670,"key":"nginx"},{"count":357,"key":"bind"},{"count":291,"key":"dovecot"},{"count":204,"key":"exim"},{"count":195,"key":"proftpd"},{"count":133,"key":"google_web_services"},{"count":133,"key":"web_server"},{"count":45,"key":"app_and_api_protector"},{"count":45,"key":"express"},{"count":45,"key":"ghost"},{"count":42,"key":"bootstrap"},{"count":38,"key":"http_server"}]} +{"asn":"AS209847","field":"host.labels.value","total":1458,"buckets":[{"count":1458,"key":"BULLETPROOF"},{"count":5,"key":"IPV6"}]} +{"asn":"AS209847","field":"host.services.cert.parsed.issuer.common_name","total":1458,"buckets":[{"count":217,"key":"YR2"},{"count":184,"key":"YR1"},{"count":133,"key":"invalid2.invalid"},{"count":127,"key":"YE2"},{"count":116,"key":"YE1"},{"count":34,"key":"server"},{"count":24,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":20,"key":"GeoTrust TLS RSA CA G1"},{"count":15,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":14,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":14,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":13,"key":"vm15882839.example.com"},{"count":11,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":10,"key":"R13"},{"count":9,"key":"dmitrievd1.example.com"}]} +{"asn":"AS209847","field":"host.operating_system.product","total":1458,"buckets":[{"count":1098,"key":"linux"},{"count":14,"key":"windows"},{"count":7,"key":"ubuntu"},{"count":5,"key":"routeros"},{"count":2,"key":"linux_kernel"},{"count":1,"key":"adaptive_security_appliance_software"},{"count":1,"key":"debian_linux"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson b/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson new file mode 100644 index 0000000..dc95421 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS210644","field":"host.services.port","total":71701,"buckets":[{"count":62026,"key":"22"},{"count":35342,"key":"443"},{"count":18338,"key":"80"},{"count":12259,"key":"2096"},{"count":8310,"key":"8443"},{"count":6116,"key":"8080"},{"count":3493,"key":"2053"},{"count":2001,"key":"2222"},{"count":1715,"key":"3389"},{"count":1172,"key":"53"},{"count":1165,"key":"51821"},{"count":1085,"key":"25"},{"count":1068,"key":"3000"},{"count":1062,"key":"8000"},{"count":862,"key":"9443"}]} +{"asn":"AS210644","field":"host.services.software.product","total":71701,"buckets":[{"count":61391,"key":"openssh"},{"count":30077,"key":"nginx"},{"count":7276,"key":"google_web_services"},{"count":7275,"key":"web_server"},{"count":5365,"key":"ghost"},{"count":5360,"key":"app_and_api_protector"},{"count":4102,"key":"express"},{"count":3511,"key":"caddy"},{"count":3140,"key":"waf"},{"count":2924,"key":"cloudflare_load_balancer"},{"count":2008,"key":"uvicorn"},{"count":1919,"key":"next.js"},{"count":1629,"key":"http_server"},{"count":1582,"key":"python"},{"count":1578,"key":"jquery"}]} +{"asn":"AS210644","field":"host.labels.value","total":71701,"buckets":[{"count":71701,"key":"BULLETPROOF"},{"count":499,"key":"IPV6"}]} +{"asn":"AS210644","field":"host.services.cert.parsed.issuer.common_name","total":71701,"buckets":[{"count":14987,"key":"YE2"},{"count":12936,"key":"YE1"},{"count":7359,"key":"invalid2.invalid"},{"count":3525,"key":"HARICA DV TLS RSA"},{"count":3217,"key":"YR1"},{"count":2129,"key":"GeoTrust TLS RSA CA G1"},{"count":1981,"key":"YR2"},{"count":1750,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1301,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":1278,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":1025,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":965,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":916,"key":"TRAEFIK DEFAULT CERT"},{"count":774,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":760,"key":"Sectigo Public Server Authentication CA DV E36"}]} +{"asn":"AS210644","field":"host.operating_system.product","total":71701,"buckets":[{"count":59980,"key":"linux"},{"count":740,"key":"ubuntu"},{"count":561,"key":"windows"},{"count":201,"key":"debian_linux"},{"count":92,"key":"routeros"},{"count":90,"key":"linux_kernel"},{"count":33,"key":"adaptive_security_appliance_software"},{"count":16,"key":"linux_ami"},{"count":14,"key":"centos"},{"count":11,"key":"windows_server"},{"count":7,"key":"freebsd"},{"count":3,"key":"dsm"},{"count":2,"key":"enterprise_linux"},{"count":1,"key":"ios"},{"count":1,"key":"macos"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson b/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson new file mode 100644 index 0000000..5821b8d --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS211720","field":"host.services.port","total":49,"buckets":[{"count":28,"key":"22"},{"count":18,"key":"3389"},{"count":14,"key":"179"},{"count":9,"key":"80"},{"count":7,"key":"443"},{"count":6,"key":"111"},{"count":6,"key":"5985"},{"count":3,"key":"8080"},{"count":3,"key":"8081"},{"count":2,"key":"135"},{"count":2,"key":"137"},{"count":2,"key":"5357"},{"count":1,"key":"53"},{"count":1,"key":"139"},{"count":1,"key":"445"}]} +{"asn":"AS211720","field":"host.services.software.product","total":49,"buckets":[{"count":25,"key":"openssh"},{"count":11,"key":"nginx"},{"count":6,"key":"http_api"},{"count":2,"key":"next.js"},{"count":2,"key":"tor"},{"count":1,"key":"caddy"},{"count":1,"key":"dropbear_ssh"},{"count":1,"key":"gunicorn"},{"count":1,"key":"http_server"},{"count":1,"key":"libupnp"},{"count":1,"key":"mariadb"}]} +{"asn":"AS211720","field":"host.labels.value","total":49,"buckets":[{"count":49,"key":"BULLETPROOF"}]} +{"asn":"AS211720","field":"host.services.cert.parsed.issuer.common_name","total":49,"buckets":[{"count":3,"key":"IPMI"},{"count":2,"key":"FREE"},{"count":2,"key":"YE1"},{"count":1,"key":"WIN-JDCEOBUFJUS"},{"count":1,"key":"WIN-JP7KUDECHOR"},{"count":1,"key":"YE2"},{"count":1,"key":"YR2"},{"count":1,"key":"agent-ca@1757674441"},{"count":1,"key":"agent-ca@1757925038"},{"count":1,"key":"agent-ca@1759158944"},{"count":1,"key":"bad-raven-crab"},{"count":1,"key":"bright-magenta-"},{"count":1,"key":"eth0"},{"count":1,"key":"gentle-red-bee"},{"count":1,"key":"greedy-cream-ha"}]} +{"asn":"AS211720","field":"host.operating_system.product","total":49,"buckets":[{"count":10,"key":"linux"},{"count":4,"key":"windows"},{"count":1,"key":"debian_linux"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson b/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson new file mode 100644 index 0000000..2093aed --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS213702","field":"host.services.port","total":7681,"buckets":[{"count":6701,"key":"22"},{"count":4574,"key":"443"},{"count":2232,"key":"2222"},{"count":2163,"key":"80"},{"count":775,"key":"8443"},{"count":678,"key":"2096"},{"count":371,"key":"3389"},{"count":236,"key":"8080"},{"count":199,"key":"2053"},{"count":171,"key":"9443"},{"count":129,"key":"3000"},{"count":124,"key":"4443"},{"count":93,"key":"8000"},{"count":89,"key":"445"},{"count":81,"key":"2083"}]} +{"asn":"AS213702","field":"host.services.software.product","total":7681,"buckets":[{"count":6428,"key":"openssh"},{"count":3432,"key":"nginx"},{"count":643,"key":"caddy"},{"count":479,"key":"google_web_services"},{"count":479,"key":"web_server"},{"count":449,"key":"app_and_api_protector"},{"count":449,"key":"ghost"},{"count":297,"key":"waf"},{"count":285,"key":"cloudflare_load_balancer"},{"count":261,"key":"express"},{"count":235,"key":"next.js"},{"count":200,"key":"openresty"},{"count":188,"key":"uvicorn"},{"count":132,"key":"http_server"},{"count":127,"key":"bootstrap"}]} +{"asn":"AS213702","field":"host.labels.value","total":7681,"buckets":[{"count":7681,"key":"BULLETPROOF"},{"count":18,"key":"IPV6"}]} +{"asn":"AS213702","field":"host.services.cert.parsed.issuer.common_name","total":7681,"buckets":[{"count":1384,"key":"YE2"},{"count":1093,"key":"YE1"},{"count":775,"key":"2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo"},{"count":498,"key":"invalid2.invalid"},{"count":310,"key":"NvJhHp68p5mjSuW_EK9Lab6bH9"},{"count":300,"key":"GlobalSign Atlas R3 DV TLS CA 2026 Q2"},{"count":235,"key":"YR1"},{"count":227,"key":"GeoTrust TLS RSA CA G1"},{"count":220,"key":"zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5"},{"count":188,"key":"YR2"},{"count":181,"key":"HARICA DV TLS RSA"},{"count":145,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":139,"key":"WR1"},{"count":122,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":110,"key":"GlobalSign ECC OV SSL CA 2018"}]} +{"asn":"AS213702","field":"host.operating_system.product","total":7681,"buckets":[{"count":6310,"key":"linux"},{"count":65,"key":"ubuntu"},{"count":65,"key":"windows"},{"count":12,"key":"debian_linux"},{"count":10,"key":"linux_kernel"},{"count":2,"key":"enterprise_linux"},{"count":1,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson b/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson new file mode 100644 index 0000000..fc70f00 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS214351","field":"host.services.port","total":744,"buckets":[{"count":564,"key":"80"},{"count":559,"key":"22"},{"count":363,"key":"443"},{"count":103,"key":"21"},{"count":99,"key":"53"},{"count":97,"key":"25"},{"count":90,"key":"587"},{"count":89,"key":"143"},{"count":89,"key":"993"},{"count":87,"key":"8085"},{"count":86,"key":"110"},{"count":86,"key":"22509"},{"count":78,"key":"3389"},{"count":49,"key":"8888"},{"count":41,"key":"7777"}]} +{"asn":"AS214351","field":"host.services.software.product","total":744,"buckets":[{"count":841,"key":"nginx"},{"count":610,"key":"openssh"},{"count":296,"key":"express"},{"count":228,"key":"dovecot"},{"count":173,"key":"fastpanel"},{"count":155,"key":"exim"},{"count":107,"key":"next.js"},{"count":84,"key":"http_server"},{"count":62,"key":"proftpd"},{"count":40,"key":"http_api"},{"count":29,"key":"bootstrap"},{"count":25,"key":"php"},{"count":25,"key":"uvicorn"},{"count":21,"key":"jquery"},{"count":20,"key":"bind"}]} +{"asn":"AS214351","field":"host.labels.value","total":744,"buckets":[{"count":744,"key":"BULLETPROOF"}]} +{"asn":"AS214351","field":"host.services.cert.parsed.issuer.common_name","total":744,"buckets":[{"count":110,"key":"etc"},{"count":58,"key":"YR1"},{"count":55,"key":"YR2"},{"count":52,"key":"vm4660.defhost.co"},{"count":45,"key":"FASTPANEL"},{"count":43,"key":"parking"},{"count":39,"key":"YE2"},{"count":34,"key":"YE1"},{"count":30,"key":"misp.goodip"},{"count":14,"key":"vm4980.defhost.co"},{"count":12,"key":"tech0.test"},{"count":10,"key":"localhost"},{"count":9,"key":"amgel.yop.nail"},{"count":9,"key":"def.host.vm"},{"count":9,"key":"info.devser.loc"}]} +{"asn":"AS214351","field":"host.operating_system.product","total":744,"buckets":[{"count":538,"key":"linux"},{"count":34,"key":"windows"},{"count":6,"key":"linux_kernel"},{"count":3,"key":"ubuntu"},{"count":1,"key":"centos"},{"count":1,"key":"debian_linux"},{"count":1,"key":"windows_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson b/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson new file mode 100644 index 0000000..70f8e12 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS214940","field":"host.services.port","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.services.software.product","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.labels.value","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.services.cert.parsed.issuer.common_name","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.operating_system.product","total":0,"buckets":[]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson new file mode 100644 index 0000000..5847748 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216139","field":"host.services.port","total":8797,"buckets":[{"count":5381,"key":"22"},{"count":3417,"key":"443"},{"count":2110,"key":"80"},{"count":928,"key":"51821"},{"count":787,"key":"53"},{"count":641,"key":"21"},{"count":606,"key":"2096"},{"count":463,"key":"25"},{"count":455,"key":"993"},{"count":444,"key":"143"},{"count":428,"key":"3306"},{"count":416,"key":"110"},{"count":399,"key":"587"},{"count":369,"key":"8443"},{"count":348,"key":"1500"}]} +{"asn":"AS216139","field":"host.services.software.product","total":8797,"buckets":[{"count":4419,"key":"openssh"},{"count":3457,"key":"nginx"},{"count":1467,"key":"dovecot"},{"count":932,"key":"exim"},{"count":901,"key":"wg-easy"},{"count":711,"key":"express"},{"count":656,"key":"google_web_services"},{"count":656,"key":"web_server"},{"count":553,"key":"ddos-guard"},{"count":429,"key":"http_server"},{"count":390,"key":"bind"},{"count":338,"key":"app_and_api_protector"},{"count":338,"key":"ghost"},{"count":292,"key":"php"},{"count":283,"key":"mysql"}]} +{"asn":"AS216139","field":"host.labels.value","total":8797,"buckets":[{"count":8797,"key":"BULLETPROOF"},{"count":4,"key":"IPV6"}]} +{"asn":"AS216139","field":"host.services.cert.parsed.issuer.common_name","total":8797,"buckets":[{"count":751,"key":"YE2"},{"count":710,"key":"invalid2.invalid"},{"count":618,"key":"YE1"},{"count":459,"key":"GlobalSign GCC R6 AlphaSSL CA 2025"},{"count":262,"key":"idrac"},{"count":231,"key":"YR1"},{"count":219,"key":"YR2"},{"count":216,"key":"isp13.eurobyte.ru"},{"count":193,"key":"MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate"},{"count":141,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":140,"key":"vps1.dev.mchost.ru"},{"count":116,"key":"vps1.dev.eurobyte.ru"},{"count":113,"key":"etc"},{"count":98,"key":"isp15.eurobyte.ru"},{"count":94,"key":"GeoTrust TLS RSA CA G1"}]} +{"asn":"AS216139","field":"host.operating_system.product","total":8797,"buckets":[{"count":3705,"key":"linux"},{"count":190,"key":"ubuntu"},{"count":67,"key":"routeros"},{"count":53,"key":"enterprise_linux"},{"count":39,"key":"debian_linux"},{"count":26,"key":"centos"},{"count":11,"key":"adaptive_security_appliance_software"},{"count":6,"key":"freebsd"},{"count":3,"key":"linux_ami"},{"count":2,"key":"linux_kernel"},{"count":2,"key":"windows"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson new file mode 100644 index 0000000..7f3584b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216246","field":"host.services.port","total":6960,"buckets":[{"count":5620,"key":"22"},{"count":4211,"key":"443"},{"count":3289,"key":"80"},{"count":688,"key":"8443"},{"count":657,"key":"2096"},{"count":389,"key":"8080"},{"count":331,"key":"2222"},{"count":305,"key":"3389"},{"count":194,"key":"3000"},{"count":172,"key":"3478"},{"count":162,"key":"25"},{"count":162,"key":"53"},{"count":130,"key":"2053"},{"count":128,"key":"993"},{"count":127,"key":"5985"}]} +{"asn":"AS216246","field":"host.services.software.product","total":6960,"buckets":[{"count":5168,"key":"openssh"},{"count":4990,"key":"nginx"},{"count":672,"key":"caddy"},{"count":498,"key":"express"},{"count":455,"key":"next.js"},{"count":271,"key":"dovecot"},{"count":240,"key":"ghost"},{"count":239,"key":"app_and_api_protector"},{"count":235,"key":"traefik_proxy"},{"count":183,"key":"fastpanel"},{"count":182,"key":"waf"},{"count":177,"key":"http_server"},{"count":175,"key":"uvicorn"},{"count":174,"key":"google_web_services"},{"count":174,"key":"web_server"}]} +{"asn":"AS216246","field":"host.labels.value","total":6960,"buckets":[{"count":6960,"key":"BULLETPROOF"},{"count":133,"key":"IPV6"}]} +{"asn":"AS216246","field":"host.services.cert.parsed.issuer.common_name","total":6960,"buckets":[{"count":1428,"key":"YE2"},{"count":1332,"key":"YE1"},{"count":261,"key":"YR1"},{"count":235,"key":"TRAEFIK DEFAULT CERT"},{"count":231,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":224,"key":"HARICA DV TLS RSA"},{"count":180,"key":"invalid2.invalid"},{"count":176,"key":"YR2"},{"count":143,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":128,"key":"WR1"},{"count":86,"key":"GeoTrust TLS RSA CA G1"},{"count":85,"key":"etc"},{"count":81,"key":"WIN-4NFSE1QOBMS"},{"count":69,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":58,"key":"GlobalSign GCC R46 OV TLS CA 2025"}]} +{"asn":"AS216246","field":"host.operating_system.product","total":6960,"buckets":[{"count":5015,"key":"linux"},{"count":246,"key":"ubuntu"},{"count":134,"key":"windows"},{"count":31,"key":"debian_linux"},{"count":8,"key":"routeros"},{"count":7,"key":"linux_kernel"},{"count":3,"key":"proxmox"},{"count":2,"key":"adaptive_security_appliance_software"},{"count":2,"key":"windows_server"},{"count":1,"key":"centos"},{"count":1,"key":"freebsd"},{"count":1,"key":"megarac_spx"},{"count":1,"key":"windows_server_2012_r2"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson new file mode 100644 index 0000000..3ee6d0b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216309","field":"host.services.port","total":37,"buckets":[{"count":35,"key":"22"},{"count":13,"key":"80"},{"count":8,"key":"443"},{"count":4,"key":"111"},{"count":2,"key":"25"},{"count":2,"key":"53"},{"count":2,"key":"110"},{"count":2,"key":"143"},{"count":2,"key":"161"},{"count":2,"key":"993"},{"count":2,"key":"3306"},{"count":2,"key":"4190"},{"count":2,"key":"5060"},{"count":2,"key":"8087"},{"count":2,"key":"8443"}]} +{"asn":"AS216309","field":"host.services.software.product","total":37,"buckets":[{"count":25,"key":"openssh"},{"count":16,"key":"nginx"},{"count":10,"key":"http_server"},{"count":9,"key":"express"},{"count":7,"key":"dovecot"},{"count":6,"key":"bootstrap"},{"count":6,"key":"php"},{"count":5,"key":"prototype"},{"count":4,"key":"jquery"},{"count":4,"key":"openssl"},{"count":3,"key":"parallels_plesk_panel"},{"count":3,"key":"requirejs"},{"count":2,"key":"lodash"},{"count":2,"key":"plesk"},{"count":2,"key":"pve"}]} +{"asn":"AS216309","field":"host.labels.value","total":37,"buckets":[{"count":37,"key":"BULLETPROOF"}]} +{"asn":"AS216309","field":"host.services.cert.parsed.issuer.common_name","total":37,"buckets":[{"count":11,"key":"YR2"},{"count":4,"key":"Plesk"},{"count":3,"key":"YR1"},{"count":2,"key":"YE1"},{"count":2,"key":"YE2"},{"count":2,"key":"pbx.invisiontech.eu"},{"count":1,"key":"MySQL_Server_8.0.42_Auto_Generated_CA_Certificate"},{"count":1,"key":"OpenWrt"},{"count":1,"key":"www.fxzjqfcj6dilr.com"}]} +{"asn":"AS216309","field":"host.operating_system.product","total":37,"buckets":[{"count":12,"key":"linux"},{"count":2,"key":"debian_linux"},{"count":1,"key":"centos"},{"count":1,"key":"proxmox"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson b/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson new file mode 100644 index 0000000..d8bcc20 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS30823","field":"host.services.port","total":2178,"buckets":[{"count":1274,"key":"22"},{"count":855,"key":"443"},{"count":651,"key":"80"},{"count":476,"key":"53"},{"count":379,"key":"27015"},{"count":300,"key":"3389"},{"count":122,"key":"8443"},{"count":120,"key":"25"},{"count":99,"key":"2096"},{"count":80,"key":"8080"},{"count":63,"key":"135"},{"count":61,"key":"111"},{"count":61,"key":"5985"},{"count":55,"key":"445"},{"count":52,"key":"2222"}]} +{"asn":"AS30823","field":"host.services.software.product","total":2178,"buckets":[{"count":1148,"key":"openssh"},{"count":850,"key":"nginx"},{"count":201,"key":"express"},{"count":134,"key":"http_server"},{"count":104,"key":"google_web_services"},{"count":104,"key":"web_server"},{"count":100,"key":"http_api"},{"count":92,"key":"dovecot"},{"count":73,"key":"next.js"},{"count":70,"key":"caddy"},{"count":70,"key":"postfix"},{"count":69,"key":"app_and_api_protector"},{"count":69,"key":"ghost"},{"count":67,"key":"cloudflare_load_balancer"},{"count":67,"key":"waf"}]} +{"asn":"AS30823","field":"host.labels.value","total":2178,"buckets":[{"count":2178,"key":"BULLETPROOF"},{"count":29,"key":"IPV6"}]} +{"asn":"AS30823","field":"host.services.cert.parsed.issuer.common_name","total":2178,"buckets":[{"count":237,"key":"YE2"},{"count":222,"key":"YE1"},{"count":112,"key":"invalid2.invalid"},{"count":99,"key":"YR2"},{"count":83,"key":"YR1"},{"count":60,"key":"windows-DE-Fran"},{"count":57,"key":"172.86.93"},{"count":52,"key":"GoGetSSL RSA DV CA"},{"count":51,"key":"windows-Frankfu"},{"count":27,"key":"localhost"},{"count":25,"key":"WIN-8OA3CCQAE4D"},{"count":24,"key":"Plesk"},{"count":22,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":21,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":21,"key":"RapidSSL TLS RSA CA G1"}]} +{"asn":"AS30823","field":"host.operating_system.product","total":2178,"buckets":[{"count":1080,"key":"linux"},{"count":159,"key":"windows"},{"count":20,"key":"proxmox"},{"count":19,"key":"routeros"},{"count":15,"key":"ubuntu"},{"count":14,"key":"debian_linux"},{"count":9,"key":"centos"},{"count":6,"key":"freebsd"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"megarac_spx"},{"count":3,"key":"windows_server"},{"count":1,"key":"ios"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"vmware_esxi_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson b/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson new file mode 100644 index 0000000..d370d69 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS33993","field":"host.services.port","total":4692,"buckets":[{"count":3082,"key":"22"},{"count":1914,"key":"443"},{"count":1900,"key":"80"},{"count":1295,"key":"53"},{"count":654,"key":"21"},{"count":592,"key":"3000"},{"count":506,"key":"1500"},{"count":497,"key":"25"},{"count":489,"key":"65534"},{"count":475,"key":"993"},{"count":466,"key":"143"},{"count":463,"key":"587"},{"count":457,"key":"110"},{"count":427,"key":"1501"},{"count":288,"key":"2096"}]} +{"asn":"AS33993","field":"host.services.software.product","total":4692,"buckets":[{"count":3541,"key":"nginx"},{"count":3202,"key":"openssh"},{"count":1488,"key":"dovecot"},{"count":1026,"key":"bind"},{"count":1015,"key":"exim"},{"count":514,"key":"proftpd"},{"count":363,"key":"express"},{"count":291,"key":"python"},{"count":227,"key":"aiohttp"},{"count":209,"key":"caddy"},{"count":180,"key":"http_server"},{"count":163,"key":"bootstrap"},{"count":143,"key":"jquery"},{"count":130,"key":"next.js"},{"count":116,"key":"traefik_proxy"}]} +{"asn":"AS33993","field":"host.labels.value","total":4692,"buckets":[{"count":4692,"key":"BULLETPROOF"},{"count":10,"key":"IPV6"}]} +{"asn":"AS33993","field":"host.services.cert.parsed.issuer.common_name","total":4692,"buckets":[{"count":598,"key":"YR1"},{"count":553,"key":"YR2"},{"count":552,"key":"YE2"},{"count":480,"key":"YE1"},{"count":309,"key":"ssl.by"},{"count":238,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":191,"key":"HARICA DV TLS RSA"},{"count":155,"key":"issssrt.ru"},{"count":116,"key":"TRAEFIK DEFAULT CERT"},{"count":98,"key":"invalid2.invalid"},{"count":82,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":81,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":53,"key":"GlobalSign GCC R46 OV TLS CA 2025"},{"count":49,"key":"etc"},{"count":46,"key":"Microsoft TLS G2 RSA CA OCSP 04"}]} +{"asn":"AS33993","field":"host.operating_system.product","total":4692,"buckets":[{"count":2914,"key":"linux"},{"count":57,"key":"windows"},{"count":52,"key":"ubuntu"},{"count":38,"key":"enterprise_linux"},{"count":25,"key":"debian_linux"},{"count":20,"key":"routeros"},{"count":8,"key":"freebsd"},{"count":4,"key":"centos"},{"count":4,"key":"windows_server"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"linux_kernel"},{"count":2,"key":"proxmox"},{"count":1,"key":"ios"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson b/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson new file mode 100644 index 0000000..a88a572 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS394711","field":"host.services.port","total":3,"buckets":[{"count":2,"key":"80"},{"count":2,"key":"443"},{"count":1,"key":"3389"}]} +{"asn":"AS394711","field":"host.services.software.product","total":3,"buckets":[{"count":4,"key":"bootstrap"}]} +{"asn":"AS394711","field":"host.labels.value","total":3,"buckets":[{"count":3,"key":"BULLETPROOF"}]} +{"asn":"AS394711","field":"host.services.cert.parsed.issuer.common_name","total":3,"buckets":[{"count":2,"key":"vergeos.local.root"},{"count":1,"key":"pcmrp-test"}]} +{"asn":"AS394711","field":"host.operating_system.product","total":3,"buckets":[]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson b/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson new file mode 100644 index 0000000..5458c33 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS400992","field":"host.services.port","total":7982,"buckets":[{"count":6772,"key":"22"},{"count":3333,"key":"443"},{"count":1402,"key":"80"},{"count":1044,"key":"2096"},{"count":513,"key":"8443"},{"count":200,"key":"2222"},{"count":192,"key":"8080"},{"count":180,"key":"2053"},{"count":179,"key":"3389"},{"count":144,"key":"25"},{"count":115,"key":"53"},{"count":85,"key":"8000"},{"count":83,"key":"500"},{"count":82,"key":"1080"},{"count":79,"key":"587"}]} +{"asn":"AS400992","field":"host.services.software.product","total":7982,"buckets":[{"count":5827,"key":"openssh"},{"count":2076,"key":"nginx"},{"count":939,"key":"google_web_services"},{"count":937,"key":"web_server"},{"count":421,"key":"app_and_api_protector"},{"count":421,"key":"ghost"},{"count":281,"key":"waf"},{"count":274,"key":"caddy"},{"count":268,"key":"cloudflare_load_balancer"},{"count":219,"key":"express"},{"count":217,"key":"traffic_server"},{"count":157,"key":"http_server"},{"count":134,"key":"bootstrap"},{"count":134,"key":"jquery"},{"count":130,"key":"dovecot"}]} +{"asn":"AS400992","field":"host.labels.value","total":7982,"buckets":[{"count":7982,"key":"BULLETPROOF"},{"count":41,"key":"IPV6"}]} +{"asn":"AS400992","field":"host.services.cert.parsed.issuer.common_name","total":7982,"buckets":[{"count":1110,"key":"YE2"},{"count":944,"key":"invalid2.invalid"},{"count":925,"key":"YE1"},{"count":281,"key":"YR1"},{"count":260,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":189,"key":"YR2"},{"count":127,"key":"GeoTrust TLS RSA CA G1"},{"count":103,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":99,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":98,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":96,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":93,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":82,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":81,"key":"HARICA DV TLS RSA"},{"count":68,"key":"TRAEFIK DEFAULT CERT"}]} +{"asn":"AS400992","field":"host.operating_system.product","total":7982,"buckets":[{"count":5596,"key":"linux"},{"count":84,"key":"ubuntu"},{"count":47,"key":"windows"},{"count":27,"key":"debian_linux"},{"count":17,"key":"routeros"},{"count":9,"key":"adaptive_security_appliance_software"},{"count":5,"key":"freebsd"},{"count":5,"key":"linux_kernel"},{"count":4,"key":"centos"},{"count":1,"key":"linux_ami"},{"count":1,"key":"windows_server_2012"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson b/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson new file mode 100644 index 0000000..1b72d5a --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS51396","field":"host.services.port","total":2005,"buckets":[{"count":841,"key":"22"},{"count":357,"key":"80"},{"count":275,"key":"443"},{"count":121,"key":"3389"},{"count":100,"key":"1407"},{"count":99,"key":"11407"},{"count":87,"key":"135"},{"count":85,"key":"445"},{"count":80,"key":"5985"},{"count":79,"key":"139"},{"count":74,"key":"53"},{"count":73,"key":"8080"},{"count":69,"key":"2096"},{"count":64,"key":"47001"},{"count":61,"key":"6239"}]} +{"asn":"AS51396","field":"host.services.software.product","total":2005,"buckets":[{"count":753,"key":"openssh"},{"count":398,"key":"nginx"},{"count":185,"key":"http_server"},{"count":110,"key":"http_api"},{"count":102,"key":"express"},{"count":72,"key":"php"},{"count":56,"key":"python"},{"count":43,"key":"dovecot"},{"count":43,"key":"pve"},{"count":42,"key":"next.js"},{"count":42,"key":"virtual_environment"},{"count":35,"key":"node_exporter"},{"count":35,"key":"simplehttp"},{"count":30,"key":"drupal"},{"count":30,"key":"tinyproxy"}]} +{"asn":"AS51396","field":"host.labels.value","total":2005,"buckets":[{"count":2005,"key":"BULLETPROOF"},{"count":15,"key":"IPV6"}]} +{"asn":"AS51396","field":"host.services.cert.parsed.issuer.common_name","total":2005,"buckets":[{"count":124,"key":"YE1"},{"count":109,"key":"YE2"},{"count":49,"key":"YR2"},{"count":31,"key":"YR1"},{"count":27,"key":"WIN-9QL4SDRB93L"},{"count":21,"key":"TRAEFIK DEFAULT CERT"},{"count":18,"key":"Proxmox Virtual Environment"},{"count":17,"key":"WIN-IK7N6SD2UBU"},{"count":17,"key":"localhost"},{"count":11,"key":"Cloudbase-Init WinRM"},{"count":11,"key":"invalid2.invalid"},{"count":10,"key":"hosting12.coolsshservers.com"},{"count":9,"key":"WIN-OU0SUKQBJN2"},{"count":9,"key":"imap.example.com"},{"count":9,"key":"srv1.dedusapp.icu"}]} +{"asn":"AS51396","field":"host.operating_system.product","total":2005,"buckets":[{"count":678,"key":"linux"},{"count":82,"key":"windows"},{"count":36,"key":"debian_linux"},{"count":19,"key":"proxmox"},{"count":14,"key":"ubuntu"},{"count":5,"key":"centos"},{"count":2,"key":"routeros"},{"count":1,"key":"vmware_esxi_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson b/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson new file mode 100644 index 0000000..c9487c4 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS51852","field":"host.services.port","total":8634,"buckets":[{"count":4334,"key":"443"},{"count":4041,"key":"22"},{"count":3586,"key":"161"},{"count":2811,"key":"80"},{"count":1892,"key":"123"},{"count":1547,"key":"53"},{"count":845,"key":"500"},{"count":794,"key":"21"},{"count":793,"key":"143"},{"count":786,"key":"993"},{"count":783,"key":"110"},{"count":771,"key":"25"},{"count":660,"key":"1194"},{"count":627,"key":"587"},{"count":587,"key":"8082"}]} +{"asn":"AS51852","field":"host.services.software.product","total":8634,"buckets":[{"count":4673,"key":"nginx"},{"count":4060,"key":"openssh"},{"count":2414,"key":"dovecot"},{"count":1224,"key":"exim"},{"count":837,"key":"cpanel"},{"count":815,"key":"openvpn_access_server"},{"count":760,"key":"http_server"},{"count":757,"key":"bind"},{"count":601,"key":"ceph"},{"count":517,"key":"webmail"},{"count":374,"key":"php"},{"count":359,"key":"proftpd"},{"count":336,"key":"express"},{"count":326,"key":"virtual_environment"},{"count":324,"key":"pve"}]} +{"asn":"AS51852","field":"host.labels.value","total":8634,"buckets":[{"count":8634,"key":"BULLETPROOF"},{"count":38,"key":"IPV6"}]} +{"asn":"AS51852","field":"host.services.cert.parsed.issuer.common_name","total":8634,"buckets":[{"count":1716,"key":"server"},{"count":1497,"key":"YR2"},{"count":894,"key":"Hydra Authentication RSA SubCA #154"},{"count":861,"key":"YR1"},{"count":773,"key":"server.domain.com"},{"count":523,"key":"YE2"},{"count":416,"key":"YE1"},{"count":342,"key":"server.ibras.eu"},{"count":278,"key":"''"},{"count":261,"key":"invalid2.invalid"},{"count":163,"key":"Proxmox Virtual Environment"},{"count":160,"key":"Hydra Authentication RSA SubCA #156"},{"count":142,"key":"Plesk"},{"count":110,"key":"server.xtreme-results.net"},{"count":99,"key":"Hydra Authentication RSA SubCA #155"}]} +{"asn":"AS51852","field":"host.operating_system.product","total":8634,"buckets":[{"count":3027,"key":"linux"},{"count":201,"key":"windows"},{"count":156,"key":"proxmox"},{"count":129,"key":"enterprise_linux"},{"count":49,"key":"ubuntu"},{"count":41,"key":"debian_linux"},{"count":35,"key":"freebsd"},{"count":25,"key":"centos"},{"count":21,"key":"routeros"},{"count":17,"key":"vmware_esxi_server"},{"count":4,"key":"idrac_linux"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"linux_kernel"},{"count":3,"key":"windows_server"},{"count":3,"key":"windows_server_2012_r2"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson b/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson new file mode 100644 index 0000000..d179938 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS57043","field":"host.services.port","total":101919,"buckets":[{"count":77184,"key":"22"},{"count":50237,"key":"443"},{"count":33035,"key":"80"},{"count":14781,"key":"2096"},{"count":8370,"key":"8443"},{"count":4740,"key":"111"},{"count":2942,"key":"8080"},{"count":2599,"key":"2222"},{"count":2592,"key":"2053"},{"count":2487,"key":"53"},{"count":2409,"key":"9100"},{"count":1869,"key":"2212"},{"count":1864,"key":"6767"},{"count":1840,"key":"21"},{"count":1838,"key":"1881"}]} +{"asn":"AS57043","field":"host.services.software.product","total":101918,"buckets":[{"count":76988,"key":"openssh"},{"count":61500,"key":"nginx"},{"count":8740,"key":"google_web_services"},{"count":8740,"key":"web_server"},{"count":6293,"key":"ghost"},{"count":6289,"key":"app_and_api_protector"},{"count":5413,"key":"express"},{"count":4095,"key":"caddy"},{"count":3938,"key":"dovecot"},{"count":3609,"key":"waf"},{"count":3453,"key":"cloudflare_load_balancer"},{"count":3042,"key":"http_server"},{"count":3024,"key":"next.js"},{"count":2218,"key":"uvicorn"},{"count":2008,"key":"bootstrap"}]} +{"asn":"AS57043","field":"host.labels.value","total":101918,"buckets":[{"count":101918,"key":"BULLETPROOF"},{"count":7,"key":"IPV6"}]} +{"asn":"AS57043","field":"host.services.cert.parsed.issuer.common_name","total":101918,"buckets":[{"count":15470,"key":"YE2"},{"count":13541,"key":"YE1"},{"count":8815,"key":"invalid2.invalid"},{"count":7505,"key":"YR1"},{"count":3903,"key":"YR2"},{"count":2294,"key":"GeoTrust TLS RSA CA G1"},{"count":2053,"key":"TRAEFIK DEFAULT CERT"},{"count":1922,"key":"hypervisor.hv"},{"count":1821,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":1535,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":1269,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":1221,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":1163,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1007,"key":"HARICA DV TLS RSA"},{"count":996,"key":"Sectigo Public Server Authentication CA DV E36"}]} +{"asn":"AS57043","field":"host.operating_system.product","total":101918,"buckets":[{"count":72787,"key":"linux"},{"count":834,"key":"ubuntu"},{"count":572,"key":"windows"},{"count":299,"key":"routeros"},{"count":271,"key":"debian_linux"},{"count":175,"key":"proxmox"},{"count":133,"key":"linux_kernel"},{"count":112,"key":"adaptive_security_appliance_software"},{"count":54,"key":"freebsd"},{"count":43,"key":"centos"},{"count":40,"key":"ios"},{"count":38,"key":"vmware_esxi_server"},{"count":21,"key":"enterprise_linux"},{"count":10,"key":"windows_server"},{"count":8,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson b/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson new file mode 100644 index 0000000..8b18094 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS58854","field":"host.services.port","total":614,"buckets":[{"count":181,"key":"8887"},{"count":175,"key":"80"},{"count":158,"key":"443"},{"count":113,"key":"0"},{"count":85,"key":"18893"},{"count":84,"key":"18891"},{"count":79,"key":"111"},{"count":78,"key":"8888"},{"count":77,"key":"8081"},{"count":74,"key":"18890"},{"count":74,"key":"18892"},{"count":74,"key":"25001"},{"count":73,"key":"16257"},{"count":73,"key":"16259"},{"count":73,"key":"26257"}]} +{"asn":"AS58854","field":"host.services.software.product","total":614,"buckets":[{"count":1191,"key":"mysql"},{"count":402,"key":"nginx"},{"count":291,"key":"python"},{"count":173,"key":"wsgiserver"},{"count":165,"key":"jquery"},{"count":155,"key":"bootstrap"},{"count":115,"key":"simplehttp"},{"count":103,"key":"node_exporter"},{"count":79,"key":"openssh"},{"count":77,"key":"kestrel_web_server"},{"count":76,"key":"cadvisor"},{"count":41,"key":"http_api"},{"count":36,"key":"tengine"},{"count":24,"key":"openresty"},{"count":16,"key":"internet_information_services"}]} +{"asn":"AS58854","field":"host.labels.value","total":614,"buckets":[{"count":614,"key":"BULLETPROOF"}]} +{"asn":"AS58854","field":"host.services.cert.parsed.issuer.common_name","total":614,"buckets":[{"count":47,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":12,"key":"TrustAsia DV TLS RSA CA 2025"},{"count":11,"key":"YR1"},{"count":10,"key":"FtpServer"},{"count":8,"key":"RapidSSL TLS RSA CA G1"},{"count":7,"key":"TrustAsia DV TLS RSA CA 2024"},{"count":5,"key":"IPMI"},{"count":5,"key":"WIN-RIK6D08VRRQ"},{"count":4,"key":"Firecloud Root Client Certification Authority"},{"count":4,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":4,"key":"宝塔面板"},{"count":3,"key":"DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1"},{"count":3,"key":"TrustAsia TLS RSA CA"},{"count":3,"key":"WIN-M7O7840CVAH"},{"count":2,"key":"Certum DV TLS G2 R39 CA"}]} +{"asn":"AS58854","field":"host.operating_system.product","total":614,"buckets":[{"count":33,"key":"linux"},{"count":27,"key":"windows"},{"count":13,"key":"ubuntu"},{"count":2,"key":"routeros"},{"count":1,"key":"centos"}]} diff --git a/kevlar/2026-09-07/censys/enrichment-summary.json b/kevlar/2026-09-07/censys/enrichment-summary.json new file mode 100644 index 0000000..a6382d2 --- /dev/null +++ b/kevlar/2026-09-07/censys/enrichment-summary.json @@ -0,0 +1,217 @@ +[ + { + "ip": "176.120.22.61", + "asn": "AS198953", + "name": "PROTON66", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "135/tcp", + "137/udp", + "139/tcp", + "3389/tcp", + "47001/tcp", + "5985/tcp" + ], + "nPorts": 6, + "software": [ + "?", + "http_api:2.0" + ], + "banners": [ + "137: �؄\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000/\u0000<��p", + "139: �\u0000\u0000\u0001�", + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Saint Petersburg, Russia" + }, + { + "ip": "204.76.203.222", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "204.76.203.221", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "204.76.203.213", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "185.246.217.150", + "asn": "AS210644", + "name": "AEZA-AS", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:10.2p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6" + ], + "os": "linux", + "location": "Amsterdam, Netherlands" + }, + { + "ip": "45.61.157.82", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "3389/tcp", + "47001/tcp" + ], + "nPorts": 2, + "software": [ + "?", + "http_api:2.0" + ], + "banners": [ + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Las Vegas, United States" + }, + { + "ip": "185.100.87.136", + "asn": "AS200651", + "name": "FLOKINET", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "7288/tcp", + "80/tcp", + "9001/tcp" + ], + "nPorts": 3, + "software": [ + "tor", + "?", + "openssh:9.9" + ], + "banners": [ + "80: HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r", + "7288: SSH-2.0-OpenSSH_9.9" + ], + "os": "", + "location": "Bucharest, Romania" + }, + { + "ip": "144.172.108.79", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "1433/tcp", + "3389/tcp", + "47001/tcp", + "80/tcp" + ], + "nPorts": 4, + "software": [ + "http_api:2.0", + "?", + "sql_server:10.0.1600" + ], + "banners": [ + "80: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-", + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Ogden, United States" + }, + { + "ip": "193.143.1.66", + "asn": "AS198953", + "name": "PROTON66", + "labels": [], + "ports": [], + "nPorts": 0, + "software": [], + "banners": [], + "os": "", + "location": "?, ?" + }, + { + "ip": "144.172.99.200", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "3389/tcp" + ], + "nPorts": 1, + "software": [ + "?" + ], + "banners": [], + "os": "", + "location": "Ogden, United States" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/censys/fleet-correlation.csv b/kevlar/2026-09-07/censys/fleet-correlation.csv new file mode 100644 index 0000000..4c38a9e --- /dev/null +++ b/kevlar/2026-09-07/censys/fleet-correlation.csv @@ -0,0 +1,7 @@ +linkage_type,ips,indicator,asn,notes +cloned-image,204.76.203.213; 204.76.203.221; 204.76.203.222,identical SSH algorithm selection + banner comment "Ubuntu-3ubuntu0.17" + OpenSSH 8.9p1 single-service profile,AS51396,PFCLOUD /29 scanner fleet in Eygelshoven NL; 1100+ Honeylabs events each; BULLETPROOF-labeled +identical-service-config,45.61.157.82; 144.172.108.79; 144.172.99.200,Windows RDP (3389) + HTTP API 2.0 on 47001; 144.172.108.79 also MSSQL 2008 (10.0.1600) on 1433,AS14956,ROUTERHOSTING RDP-access fleet Las Vegas/Ogden US; BULLETPROOF-labeled +remote-access-node,176.120.22.61,Windows + RDP 3389 + WinRM 5985 + DCERPC 135,AS198953,PROTON66 St Petersburg RU; 1597 Honeylabs events; Censys BULLETPROOF label +scan-only-node,193.143.1.66,zero open ports visible to Censys,AS198953,PROTON66; 24 Honeylabs events but no exposed services +tor-exit,185.100.87.136,Censys TOR label + SSH 9.9 on non-standard port 7288,AS200651,FLOKINET Bucharest RO; 24 Honeylabs events; BULLETPROOF-labeled +ssh-fingerprint-family,204.76.203.213; 204.76.203.221; 204.76.203.222; 185.246.217.150,identical SSH algorithm selection (curve25519-sha256@libssh.org / ecdsa-sha2-nistp256 / aes128-ctr / hmac-sha2-256),AS51396; AS210644,shared SSH hardening baseline across PFCLOUD and AEZA fleets diff --git a/kevlar/2026-09-07/censys/ip-enrichments.ndjson b/kevlar/2026-09-07/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..b0d739e --- /dev/null +++ b/kevlar/2026-09-07/censys/ip-enrichments.ndjson @@ -0,0 +1,10 @@ +{"ip":"176.120.22.61","asn":"AS198953","name":"PROTON66","honeylabs_events":1597,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":198953,"bgp_prefix":"176.120.22.0/24","country_code":"RU","description":"proton66 - Proton66 OOO","name":"proton66 - Proton66 OOO"},"dns":{"reverse_dns":{"resolve_time":"2026-09-02T21:19:43Z"}},"ip":"176.120.22.61","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Saint Petersburg","continent":"Europe","coordinates":{"latitude":59.93863,"longitude":30.31413},"country":"Russia","country_code":"RU","postal_code":"195213","province":"St.-Petersburg","timezone":"Europe/Moscow"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.526},"service_count":6,"services":[{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","dcerpc":{"could_bind":true,"could_query_epm":true,"endpoints":[{"bindings":["ncacn_ip_tcp:176.120.22.61[1032]","ncalrpc:[samss lpc]","ncalrpc:[SidKey Local End Point]","ncalrpc:[protected_storage]","ncalrpc:[lsasspirpc]","ncalrpc:[lsapolicylookup]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[securityevent]","ncalrpc:[audit]","ncacn_np:\\\\M051108[\\pipe\\lsass]"],"executable":"N/A","explained_uuid":"b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 v2.0 KeyIso","protocol":"N/A"},{"bindings":["ncalrpc:[WMsgKRpc0289BF2]"],"executable":"winlogon.exe","explained_uuid":"12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 Secure Desktop LRPC interface","protocol":"N/A"},{"bindings":["ncalrpc:[dabrpc]","ncalrpc:[LRPC-7563631bf11d56b19e]","ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"9b008953-f195-4bf9-bde0-4471971e58ed v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc6]","ncalrpc:[dhcpcsvc]","ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"dhcpcsvc6.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 DHCPv6 Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"N/A","explained_uuid":"abfb6ca3-0c5e-4734-9285-0aee72fe8d1c v1.0 Wcm Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a2f1d3b7cddc139c78]"],"executable":"gpsvc.dll","explained_uuid":"2eb08e3e-639f-4fba-97b1-14f878961076 v1.0 Group Policy RPC Interface","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"MPSSVC.dll","explained_uuid":"7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"12345678-1234-abcd-ef00-0123456789ab v1.0","protocol":"[MS-RPRN]: Print System Remote Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1029]"],"executable":"services.exe","explained_uuid":"367abb81-9844-35f1-ad32-98f038001003 v2.0","protocol":"[MS-SCMR]: Service Control Manager Remote Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1032]","ncalrpc:[samss lpc]","ncalrpc:[SidKey Local End Point]","ncalrpc:[protected_storage]","ncalrpc:[lsasspirpc]","ncalrpc:[lsapolicylookup]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[securityevent]","ncalrpc:[audit]","ncacn_np:\\\\M051108[\\pipe\\lsass]"],"executable":"samsrv.dll","explained_uuid":"12345778-1234-abcd-ef00-0123456789ac v1.0","protocol":"[MS-SAMR]: Security Account Manager (SAM) Remote Protocol"},{"bindings":["ncalrpc:[LRPC-7563631bf11d56b19e]","ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"697dcda9-3ba9-4eb2-9247-e11f1901b0d2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"085b0334-e454-4d91-9b8c-4134f9e793f3 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"3a9ef155-691d-4449-8d05-09ad57031823 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncalrpc:[LRPC-5b3c020788ba8cdd19]","ncalrpc:[LRPC-5b3c020788ba8cdd19]","ncalrpc:[LRPC-5b3c020788ba8cdd19]"],"executable":"msdtcprx.dll","explained_uuid":"906b0ce0-c70b-1067-b317-00dd010662da v1.0","protocol":"[MS-CMPO]: MSDTC Connection Manager:"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8782d3b9-ebbd-4644-a3d8-e8725381919b v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"2e6035b2-e8f1-41a7-a044-656b439c4c34 v1.0 Proxy Manager provider server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\W32TIME_ALT]","ncalrpc:[W32TIME_ALT]","ncalrpc:[LRPC-1f4f400a89fd304001]","ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"],"executable":"N/A","explained_uuid":"3473dd4d-2e88-4006-9cba-22570909dd10 v5.1 WinHttp Auto-Proxy Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"N/A","explained_uuid":"f47433c3-3e9d-4157-aad4-83aa1f5c2d4c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1025]","ncalrpc:[WindowsShutdown]","ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc068920]"],"executable":"wininit.exe","explained_uuid":"d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0","protocol":"[MS-RSP]: Remote Shutdown Protocol"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c605f9fb-f0a3-4e2a-a073-73560f8d9e3e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-729277d6e71e759854]","ncacn_np:\\\\M051108[\\PIPE\\srvsvc]","ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"certprop.dll","explained_uuid":"30b044a5-a225-43f0-b3a4-e060df91f9c1 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"iphlpsvc.dll","explained_uuid":"552d076a-cb29-4e44-8b6a-d15e59e2c0af v1.0 IP Transition Configuration endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"IKEEXT.DLL","explained_uuid":"a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0 IKE/Authip API","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"86d35949-83c9-4044-b424-db363231fd0c v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"MPSSVC.dll","explained_uuid":"2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8bfc3be1-6def-4e2d-af74-7c47cd0ade4a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"3b338d89-6cfa-44b8-847e-531531bc9992 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"srvsvc.dll","explained_uuid":"98716d03-89ac-44c7-bb8c-285824e51c4a v1.0 XactSrv service","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"1ff70682-0a51-30e8-076d-740be8cee98b v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-1f4f400a89fd304001]","ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"],"executable":"nsisvc.dll","explained_uuid":"7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0 NSI server endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"76f03f96-cdfd-44fc-a22c-64950a001209 v1.0","protocol":"[MS-PAR]: Print System Asynchronous Remote Protocol"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc]","ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"dhcpcsvc.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 DHCP Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"wevtsvc.dll","explained_uuid":"f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 Event log TCPIP","protocol":"[MS-EVEN6]: EventLog Remoting Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"1a0d010f-1c33-432c-b0f5-8cf4e8053099 v1.0 IdSegSrv service","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c36be077-e14b-4fe9-8abc-e856ef4f048b v1.0 Proxy Manager client server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[WindowsShutdown]","ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc068920]","ncalrpc:[WMsgKRpc0BA091]","ncalrpc:[WMsgKRpc0289BF2]"],"executable":"winlogon.exe","explained_uuid":"76f226c3-ec14-4325-8a99-6a46348418af v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncacn_np:\\\\M051108[\\PIPE\\srvsvc]","ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[IUserProfile2]"],"executable":"sysntfy.dll","explained_uuid":"c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 Impl friendly name","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2d98a740-581d-41b9-aa0d-a88b9d5ce938 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"nrpsrv.dll","explained_uuid":"30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 NRP server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"BFE.DLL","explained_uuid":"dd490425-5325-4565-b774-7e27d6c09c24 v1.0 Base Firewall Engine API","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\wkssvc]","ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"7f1343fe-50a9-4927-a778-0c5859517bac v1.0 DfsDs service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"f2c9b409-c1c9-4100-8639-d8ab1486694a v1.0 Witness Client Upcall Server","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1030]"],"executable":"FwRemoteSvr.dll","explained_uuid":"6b5bdd1e-528c-422c-af8c-a4079be4fe48 v1.0 Remote Fw APIs","protocol":"[MS-FASP]: Firewall and Advanced Security Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 v1.0 Adh APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ddacc17bdd42921044]"],"executable":"N/A","explained_uuid":"b2507c30-b126-494a-92ac-ee32b6eeb039 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"eb081a0d-10ee-478a-a1dd-50995283e7a8 v3.0 Witness Client Test Interface","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"4a452661-8290-4b36-8fbe-7f4093a94978 v1.0","protocol":"N/A"}]},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"id":"CENSYS-2022-1025","metrics":{},"name":"Exposed DCERPC Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-06T16:42:06Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":135,"protocol":"DCERPC","scan_time":"2026-09-06T15:36:11Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp"},{"banner":"�؄\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000/\u0000<��p�p\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","banner_hash_sha256":"3eafb65f29d04699ee533a5329edd7fcc03a4a623be0e41032afe81389e2e9cc","banner_hex":"e5d88400000000010000000020434b414141414141414141414141414141414141414141414141414141414141000021000100000000002f003cecef70ab7000000000000000000000000000000000000000000000000000000000000000000000000000000000","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","port":137,"protocol":"NETBIOS","scan_time":"2026-09-07T02:28:50Z","transport_protocol":"udp"},{"banner":"�\u0000\u0000\u0001�","banner_hash_sha256":"ffda6a629d2fc268bbf42019878a56c91ba8a0ca8162c9caa291fff957623e04","banner_hex":"8300000182","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T09:30:36Z"},"port":139,"protocol":"NETBIOS","scan_time":"2026-09-07T09:45:55Z","transport_protocol":"tcp"},{"cert":{"added_at":"2026-08-15T08:45:19Z","ever_seen_in_scan":true,"fingerprint_md5":"d1c6245ff53529256936944f02bbb799","fingerprint_sha1":"8ed826c5a4d251e4114c41bd805cadbaaa453d28","fingerprint_sha256":"5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9","modified_at":"2026-08-15T08:45:19Z","names":["M051108"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["M051108"]},"issuer_dn":"CN=M051108","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"41589344625908147176989412798876321205","serial_number_hex":"1f49d100c949abb941aa0fb62bdf85b5","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"a2791bf8c3e14d5e9d6d6191107e6b53091d530ea61818324cf2a5408a78f93f47e57affe03bef889623fec3a4eec5dbf83674136fc2fc606b8801632edea7d14e1fe4ca0662e9e348890d27e373566aa1c61cbadfb1ef25c3f4fd38c3d6937620d92bb991076fdf80f3f19c42d6d8abd23e1a509f94dceca872f332eb78d0fa3816c5847fc0260f054ccdf108c53ef3a5082e0742d0fe683bb3ea74c08af50e860732275bc9034891546862afe8eb5ef7afd7f6111bcece21d6b5c4ca59170a2175a74cf77125861369b2047c9e30d5668ffbbbce785325e9756c3edd1332d6cdd3e02a878211ed41a07b8bd9df80d5899a64fb04520d63cfd106a34f7aa8c0"},"subject":{"common_name":["M051108"]},"subject_dn":"CN=M051108","subject_key_info":{"fingerprint_sha256":"b9df7ebb8ef6601132112b543ac023199a9fe33e8fce6ef03ee2250c5d2728e6","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"e337f4e05615c11cf4743f38b87a0cc4b3313f7abc5c642901fbd3843349e724d9d0deb581fadecbd8bb02d9c9122303d6bbf2498e2a827a77b6126ab0cbe62e986aa62e2e96cd936d30213e2180f4f71e5b8fa57ac322aab66a5c879e2008c31e1ebe195681834ed90d36b3255530d9b25f079cad7b8f39ee5f21feb7b05051dfd1bc310de0efbb1ba3276d73d1968e98e8c2cfbc12ebf2663d771ea61fe7e11c648478adbf97b65dd773097d00cb21ace23d760a0fcf9933203469d6f0dcc933ed3f74edc8263934fcdccb48405d4ef6e1242645a59e05741d809b4d8ac8773f73f7b6c7c5f3f2533c17a20b15ff98107571b4de52051e0b5bdfe94402d4ff"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-12T17:38:09Z","not_before":"2026-08-13T17:38:09Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5","spki_subject_fingerprint_sha256":"327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5","tbs_fingerprint_sha256":"1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2","tbs_no_ct_fingerprint_sha256":"1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2","validated_at":"2026-09-06T21:52:42Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-15T08:45:19Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"64000_2-1-3-4-8_1460_0_3-6","scan_time":"2026-09-07T09:38:24Z"},"jarm":{"cipher_and_version_fingerprint":"26d26d16d26d26d22c26d26d26d26d","fingerprint":"26d26d16d26d26d22c26d26d26d26dd7fc4c7c6ef19b77a4ca0787979cdc13","ip":"176.120.22.61","is_success":true,"port":3389,"scan_time":"2026-09-05T11:16:24Z","tls_extensions_sha256":"d7fc4c7c6ef19b77a4ca0787979cdc13","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_256_GCM_SHA384","literal_match":"TLS_RSA_WITH_AES_256_GCM_SHA384"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"dynvc_graphics_pipeline":true,"extended_client_data_supported":true,"neg_resp_reserved":true,"restricted_admin_mode":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-07T01:41:33Z","screenshots":[{"extracted_text":"","handle":"efd2d3c6a3734d9ea87930e03e64110e","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_256_GCM_SHA384","fingerprint_sha256":"5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9","ja3s":"f75082535b4a79c07b31bdd0e2b7eb87","ja4s":"t120100_009d_bc98f8e001b5","version_selected":"tlsv1_2","versions":[{"ja3s":"f75082535b4a79c07b31bdd0e2b7eb87","ja4s":"t120100_009d_bc98f8e001b5","version":"tlsv1_2"},{"ja3s":"1308be477c8afb355e2860ab89378ae5","ja4s":"t110100_c014_bc98f8e001b5","version":"tlsv1_1"},{"ja3s":"bcf3a836c82d12ee988005fb0c011445","ja4s":"t100100_c014_bc98f8e001b5","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"id":"CENSYS-2025-1027","metrics":{},"name":"Exposed WINRM Service","risk_source":"censys","severity":"high","source":"censys","year":2025}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:49:46Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":5985,"protocol":"WINRM","scan_time":"2026-09-03T22:08:29Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp","winrm":{"auth_types":["Negotiate"],"ntlm_info":{"always_sign_supported":true,"challenge_type":3,"dns_domain_name":"M051108","dns_server_name":"M051108","encryption_128bit_supported":true,"encryption_56bit_supported":true,"netbios_computer_name":"M051108","netbios_domain_name":"M051108","ntlm1_supported":true,"ntlm2_supported":true,"ntlm_version":15,"os_version":"6.3.9600","target_name":"M051108"}}},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"176.120.22.61","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://176.120.22.61:47001/"},"ip":"176.120.22.61","path":"/","port":47001,"scan_time":"2026-09-07T08:04:01Z","transport_protocol":"tcp"}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:40:40Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-07T08:04:01Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["176.120.22.0/24"],"created":"2024-08-27T00:00:00Z","handle":"RU-PROTON66-20240827","name":"Proton66 OOO","updated":"2024-08-27T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@proton66.ru","handle":"AR70098-RIPE","name":"Abuse-C Role"}],"address":"DISTRICT No. 54, ISKROVSKY PR-KT, D. 21, LIT. U, kv.218\\n193230\\nST. PETERSBURG\\nRUSSIAN FEDERATION","admin_contacts":[{"email":"mail@proton66.ru","handle":"TD6653-RIPE","name":"Tech dept."}],"handle":"ORG-PO84-RIPE","name":"Proton66 OOO"}}}}},"services":{"result":{"next_page_token":"02d52b35a517b30b2b695fbb:gh0JPwvaJkzKw4pU+j7uvr6ac7UjnIeezU0WAjXWRNq+6Sl4BPacLsiWU9V6W+cKLav69TTbJu1uTaWrPsUtx8loj5Gbc8SL9J4VB9gAcBJwL9hMUmO1IQSfgD21O33HYkFi3HhamhtkHcvQAAPMrNrPDkengOPbpEDNJ1nFqznfvarwpnxWy9362afBeoIKsgD34DRY+FXqAt5TjeRjUSqJr/WbwFZeydyCBFtjA7WFqaAoXrRtDpOL6wvMHAhjMP6DodMIz3wI155dtm49Jz/r44kahbRGjcCzttbEymzC9/WtEVfn7jZXDHkfo0otS2sKopN0icLkzc0Bl48vwQft5GTvT8FMYq4sNHf1qxsNtda2U3ljTrFhXSZu2+OTBOBRQ6Fr0kgcGplYwLOY0Jd72G/PMTmz8Fa5Yi7vWPXrOAzLgnurUnHVXU/9Gvr3PodmZEUw+B9wVAyTglxr/6+G5YtWel5zf1FG7gS6ZTuNrT5El3rF/B9wsk96hzS1VnU9Y56jVn84q6uqG2uk5DOuCPGI2Wq05MKFT/Ca4Bqen4u7b8+YW+y/ZeJSMz6++V4NMh9JhsfdGMhSZEvdNGADxFq+fLIkG45MoOLmM6ETXuYBBZkSBatKCwskWwS7uV0RQsEnkJRfX2uIngZvjdAtcgyTFbU4opKnxBknXamvIRk9qWfXGHpGuTzbM8THish/lyHeaTt6Q6QpnvZMm2gMTAXwJuWcBAT6i4jDpZv6L0/XYY5S1xGrC9uLr7nrjcE6RPf4","ranges":[{"end_time":"2026-09-07T01:41:34.02976Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-08-06T19:47:31.859886Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T16:36:46.224868Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-08-20T07:42:14.372647Z","transport_protocol":"UDP"},{"end_time":"2026-09-06T15:36:12.257911Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-08-06T02:43:46.311271Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T08:33:01.67775Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-09-02T02:12:44.871529Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T05:55:16.624856Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-08-06T02:43:52.747803Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T04:01:47.692342Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-08-06T02:44:01.749124Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T22:08:30.585154Z","ip":"176.120.22.61","port":"5985","protocol":"WINRM","start_time":"2026-09-03T22:08:29.585154Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T05:35:21.503535Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-09-01T05:34:56.997486Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T05:34:29.380106Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-31T05:20:25.159832Z","transport_protocol":"TCP"},{"end_time":"2026-08-30T10:32:06.311402Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-27T12:18:02.047257Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T08:43:41.570019Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-27T08:43:40.570019Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T10:21:46.760391Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-26T10:20:25.67231Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T08:13:36.504647Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-26T08:13:35.504647Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T08:13:12.42251Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-25T04:43:30.494382Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T17:34:19.531526Z","ip":"176.120.22.61","port":"5985","protocol":"WINRM","start_time":"2026-08-08T19:17:33.821091Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T07:36:40.054527Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-23T06:50:12.773792Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T15:23:44.11493Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-22T08:38:09.523732Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T08:37:33.581826Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:41:17.778311Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:38:14.917603Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:38:13.917603Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:19:00.451075Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-21T07:18:59.451075Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T06:44:17.276544Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-20T06:44:16.276544Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T07:50:18.707543Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-18T11:41:13.716445Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T02:49:51.723149Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-08-09T20:06:57.477747Z","transport_protocol":"UDP"},{"end_time":"2026-08-17T14:01:55.895553Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-17T14:01:53.811806Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T14:01:48.234317Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-17T14:01:47.234317Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T14:01:34.438545Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-16T07:32:40.445243Z","transport_protocol":"TCP"},{"end_time":"2026-08-15T13:38:22.298154Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-06T18:41:27.264213Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T01:37:40.529844Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-05T01:37:39.529844Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T18:00:08.854314Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-08-04T18:00:07.854314Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T00:07:25.545518Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-08-04T00:07:24.545518Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T18:17:40.953526Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-06-11T18:17:39.953526Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T17:13:52.184593Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-06-11T17:13:51.184593Z","transport_protocol":"TCP"},{"end_time":"2026-06-03T05:21:47.778097Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-06-03T05:21:46.778097Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T13:21:45.552973Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-06-01T13:21:44.552973Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T11:59:37.716174Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-31T11:59:36.716174Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T04:38:06.680817Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-31T04:38:05.680817Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T22:14:19.208939Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-29T22:14:18.208939Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T07:02:58.389854Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-29T07:02:57.389854Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T04:05:25.20307Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-29T04:05:24.20307Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T17:28:28.787203Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-05-28T17:28:27.787203Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:13:50.268721Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-27T01:07:49.294913Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T11:39:31.149123Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-21T11:39:30.149123Z","transport_protocol":"TCP"},{"end_time":"2026-05-20T06:35:47.601788Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-18T05:24:08.392658Z","transport_protocol":"TCP"},{"end_time":"2026-05-17T01:18:18.028105Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-17T01:18:17.028105Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T15:31:29.175412Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-15T15:31:28.175412Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T04:14:16.791927Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-05-15T04:14:15.791927Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T03:55:36.848816Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-15T03:55:35.848816Z","transport_protocol":"TCP"},{"end_time":"2026-05-14T14:56:17.761063Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-14T14:56:16.761063Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T15:08:00.800876Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-13T15:07:59.800876Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T03:26:28.627729Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-05-12T07:50:34.962837Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T02:20:49.751824Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-13T02:20:48.751824Z","transport_protocol":"TCP"},{"end_time":"2026-05-12T18:40:14.353273Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-12T18:40:13.353273Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T18:48:39.930699Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-11T18:48:38.930699Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T02:01:01.410146Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-10T02:24:06.195117Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T22:31:35.377374Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-10T22:31:34.377374Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T05:37:23.559231Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-10T05:37:22.559231Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T21:37:43.506453Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-09T21:37:42.506453Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T21:37:29.450271Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-09T21:37:28.450271Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T19:54:50.330648Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-05-09T19:54:49.330648Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:15:58.311145Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-07T22:59:54.997321Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:15:51.999282Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-08T21:15:50.999282Z","transport_protocol":"TCP"},{"end_time":"2026-05-07T18:31:48.72907Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-06T17:48:21.177639Z","transport_protocol":"TCP"},{"end_time":"2026-05-05T02:28:47.751376Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-05-05T02:28:46.751376Z","transport_protocol":"UDP"},{"end_time":"2026-05-04T08:28:18.641295Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-05-04T08:28:17.641295Z","transport_protocol":"TCP"},{"end_time":"2026-05-03T02:16:38.304547Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-05-03T02:16:37.304547Z","transport_protocol":"UDP"},{"end_time":"2026-05-02T04:21:56.385586Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-05-02T04:21:55.385586Z","transport_protocol":"TCP"},{"end_time":"2026-05-01T11:51:04.381131Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-30T11:09:07.220963Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T22:59:39.760584Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-29T21:47:33.085667Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T00:32:19.26696Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-27T23:16:37.032761Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T12:17:13.960929Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-29T12:17:12.960929Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T06:41:09.172449Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-29T06:41:08.172449Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T22:32:55.762689Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-04-27T01:40:45.637947Z","transport_protocol":"UDP"},{"end_time":"2026-04-28T21:27:04.225648Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-28T21:27:03.225648Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T16:35:18.810593Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-28T16:35:17.810593Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T12:48:34.982189Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-27T11:58:42.4909Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T08:44:26.059079Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-28T08:44:25.059079Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T22:15:41.662264Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-27T22:15:40.662264Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T16:13:54.947103Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-27T16:13:53.947103Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T07:45:54.375223Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-27T07:45:53.375223Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T13:58:08.231706Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-26T13:58:07.231706Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T02:15:30.006463Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-26T02:15:29.006463Z","transport_protocol":"TCP"},{"end_time":"2026-04-25T18:53:50.934945Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-21T15:02:44.256579Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T21:16:57.206015Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-24T21:16:56.206015Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T21:08:12.467422Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-23T19:45:59.138797Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T12:41:05.027246Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-24T12:41:04.027246Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T12:33:52.933439Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-23T12:17:21.241554Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T18:51:16.543959Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-04-22T18:51:15.543959Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T15:36:46.004145Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-22T15:36:45.004145Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T11:21:05.741384Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-22T11:21:04.741384Z","transport_protocol":"TCP"},{"end_time":"2026-04-21T10:32:12.509336Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-18T07:58:05.149909Z","transport_protocol":"TCP"},{"end_time":"2026-04-21T04:32:24.241526Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-19T02:57:17.731764Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T23:16:25.20814Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-20T23:16:24.20814Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T19:17:26.020854Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-20T19:17:25.020854Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T10:05:01.609157Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-20T10:05:00.609157Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T02:35:39.603981Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-19T01:36:31.641712Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T04:53:03.044811Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-17T02:48:43.238301Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T01:36:00.433291Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-18T00:53:03.996167Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T19:42:29.956391Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-17T19:42:28.956391Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T13:37:34.38622Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-16T12:40:28.151909Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T02:45:51.877095Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-17T02:45:50.877095Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.222","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1159,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.222.ptr.pfcloud.network"],"resolve_time":"2026-09-03T08:05:36Z"}},"ip":"204.76.203.222","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.222","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-06T01:52:43Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T12:39:40Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.817,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.973,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T12:39:41.689695Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2026-06-02T05:41:32.394Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:46:14.93478Z","ip":"204.76.203.222","port":"67","protocol":"HTTP","start_time":"2026-08-22T19:08:14.446773Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:57:30.772986Z","ip":"204.76.203.222","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:23:25.207379Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T22:04:38.778346Z","ip":"204.76.203.222","port":"9191","protocol":"HTTP","start_time":"2026-06-02T02:59:26.327593Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T12:23:22.168316Z","ip":"204.76.203.222","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:42:54.382087Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T12:22:50.500211Z","ip":"204.76.203.222","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:42:51.353662Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T12:40:08.094069Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2026-03-10T19:33:16.341751Z","transport_protocol":"TCP"},{"end_time":"2025-12-26T20:41:41.855735Z","ip":"204.76.203.222","port":"27015","protocol":"VALVE","start_time":"2025-12-25T19:50:39.369707Z","transport_protocol":"UDP"},{"end_time":"2025-11-14T14:49:34.962727Z","ip":"204.76.203.222","port":"80","protocol":"HTTP","start_time":"2025-11-08T16:56:37.952227Z","transport_protocol":"TCP"},{"end_time":"2025-11-14T02:37:36.078766Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2025-11-02T16:25:52.557356Z","transport_protocol":"TCP"},{"end_time":"2025-11-14T01:53:18.915475Z","ip":"204.76.203.222","port":"25","protocol":"SMTP","start_time":"2025-11-09T10:25:39.200602Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:55:07.570045Z","ip":"204.76.203.222","port":"8080","protocol":"HTTP","start_time":"2025-11-08T17:16:02.424874Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:48:31.240446Z","ip":"204.76.203.222","port":"3128","protocol":"HTTP","start_time":"2025-11-08T16:46:49.894088Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:43:58.158957Z","ip":"204.76.203.222","port":"443","protocol":"HTTP","start_time":"2025-11-08T17:32:06.024704Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:37:42.094604Z","ip":"204.76.203.222","port":"25","protocol":"HTTP","start_time":"2025-11-08T17:24:12.669007Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T17:07:53.199674Z","ip":"204.76.203.222","port":"110","protocol":"HTTP","start_time":"2025-11-08T14:47:46.739142Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T16:20:49.229546Z","ip":"204.76.203.222","port":"143","protocol":"HTTP","start_time":"2025-11-08T14:08:41.926986Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T14:56:34.02391Z","ip":"204.76.203.222","port":"3389","protocol":"HTTP","start_time":"2025-11-08T13:44:50.629124Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T13:06:24.280379Z","ip":"204.76.203.222","port":"139","protocol":"NETBIOS","start_time":"2025-10-10T17:44:57.963724Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T12:52:12.544169Z","ip":"204.76.203.222","port":"5357","protocol":"HTTP","start_time":"2025-10-08T07:49:57.916094Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T09:39:04.243743Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-10-10T17:37:57.211989Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T08:44:09.470349Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-10-08T08:34:30.904217Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T07:46:48.22387Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-10-10T17:36:03.428026Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T22:30:28.361543Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-10-07T22:09:44.223632Z","transport_protocol":"UDP"},{"end_time":"2025-10-13T18:31:27.159773Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-10-07T22:59:36.401285Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T14:32:09.469151Z","ip":"204.76.203.222","port":"135","protocol":"DCERPC","start_time":"2025-10-10T17:36:08.514572Z","transport_protocol":"TCP"},{"end_time":"2025-10-04T19:23:12.042373Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-10-02T17:41:35.929601Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T19:01:09.512006Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-10-02T17:43:33.167121Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T18:35:31.43832Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-10-02T11:39:18.577069Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T17:38:48.359586Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-10-02T16:34:22.052524Z","transport_protocol":"UDP"},{"end_time":"2025-10-03T12:32:38.251236Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-10-02T11:46:13.66808Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T09:29:43.273887Z","ip":"204.76.203.222","port":"135","protocol":"DCERPC","start_time":"2025-09-27T00:49:43.669932Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:03:54.096497Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-09-27T00:50:03.370604Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T06:07:50.018474Z","ip":"204.76.203.222","port":"139","protocol":"NETBIOS","start_time":"2025-09-27T00:49:43.728869Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T21:30:56.86317Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-09-27T00:49:44.943185Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T17:29:19.342834Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-09-27T00:49:46.01324Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T17:06:37.955937Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-09-24T22:13:42.890905Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T15:31:25.773843Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-09-27T00:50:55.274143Z","transport_protocol":"UDP"},{"end_time":"2025-09-30T14:34:28.817436Z","ip":"204.76.203.222","port":"6000","protocol":"X11","start_time":"2025-09-29T13:45:07.259993Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.221","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1154,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.221.ptr.pfcloud.network"],"resolve_time":"2026-09-01T08:58:36Z"}},"ip":"204.76.203.221","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.221","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-07T08:17:47Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T10:34:20Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.818,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.972,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.941,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.446,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.162,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.162,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.075,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.212,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.003,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T10:34:21.770801Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2026-06-03T01:42:00.622493Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:46:09.030538Z","ip":"204.76.203.221","port":"67","protocol":"HTTP","start_time":"2026-08-22T19:08:41.66154Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:56:48.67344Z","ip":"204.76.203.221","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:18:50.253453Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T21:42:46.334404Z","ip":"204.76.203.221","port":"9191","protocol":"HTTP","start_time":"2026-06-02T01:46:29.990534Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:56:50.458314Z","ip":"204.76.203.221","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:12:19.839021Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:56:05.5247Z","ip":"204.76.203.221","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:12:08.205176Z","transport_protocol":"TCP"},{"end_time":"2025-11-18T10:47:33.189899Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-11-16T17:37:46.5025Z","transport_protocol":"TCP"},{"end_time":"2025-11-18T09:38:02.481763Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-11-16T16:26:35.581182Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T23:00:58.146943Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-11-16T15:19:39.660248Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T23:00:20.19446Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-11-16T16:21:47.601236Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T20:47:18.560129Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-11-16T17:42:21.614573Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T13:21:20.689292Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-11-16T09:19:25.147118Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T11:50:15.353021Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-11-16T11:07:22.595649Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T09:37:33.237394Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-11-16T21:50:37.048599Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T19:06:43.214522Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-11-16T19:06:42.214522Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T02:51:37.869772Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-10-26T05:34:47.035623Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T01:24:36.71023Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-10-25T21:39:35.88889Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T15:28:28.289133Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-10-25T06:58:09.593489Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:50:03.76277Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-10-25T11:49:36.44012Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:30:20.446965Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-10-25T06:09:23.440522Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:29:31.161169Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-10-25T06:09:02.301978Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:03:58.259723Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-10-25T14:44:52.622209Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T11:46:16.687351Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-10-25T02:11:15.444257Z","transport_protocol":"TCP"},{"end_time":"2025-11-11T19:32:37.322003Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-10-25T14:44:38.14463Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T20:14:23.461096Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-10-03T06:52:51.849196Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T19:56:28.664434Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-10-02T20:19:49.3742Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T19:00:09.28638Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-10-03T07:59:42.948156Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T15:14:44.575091Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-10-03T06:21:11.80278Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T13:22:08.425446Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-10-22T08:10:31.475304Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T09:01:45.041238Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-10-03T06:33:11.146401Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T09:01:16.207092Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-10-23T08:47:16.838109Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T08:31:54.552702Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-10-03T01:40:40.421355Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T09:34:08.925846Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-10-02T21:49:00.406377Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T08:06:05.901521Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-09-10T09:07:00.890855Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:36:38.404741Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-09-10T08:14:51.765612Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T06:00:35.005462Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-09-10T05:07:24.798472Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T05:35:11.670717Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-09-10T09:14:06.90757Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T01:13:40.623702Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-09-10T07:38:35.672012Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:56:02.272686Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-09-10T15:34:00.563975Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:08:25.742367Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-09-10T10:17:21.049767Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T16:42:30.887078Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-08-21T14:01:27.222303Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T14:34:45.271796Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-08-26T13:43:23.326874Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T09:13:17.61131Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-08-25T21:52:38.784757Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:17:35.18683Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-08-18T13:02:39.529457Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T07:01:34.088124Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-08-26T11:09:44.140382Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T06:49:54.778998Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-08-19T05:51:03.993422Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T03:50:46.472401Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-08-18T18:01:29.391642Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.213","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1123,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.213.ptr.pfcloud.network"],"resolve_time":"2026-09-05T08:21:38Z"}},"ip":"204.76.203.213","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.213","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-05T01:39:42Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-07T07:46:44Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.817,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.973,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T06:20:02.37053Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2026-06-02T06:09:21.954228Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:45:50.412574Z","ip":"204.76.203.213","port":"67","protocol":"HTTP","start_time":"2026-08-22T16:22:15.394174Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:57:40.481024Z","ip":"204.76.203.213","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:48:59.641133Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T22:24:18.626104Z","ip":"204.76.203.213","port":"9191","protocol":"HTTP","start_time":"2026-06-02T00:33:06.621771Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:57:49.354509Z","ip":"204.76.203.213","port":"666","protocol":"HTTP","start_time":"2026-06-02T00:28:10.739429Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:57:16.480892Z","ip":"204.76.203.213","port":"666","protocol":"HTTP","start_time":"2026-06-02T00:28:05.405631Z","transport_protocol":"TCP"},{"end_time":"2026-01-14T06:32:12.533854Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2025-12-31T09:14:13.738025Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T14:30:50.497886Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2025-12-16T17:14:17.210439Z","transport_protocol":"TCP"},{"end_time":"2025-10-20T00:07:55.584802Z","ip":"204.76.203.213","port":"80","protocol":"HTTP","start_time":"2025-10-03T01:25:36.903683Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T03:46:53.817728Z","ip":"204.76.203.213","port":"80","protocol":"HTTP","start_time":"2025-09-20T20:14:26.451254Z","transport_protocol":"TCP"}]}}} +{"ip":"185.246.217.150","asn":"AS210644","name":"AEZA-AS","honeylabs_events":51,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":210644,"bgp_prefix":"185.246.217.0/24","country_code":"RU","description":"AEZA-AS - AEZA GROUP LLC","name":"AEZA-AS - AEZA GROUP LLC"},"dns":{"reverse_dns":{"resolve_time":"2026-09-06T13:42:52Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-09-01T00:00:00Z","tags":[{"name":"Apache HTTP Server Path Traversal Attempt"},{"name":"Apache HTTP Server Path Traversal CVE-2021-41773 RCE Attempt"},{"name":"CGI Script Scanner"},{"name":"Docker Scanner"},{"name":"Generic IoT Default Password Attempt"},{"name":"Generic Path Traversal Attempt"},{"name":"Generic Sensitive File Access Attempt"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"PHP CGI CVE-2012-1823 Remote Code Execution Attempt"},{"name":"PHP CVE-2024-4577 RCE Attempt"},{"name":"PHP InvokeFunction Attacker"},{"name":"PHPUnit CVE-2017-9841 RCE Attempt"},{"name":"SSH Alternative Port Crawler"},{"name":"SSH Connection Attempt"},{"name":"TLS/SSL Crawler"},{"name":"Telnet Bruteforcer"},{"name":"Telnet Login Attempt"},{"name":"Telnet Protocol"},{"name":"ThinkPHP Code Execution CVE-2019-9082"},{"name":"ThinkPHP Framework LFI CVE-2022-47945 Attempt"},{"name":"ThinkPHP RCE Attempt"},{"name":"Web Crawler"}]},"ip":"185.246.217.150","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Amsterdam","continent":"Europe","coordinates":{"latitude":52.37403,"longitude":4.88969},"country":"Netherlands","country_code":"NL","postal_code":"1012","province":"North Holland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"anonymous":true,"source":"IPINFO","vpn":true}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.884},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6","banner_hash_sha256":"2273abc4876744fd39fbca4340aba60bfa05a980df8e117c11bd8c4dd41f4486","banner_hex":"5353482d322e302d4f70656e5353485f31302e327031205562756e74752d327562756e7475332e36","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.246.217.150","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1320_11_1-2-4-8-16","scan_time":"2026-09-06T08:38:48Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T20:15:25Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"10.2p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-2ubuntu3.6","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6","software_version":"OpenSSH_10.2p1"},"hassh_fingerprint":"671c5858369db8e0a60108d866bbf8ec","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["mlkem768x25519-sha256","sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","ext-info-s","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"jlggM4O0YYvsMAO7iXsRVvq45AR7hbu6gyyujJqWzIs=","y":"cOo4b1uge9uSm1UPf67GzTnJp73503RFxbjyYdh1q4c="},"fingerprint_sha256":"408d8e8896afad45eb74acbf94672a5ec60acd3a71cbdbdba54f2a1b04ef482e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"},{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":">=10.0 && <10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"cidrs":["185.246.217.0/24"],"created":"2025-06-30T00:00:00Z","handle":"NETCRAFTERS","name":"NetCrafters OU","updated":"2026-08-06T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"ripe@netcrafters.host","handle":"ACRO62610-RIPE","name":"Abuse contact role object"}],"address":"Ida-Viru maakond, Kohtla-Järve linn, Sompa linnaosa, Tulika tn 6, 30721","handle":"ORG-NO63-RIPE","name":"NetCrafters OU"}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T20:15:26.130072Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-09-04T13:16:01.856056Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:15:24.207063Z","ip":"185.246.217.150","port":"8000","protocol":"HTTP","start_time":"2026-08-30T19:18:43.517726Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T05:45:52.372336Z","ip":"185.246.217.150","port":"2096","protocol":"HTTP","start_time":"2026-08-06T23:12:30.652927Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T17:35:04.958144Z","ip":"185.246.217.150","port":"80","protocol":"HTTP","start_time":"2026-08-05T23:59:08.290999Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T16:06:13.331855Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-08-06T22:03:51.516619Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T09:36:56.940525Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-09-02T00:19:30.485699Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T18:06:09.324897Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-08-28T07:45:45.101812Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T01:17:19.891341Z","ip":"185.246.217.150","port":"2096","protocol":"UNKNOWN","start_time":"2026-08-06T23:11:55.709959Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T16:31:11.563696Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-08-05T16:31:10.563696Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T16:22:29.716999Z","ip":"185.246.217.150","port":"500","protocol":"IKE","start_time":"2026-06-05T00:39:23.563989Z","transport_protocol":"UDP"},{"end_time":"2026-07-06T02:22:08.738443Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-06-06T19:21:45.939039Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T21:15:22.922969Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-11-05T10:56:45.816243Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T20:47:25.993807Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-10T19:26:47.896459Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T20:32:35.534824Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-11-10T09:22:21.944299Z","transport_protocol":"TCP"},{"end_time":"2025-11-11T18:30:48.140841Z","ip":"185.246.217.150","port":"31053","protocol":"UNKNOWN","start_time":"2025-11-02T14:49:40.37092Z","transport_protocol":"TCP"},{"end_time":"2025-11-10T14:57:33.32334Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-09T12:54:32.901561Z","transport_protocol":"TCP"},{"end_time":"2025-11-10T01:22:04.459076Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-11-04T03:19:54.947211Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T08:32:13.84649Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-03T18:19:41.086518Z","transport_protocol":"TCP"},{"end_time":"2025-11-05T10:50:16.960735Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-31T15:11:10.212765Z","transport_protocol":"TCP"},{"end_time":"2025-11-03T19:19:29.784417Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-25T04:35:43.820828Z","transport_protocol":"TCP"},{"end_time":"2025-11-03T06:06:10.556761Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-03T01:32:17.825609Z","transport_protocol":"TCP"},{"end_time":"2025-11-02T07:48:17.100526Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-31T09:11:28.04361Z","transport_protocol":"TCP"},{"end_time":"2025-10-31T08:51:04.348198Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-31T05:43:21.873551Z","transport_protocol":"TCP"},{"end_time":"2025-10-31T07:34:02.599765Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-31T05:02:08.598011Z","transport_protocol":"TCP"},{"end_time":"2025-10-30T15:30:39.983256Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-27T09:54:57.848415Z","transport_protocol":"TCP"},{"end_time":"2025-10-30T10:27:10.511285Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-26T04:01:15.032632Z","transport_protocol":"TCP"},{"end_time":"2025-10-27T05:41:55.276185Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-26T05:06:24.164276Z","transport_protocol":"TCP"},{"end_time":"2025-10-26T00:38:56.019669Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-24T23:57:44.330955Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T11:21:31.026885Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-23T11:21:30.026885Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T11:21:03.103064Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-23T11:21:02.103064Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T08:57:16.640174Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-23T08:57:15.640174Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T05:14:07.020065Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-22T02:41:11.702961Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T00:00:03.446783Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-20T22:50:20.390947Z","transport_protocol":"TCP"},{"end_time":"2025-10-22T08:25:35.237939Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-21T07:43:43.443458Z","transport_protocol":"TCP"},{"end_time":"2025-10-21T23:31:52.393019Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-20T22:07:53.202277Z","transport_protocol":"TCP"},{"end_time":"2025-10-20T00:35:42.382978Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-18T23:10:34.3167Z","transport_protocol":"TCP"},{"end_time":"2025-10-19T04:56:51.268252Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-18T02:32:49.94938Z","transport_protocol":"TCP"},{"end_time":"2025-10-19T00:22:12.263415Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-17T23:22:44.397481Z","transport_protocol":"TCP"},{"end_time":"2025-10-16T14:40:53.085523Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-15T04:07:37.98329Z","transport_protocol":"TCP"},{"end_time":"2025-10-16T06:08:18.485867Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-15T04:54:42.838868Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T22:52:59.568857Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-14T22:41:40.190485Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T00:34:21.832891Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-11T00:52:37.748432Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T00:15:44.573013Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-13T23:43:50.713324Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T13:58:57.709139Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-13T05:04:07.876428Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T08:20:19.188412Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-07T15:49:29.594439Z","transport_protocol":"TCP"},{"end_time":"2025-10-12T20:23:47.018515Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-11T19:39:56.077607Z","transport_protocol":"TCP"},{"end_time":"2025-10-11T15:50:52.359194Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-09T20:33:46.777118Z","transport_protocol":"TCP"},{"end_time":"2025-10-10T20:13:28.271856Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-09T18:40:24.145521Z","transport_protocol":"TCP"},{"end_time":"2025-10-09T11:48:18.404862Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-02T20:52:44.239023Z","transport_protocol":"TCP"},{"end_time":"2025-10-09T05:31:52.161261Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-03T15:47:18.881195Z","transport_protocol":"TCP"},{"end_time":"2025-10-07T07:22:43.801868Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-02T11:55:56.046037Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T11:31:15.47426Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-02T10:35:12.26799Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T12:31:10.317513Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-30T10:27:45.115947Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T11:47:58.501614Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-28T07:04:28.249128Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T11:29:37.91748Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-01T11:29:36.91748Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T07:22:09.714259Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-27T12:45:12.738351Z","transport_protocol":"TCP"},{"end_time":"2025-09-30T06:35:16.394719Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-29T05:48:38.454473Z","transport_protocol":"TCP"},{"end_time":"2025-09-29T01:45:07.609045Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-28T01:12:24.798366Z","transport_protocol":"TCP"},{"end_time":"2025-09-28T02:49:02.540332Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-25T04:44:38.244544Z","transport_protocol":"TCP"},{"end_time":"2025-09-27T20:31:54.855534Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-17T04:48:36.620228Z","transport_protocol":"TCP"},{"end_time":"2025-09-27T08:29:24.571014Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-24T14:34:06.461087Z","transport_protocol":"TCP"},{"end_time":"2025-09-25T00:51:42.177622Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-20T05:56:23.203021Z","transport_protocol":"TCP"},{"end_time":"2025-09-24T10:37:35.886782Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-18T06:28:56.900038Z","transport_protocol":"TCP"},{"end_time":"2025-09-19T10:52:15.187437Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-16T23:01:55.72855Z","transport_protocol":"TCP"},{"end_time":"2025-09-18T02:57:11.424483Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-17T02:04:15.779875Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T16:32:19.426001Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-10T15:31:17.369913Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T07:21:04.577443Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-10T07:43:44.745046Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T00:22:14.719409Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-10T01:48:03.073862Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T14:31:44.026213Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-08-18T22:17:02.299728Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T11:19:04.453788Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-08-19T09:39:43.080163Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:59:18.444225Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-08-18T18:16:12.28019Z","transport_protocol":"TCP"}]}}} +{"ip":"45.61.157.82","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":32,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"45.61.156.0/23","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"forward_dns":{"cldz.abdorahmanamani.ir":{"name":"cldz.abdorahmanamani.ir","record_type":"a","resolve_time":"2026-09-06T14:46:49Z"},"golagen1.lol":{"name":"golagen1.lol","record_type":"a","resolve_time":"2026-09-06T13:01:20Z"},"hansinitoin.click":{"name":"hansinitoin.click","record_type":"a","resolve_time":"2026-09-06T19:34:19Z"},"sandarter.click":{"name":"sandarter.click","record_type":"a","resolve_time":"2026-09-07T01:56:13Z"},"usbailnk.one":{"name":"usbailnk.one","record_type":"a","resolve_time":"2026-09-07T08:58:28Z"},"usbalnk.live":{"name":"usbalnk.live","record_type":"a","resolve_time":"2026-09-07T08:38:20Z"},"vacsu.sbs":{"name":"vacsu.sbs","record_type":"a","resolve_time":"2026-09-06T21:06:10Z"},"www.golagen1.lol":{"name":"www.golagen1.lol","record_type":"a","resolve_time":"2026-09-06T15:38:43Z"},"www.hansinitoin.click":{"name":"www.hansinitoin.click","record_type":"a","resolve_time":"2026-09-07T08:54:26Z"},"www.sandarter.click":{"name":"www.sandarter.click","record_type":"a","resolve_time":"2026-09-06T21:07:26Z"},"www.usbailnk.one":{"name":"www.usbailnk.one","record_type":"a","resolve_time":"2026-09-06T13:08:49Z"},"www.usbalnk.live":{"name":"www.usbalnk.live","record_type":"a","resolve_time":"2026-09-07T03:04:38Z"},"www.vacsu.sbs":{"name":"www.vacsu.sbs","record_type":"a","resolve_time":"2026-09-06T14:14:55Z"}},"names":["cldz.abdorahmanamani.ir","golagen1.lol","hansinitoin.click","sandarter.click","usbailnk.one","usbalnk.live","vacsu.sbs","www.golagen1.lol","www.hansinitoin.click","www.sandarter.click","www.usbailnk.one","www.usbalnk.live","www.vacsu.sbs"],"reverse_dns":{"names":["82.157.61.45.static.cloudzy.com"],"resolve_time":"2026-08-31T14:20:46Z"}},"ip":"45.61.157.82","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Las Vegas","continent":"North America","coordinates":{"latitude":36.1008,"longitude":-115.1365},"country":"United States","country_code":"US","postal_code":"89119","province":"Nevada","timezone":"America/Los_Angeles"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.504},"service_count":2,"services":[{"cert":{"added_at":"2026-08-04T18:32:54Z","ever_seen_in_scan":true,"fingerprint_md5":"2ac861116f676b05a73a58bbd61e28cd","fingerprint_sha1":"afe246d55b3ffae584b44511d866ff535da0e292","fingerprint_sha256":"de69af101d75f3f928e6e9d336602e5a0ee3bfe3251b49da4f1392fd77a56986","modified_at":"2026-08-04T18:32:54Z","names":["ubuntu-LasVegas"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["ubuntu-LasVegas"]},"issuer_dn":"CN=ubuntu-LasVegas","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"118999415673907554624953375300177860427","serial_number_hex":"5986742c4f0336b0472ee80fa5bb974b","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"6891ce86caedfe1db6c096145cf9cdeb1f64c7cfd138470b649d130cca789cd080aab78d2c2c7531eda6e2469e37128616f05cef14bff7ef6ff0d51d9a11c306041812e94c2c6ba64e17debb4fc02abfed62a91d6741503269e670875c89edbc4ee5b6ee89e7ff04b48de66c5985e84ffdde2f021f485853e94518200735705501c5bbb0263c7c6075c689c647ca572293bcdf440a63ca5d8956c9223c99871f8011dc6e1287959dd33dd3c8f8ec693232f33c9b05cac4fe0ad1e49e2edaf5b4bf9cd401b6ba20bf6cecdef164bf3e59941fb96ad473a77478e107f7904a409c087b3d66a4027a95118e90d8fe52c1146a7ceceea236ed52a7afff8bd06f34f3"},"subject":{"common_name":["ubuntu-LasVegas"]},"subject_dn":"CN=ubuntu-LasVegas","subject_key_info":{"fingerprint_sha256":"01e258525bfb44566da7c16431ffd6d6eb3e28cde5799fd00a50156d2a74977d","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"a5d2899c0616dc88692b38055c49962f7a4ab2ddf5a9cb832ac09b71539debfadb1c30c941bd0605af9b3b92cbfb0b924b8979cd32fd8bef193acbbd1a994fe4f6f930ddf58a2917eac01b002eb8142a7036acf5e46e1f318af540d8e7b6333842944d285177108054c827bb4a1deae8ede57167fd25abd75f564758420efcc1723ca7d9d78e15c828049e35cae5727b3c3ed84d59c3046238b47fd6f2332b6c84f8c60a084d94e357033cab1b285b951852762e88daeb82a99d27d2e7ebe25a9e716db697ac2d30730d25842357d095e5e4601677b3998e7af79fedb4f7ebf24ec3d700615918951ac5f83d5c845e1da44a5fc13216acafbdfcc1c55fc1323f"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-02T17:31:06Z","not_before":"2026-08-03T17:31:06Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"f5f97b53d902cccd32aa6310e93fd16d0e3340763c0a30c9b4082355c8d5758a","spki_subject_fingerprint_sha256":"f5f97b53d902cccd32aa6310e93fd16d0e3340763c0a30c9b4082355c8d5758a","tbs_fingerprint_sha256":"4abf4451c0761d67c1f89ffe99d1af527e6cbaed7dbe5189fb4edf2fef74bbbf","tbs_no_ct_fingerprint_sha256":"4abf4451c0761d67c1f89ffe99d1af527e6cbaed7dbe5189fb4edf2fef74bbbf","validated_at":"2026-09-06T18:28:13Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-04T18:32:54Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"45.61.157.82","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T08:40:08Z"},"jarm":{"cipher_and_version_fingerprint":"06b06b00006b06b06b06b06b06b06b","fingerprint":"06b06b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"45.61.157.82","is_success":true,"port":3389,"scan_time":"2026-09-03T19:07:13Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-06T11:35:04Z","screenshots":[{"extracted_text":"Administrator Logged on Password ↑ Cancel Windows Server 2008 R2 Standard","handle":"f6e40afdee8140da9dc59388fad30255","phash":"cc227733cc0cdb33"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"de69af101d75f3f928e6e9d336602e5a0ee3bfe3251b49da4f1392fd77a56986","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"45.61.157.82","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://45.61.157.82:47001/"},"ip":"45.61.157.82","path":"/","port":47001,"scan_time":"2026-09-06T16:00:35Z","transport_protocol":"tcp"}],"ip":"45.61.157.82","ja4tscan":{"fingerprint":"8192_2-4-8_1460_0_3-6","scan_time":"2026-09-07T01:06:52Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-06T16:00:35Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["45.61.156.0/23"],"created":"2024-04-06T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2024-04-06T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"0a159073e7622c2db7674259:Cn7vcPfLETg7M0oPSa8X/Ku7B6Zs9TaCuZjwYEHnK9eHPNQaQMY6YDaVJe4I8UakPTrSMjX93LYTT2n8FWSc6EPGF8FaeSJIdYxe9Kv5ioUFIwwIKGnEwftuwDsMpVAv1rw6Zl1I3TieH2Wt3NM/u3b+8/oA63iudEYRMyKrI0tuApEImTjshy1y/cEg2WNC3KqY94CQ5Z8DiZ3Rf6KcybZwG8qshhA4hHrsomt8QAWWatKWpJTiUL9nVMDP3RIibnGm2pcbc2ktBQlRQ24IEOSqp62w42ZllS6PL/lT1GRBTd+9UPZwbE/bVhIVDz6QGKPQQ8mhaHnjb47J/PkeRLlYx3IDSz61D8yJWog6J9wvXThq2LSLpNUxb8eAQCVRG3Nhdvkn3yQ5xAIxl9DlD0RkHLQArXWjistC9R2QAIiOclK1pKuI2fShkwZJHyIJQgpFBnhb8YvmpSkriYq8EUl20SItLnQx3DcnvgaOpz3D16DGf0mEbKjocIzCngUIxrE32LDOs8IC+0jjc4pJcNVwoUjM52Knl2iPiWEoqIyCb0L28Ie1jlALnhwre6Z6fz1If8SZwquPQD4ahZbE5lClL8Ulml6Z+JCVzAPmyL+JiYTcKKDIHvh5zIDmvRKfqBS/VPGO/jWf73c9iquODmwNyXqmaaMshxDhaoSmKFo92qzZ1OY6D/nqxHIFmL6TeKjf/bvvp01vitaUD7WyhF1a4vcpcjYXxUnptQEJ9G1I+xsqGX1R6WTGTjvOt1s2NphNDvEG","ranges":[{"end_time":"2026-09-06T16:00:36.963491Z","ip":"45.61.157.82","port":"47001","protocol":"HTTP","start_time":"2026-09-03T04:14:52.114975Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T11:35:05.80638Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-09-03T18:09:14.349917Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T03:41:44.113082Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-09T13:33:11.098531Z","transport_protocol":"TCP"},{"end_time":"2026-08-30T08:06:33.000646Z","ip":"45.61.157.82","port":"47001","protocol":"HTTP","start_time":"2026-08-05T12:28:21.292647Z","transport_protocol":"TCP"},{"end_time":"2026-08-08T13:07:32.626259Z","ip":"45.61.157.82","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-08T13:07:31.626259Z","transport_protocol":"TCP"},{"end_time":"2026-08-08T01:49:18.517131Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-05T23:38:42.474099Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T22:42:52.275462Z","ip":"45.61.157.82","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-04T22:42:51.275462Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T18:32:44.086139Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-01T14:23:52.495786Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T11:34:04.918053Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-07-31T18:41:15.92357Z","transport_protocol":"TCP"},{"end_time":"2026-07-30T19:31:44.339231Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-07-30T19:31:43.339231Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T07:49:43.563151Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-29T07:49:42.563151Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T07:28:51.871698Z","ip":"45.61.157.82","port":"143","protocol":"IMAP","start_time":"2026-05-12T15:26:34.956793Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:54:51.495771Z","ip":"45.61.157.82","port":"8888","protocol":"HTTP","start_time":"2026-05-23T22:22:31.089115Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:35:34.322615Z","ip":"45.61.157.82","port":"8888","protocol":"UNKNOWN","start_time":"2026-05-01T21:10:50.023096Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:31:12.144586Z","ip":"45.61.157.82","port":"110","protocol":"POP3","start_time":"2026-05-12T15:08:33.444333Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T02:04:59.994977Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-28T22:05:37.687088Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T01:48:25.975556Z","ip":"45.61.157.82","port":"80","protocol":"HTTP","start_time":"2026-05-23T22:15:09.163694Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T20:40:24.418049Z","ip":"45.61.157.82","port":"993","protocol":"IMAP","start_time":"2026-05-13T02:56:32.081295Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T19:07:50.589784Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-05-12T15:14:01.431905Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T15:06:59.574712Z","ip":"45.61.157.82","port":"7777","protocol":"HTTP","start_time":"2026-05-12T14:23:45.72071Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T14:31:59.705222Z","ip":"45.61.157.82","port":"21","protocol":"FTP","start_time":"2026-07-27T09:17:41.963753Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T12:34:25.938046Z","ip":"45.61.157.82","port":"587","protocol":"SMTP","start_time":"2026-05-12T13:50:47.462026Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T11:50:15.023298Z","ip":"45.61.157.82","port":"443","protocol":"HTTP","start_time":"2026-05-24T00:40:21.73953Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T09:50:44.819511Z","ip":"45.61.157.82","port":"25","protocol":"SMTP","start_time":"2026-05-24T01:02:46.585605Z","transport_protocol":"TCP"},{"end_time":"2026-07-27T19:16:36.869242Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-27T19:16:35.869242Z","transport_protocol":"TCP"},{"end_time":"2026-07-27T18:58:09.79946Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-27T18:58:08.79946Z","transport_protocol":"TCP"},{"end_time":"2026-07-26T04:30:28.006271Z","ip":"45.61.157.82","port":"21","protocol":"FTP","start_time":"2026-05-12T13:07:15.070464Z","transport_protocol":"TCP"},{"end_time":"2026-07-26T02:34:09.324997Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-26T02:34:08.324997Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T09:59:53.367913Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-25T09:59:52.367913Z","transport_protocol":"TCP"},{"end_time":"2026-07-24T16:09:13.599292Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-24T16:09:12.599292Z","transport_protocol":"TCP"},{"end_time":"2026-07-23T22:17:05.931893Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-23T22:17:04.931893Z","transport_protocol":"TCP"},{"end_time":"2026-07-23T17:12:37.955822Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-23T17:12:36.955822Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T22:26:12.320666Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-22T22:26:11.320666Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T16:03:10.997998Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-22T16:03:09.997998Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T10:14:48.452197Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-21T09:31:58.106743Z","transport_protocol":"TCP"},{"end_time":"2026-07-20T19:00:41.973626Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-20T13:16:38.224417Z","transport_protocol":"TCP"},{"end_time":"2026-07-20T03:28:13.759923Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-19T18:21:57.8624Z","transport_protocol":"TCP"},{"end_time":"2026-07-18T17:23:17.858032Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-18T17:23:16.858032Z","transport_protocol":"TCP"},{"end_time":"2026-07-18T17:09:11.209972Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-18T17:09:10.209972Z","transport_protocol":"TCP"},{"end_time":"2026-07-17T17:07:04.368521Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-17T17:07:03.368521Z","transport_protocol":"TCP"},{"end_time":"2026-07-17T04:24:18.458634Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-16T05:29:54.315256Z","transport_protocol":"TCP"},{"end_time":"2026-07-15T16:32:36.098525Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-15T16:32:35.098525Z","transport_protocol":"TCP"},{"end_time":"2026-07-14T11:41:38.004811Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-13T16:26:46.248639Z","transport_protocol":"TCP"},{"end_time":"2026-07-13T18:21:05.621937Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-13T16:26:46.418087Z","transport_protocol":"TCP"},{"end_time":"2026-07-12T09:51:58.604193Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-12T09:51:57.604193Z","transport_protocol":"TCP"},{"end_time":"2026-07-11T17:30:08.60141Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-11T17:30:07.60141Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T10:17:08.786974Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-09T12:49:32.663845Z","transport_protocol":"TCP"},{"end_time":"2026-07-09T21:40:51.0641Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-09T05:11:19.511674Z","transport_protocol":"TCP"},{"end_time":"2026-07-08T18:25:23.290736Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-08T18:25:22.290736Z","transport_protocol":"TCP"},{"end_time":"2026-07-08T05:40:45.442823Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-08T05:40:44.442823Z","transport_protocol":"TCP"},{"end_time":"2026-07-07T20:19:56.544584Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-07T20:19:55.544584Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T05:00:34.974409Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-05T19:52:01.232206Z","transport_protocol":"TCP"},{"end_time":"2026-07-05T23:28:06.908242Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-01T16:22:25.554024Z","transport_protocol":"TCP"},{"end_time":"2026-07-04T14:12:24.551306Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-02T16:33:18.094646Z","transport_protocol":"TCP"},{"end_time":"2026-06-30T11:28:25.426166Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-28T12:53:15.027839Z","transport_protocol":"TCP"},{"end_time":"2026-06-29T20:27:42.1222Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-28T15:48:10.881985Z","transport_protocol":"TCP"},{"end_time":"2026-06-27T15:55:20.967873Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-27T15:55:19.967873Z","transport_protocol":"TCP"},{"end_time":"2026-06-27T05:27:35.172255Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-24T16:06:51.450676Z","transport_protocol":"TCP"},{"end_time":"2026-06-25T22:21:44.312542Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-25T09:04:40.894404Z","transport_protocol":"TCP"},{"end_time":"2026-06-23T10:01:09.946858Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-23T10:01:08.946858Z","transport_protocol":"TCP"},{"end_time":"2026-06-22T22:29:49.305436Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-21T03:28:51.139229Z","transport_protocol":"TCP"},{"end_time":"2026-06-22T02:45:16.115575Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-20T17:38:17.104254Z","transport_protocol":"TCP"},{"end_time":"2026-06-20T16:01:33.147287Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-20T16:01:32.147287Z","transport_protocol":"TCP"},{"end_time":"2026-06-19T17:05:06.277824Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-19T17:05:05.277824Z","transport_protocol":"TCP"},{"end_time":"2026-06-18T23:38:54.595481Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-17T23:09:48.833428Z","transport_protocol":"TCP"},{"end_time":"2026-06-18T23:38:54.536629Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-17T18:23:07.187995Z","transport_protocol":"TCP"},{"end_time":"2026-06-17T17:18:16.37188Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-17T17:18:15.37188Z","transport_protocol":"TCP"},{"end_time":"2026-06-16T08:25:28.479863Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-14T17:30:12.206355Z","transport_protocol":"TCP"},{"end_time":"2026-06-15T23:37:49.258672Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-15T23:37:48.258672Z","transport_protocol":"TCP"},{"end_time":"2026-06-15T20:59:09.675012Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-14T22:20:16.856639Z","transport_protocol":"TCP"},{"end_time":"2026-06-13T06:10:12.754778Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-11T14:15:24.146022Z","transport_protocol":"TCP"},{"end_time":"2026-06-12T04:08:36.569285Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-11T08:21:27.240139Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T00:42:32.983806Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-10T10:37:37.552609Z","transport_protocol":"TCP"},{"end_time":"2026-06-10T07:28:24.351845Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-08T19:15:09.743367Z","transport_protocol":"TCP"},{"end_time":"2026-06-07T18:40:09.882649Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-07T18:40:08.882649Z","transport_protocol":"TCP"},{"end_time":"2026-06-07T00:20:50.783956Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-07T00:20:49.783956Z","transport_protocol":"TCP"},{"end_time":"2026-06-05T14:57:08.729925Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-04T18:30:01.586734Z","transport_protocol":"TCP"},{"end_time":"2026-06-03T21:53:56.248975Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-03T06:04:56.312935Z","transport_protocol":"TCP"},{"end_time":"2026-06-02T12:31:45.978299Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-02T12:31:44.978299Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T23:01:19.32168Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-01T23:01:18.32168Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T09:55:51.867033Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-30T08:42:56.958068Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T11:35:52.423135Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-30T00:19:08.047027Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T13:05:56.105467Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-29T13:05:55.105467Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T20:08:22.056824Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-28T20:08:21.056824Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T16:17:45.026165Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-28T16:17:44.026165Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T23:20:22.501442Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-27T23:20:21.501442Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T19:25:27.652471Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-27T19:25:26.652471Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T08:27:05.313996Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-27T02:32:10.341446Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T11:50:20.186912Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-24T17:19:30.564629Z","transport_protocol":"TCP"},{"end_time":"2026-05-25T23:00:09.136586Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-25T21:09:17.738936Z","transport_protocol":"TCP"},{"end_time":"2026-05-24T17:07:52.165095Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-24T15:29:07.149419Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T15:52:41.544059Z","ip":"45.61.157.82","port":"80","protocol":"HTTP","start_time":"2026-05-13T09:03:18.626694Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T11:16:40.904583Z","ip":"45.61.157.82","port":"443","protocol":"HTTP","start_time":"2026-05-12T15:23:10.012714Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T20:19:13.318491Z","ip":"45.61.157.82","port":"8888","protocol":"HTTP","start_time":"2026-05-12T15:24:16.351254Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T20:16:01.320179Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-22T20:16:00.320179Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T19:56:08.539341Z","ip":"45.61.157.82","port":"25","protocol":"SMTP","start_time":"2026-05-12T16:10:14.041319Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T16:32:50.307183Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-22T16:32:49.307183Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T16:17:54.639777Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-22T16:17:53.639777Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T09:32:42.290039Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-20T02:30:35.826316Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T09:32:42.129233Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-19T16:21:10.636272Z","transport_protocol":"TCP"}]}}} +{"ip":"185.100.87.136","asn":"AS200651","name":"FLOKINET","honeylabs_events":24,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":200651,"bgp_prefix":"185.100.87.0/24","country_code":"IS","description":"FlokiNET - FlokiNET ehf","name":"FlokiNET - FlokiNET ehf"},"dns":{"reverse_dns":{"resolve_time":"2026-08-30T19:27:56Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-09-01T00:00:00Z","tags":[{"name":"DNS Protocol"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"ICMPv4 Protocol"},{"name":"Looks Like Debian server"},{"name":"Looks Like Windows 11 laptop"},{"name":"Ping Scanner"},{"name":"QUIC Protocol"},{"name":"SSH Alternative Port Crawler"},{"name":"SSH Connection Attempt"},{"name":"SparkRAT Client Update Scanner"},{"name":"TLS/SSL Crawler"},{"name":"Web Crawler"}]},"ip":"185.100.87.136","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Bucharest","continent":"Europe","coordinates":{"latitude":44.43225,"longitude":26.10626},"country":"Romania","country_code":"RO","postal_code":"050011","province":"Bucharest","timezone":"Europe/Bucharest"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"anonymous":true,"source":"IPINFO","tor":true},{"source":"ONIONOO","tor":true,"tor_info":{"relays":[{"advertised_bandwidth":92160,"bandwidth_burst":122880,"bandwidth_rate":92160,"consensus_weight":3,"consensus_weight_fraction":1.5237209e-8,"effective_family":["9366185B4ECB1CC3634F475D20FDDFE7A302BAF2"],"exit_addresses":["185.100.87.136"],"exit_policy":["reject 0.0.0.0/8:*","reject 169.254.0.0/16:*","reject 127.0.0.0/8:*","reject 192.168.0.0/16:*","reject 10.0.0.0/8:*","reject 172.16.0.0/12:*","reject 185.100.87.136:*","accept *:20-21","accept *:43","accept *:53","accept *:80","accept *:443","accept *:989-990","accept *:1194","accept *:4321","accept *:5222-5223","accept *:11371","accept *:64738","reject *:*"],"exit_policy_summary":{"accept":["20-21","43","53","80","443","989-990","1194","4321","5222-5223","11371","64738"]},"exit_probability":4.649127e-8,"fingerprint":"9366185B4ECB1CC3634F475D20FDDFE7A302BAF2","flags":["Exit","Running","Valid"],"guard_probability":0,"measured":true,"middle_probability":0,"nickname":"PremiumTorExit","observed_bandwidth":126796,"or_addresses":["185.100.87.136:9001"],"platform":"Tor 0.4.9.11 on Linux","recommended_version":true,"version":"0.4.9.11","version_status":"recommended"}]}},{"tor":true}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.896},"service_count":3,"services":[{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r\nX-Your-Address-Is: 66.132.172.100\r\nContent-Encoding: identity\r\nContent-Length: 17557\r\nExpires: Sun, 06 Sep 2026 23:06:48 GMT\r\n","banner_hash_sha256":"770a86aff34e7fec758afc88c18c6367ceccdef226a4fae6b09e417fd07ca6ba","endpoints":[{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r\nX-Your-Address-Is: 66.132.172.100\r\nContent-Encoding: identity\r\nContent-Length: 17557\r\nExpires: Sun, 06 Sep 2026 23:06:48 GMT\r\n","banner_hash_sha256":"770a86aff34e7fec758afc88c18c6367ceccdef226a4fae6b09e417fd07ca6ba","endpoint_type":"HTTP","hostname":"185.100.87.136","http":{"body":"\n\n\n\n\nThis is a Tor Exit Router\n\n\n\n\n\n\n

This is a\nTor Exit Router

\n\n

\nMost likely you are accessing this website because you had some issue with\nthe traffic coming from this IP. This router is part of the Tor Anonymity Network, which is\ndedicated to providing\nprivacy to people who need it most: average computer users. This\nrouter IP should be generating no other traffic, unless it has been\ncompromised.

\n\n

\n\n\n

\n\n

\nTor sees use by many\nimportant segments of the population, including whistle blowers,\njournalists, Chinese dissidents skirting the Great Firewall and oppressive\ncensorship, abuse victims, stalker targets, the US military, and law\nenforcement, just to name a few. While Tor is not designed for malicious\ncomputer users, it is true that they can use the network for malicious ends.\nIn reality however, the actual amount of abuse is quite low. This\nis largely because criminals and hackers have significantly better access to\nprivacy and anonymity than do the regular users whom they prey upon. Criminals\ncan and do build,\nsell, and trade far larger and more\npowerful networks than Tor on a daily basis. Thus, in the mind of this\noperator, the social need for easily accessible censorship-resistant private,\nanonymous communication trumps the risk of unskilled bad actors, who are\nalmost always more easily uncovered by traditional police work than by\nextensive monitoring and surveillance anyway.

\n\n

\nIn terms of applicable law, the best way to understand Tor is to consider it a\nnetwork of routers operating as common carriers, much like the Internet\nbackbone. However, unlike the Internet backbone routers, Tor routers\nexplicitly do not contain identifiable routing information about the source of\na packet, and no single Tor node can determine both the origin and destination\nof a given transmission.

\n\n

\nAs such, there is little the operator of this router can do to help you track\nthe connection further. This router maintains no logs of any of the Tor\ntraffic, so there is little that can be done to trace either legitimate or\nillegitimate traffic (or to filter one from the other). Attempts to\nseize this router will accomplish nothing.

\n\n\n\n

\nFurthermore, this machine also serves as a carrier of email, which means that\nits contents are further protected under the ECPA. 18\nUSC 2707 explicitly allows for civil remedies ($1000/account\nplus legal fees)\nin the event of a seizure executed without good faith or probable cause (it\nshould be clear at this point that traffic with an originating IP address of\nFIXME_DNS_NAME should not constitute probable cause to seize the\nmachine). Similar considerations exist for 1st amendment content on this\nmachine.

\n\n\n\n

\nIf you are a representative of a company who feels that this router is being\nused to violate the DMCA, please be aware that this machine does not host or\ncontain any illegal content. Also be aware that network infrastructure\nmaintainers are not liable for the type of content that passes over their\nequipment, in accordance with DMCA\n\"safe harbor\" provisions. In other words, you will have just as much luck\nsending a takedown notice to the Internet backbone providers. Please consult\nEFF's prepared\nresponse for more information on this matter.

\n\n

For more information, please consult the following documentation:

\n\n
    \n
  1. Tor Overview
    2. \n
  2. Tor Abuse FAQ
    3. \n
  3. Tor Legal FAQ
    4. \n
\n\n

\nThat being said, if you still have a complaint about the router, you may\nemail the maintainer. If\ncomplaints are related to a particular service that is being abused, I will\nconsider removing that service from my exit policy, which would prevent my\nrouter from allowing that traffic to exit through it. I can only do this on an\nIP+destination port basis, however. Common P2P ports are\nalready blocked.

\n\n

\nYou also have the option of blocking this IP address and others on\nthe Tor network if you so desire. The Tor project provides a web service\nto fetch a list of all IP addresses of Tor exit nodes that allow exiting to a\nspecified IP:port combination, and an official DNSRBL is also available to\ndetermine if a given IP address is actually a Tor exit server. Please\nbe considerate\nwhen using these options. It would be unfortunate to deny all Tor users access\nto your site indefinitely simply because of a few bad apples.

\n\n\n\n","body_hash_sha1":"c97a4d30857969d907bc4d2addc000a84be8ca12","body_hash_sha256":"a32c833ad1733a12a271d9d108a5801a72f8a45637e324b7d566899a98e31bb2","body_hash_tlsh":"9e72ae77a34973361340c290762472dcff53c17ab3c57ae2746ac516b288aa683752eb","body_size":17557,"headers":{"Connection":{"headers":["close"]},"Content-Encoding":{"headers":["identity"]},"Content-Length":{"headers":["17557"]},"Content-Type":{"headers":["text/html"]},"Date":{"headers":[""]},"Expires":{"headers":["Sun, 06 Sep 2026 23:06:48 GMT"]},"X-Your-Address-Is":{"headers":["66.132.172.100"]}},"html_tags":["This is a Tor Exit Router",""],"html_title":"This is a Tor Exit Router","protocol":"HTTP/1.0","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.0"],"uri":"http://185.100.87.136/"},"ip":"185.100.87.136","path":"/","port":80,"scan_time":"2026-09-06T22:46:51Z","transport_protocol":"tcp"},{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/plain\r\nX-Your-Address-Is: 66.132.172.197\r\nContent-Encoding: identity\r\nContent-Length: 28\r\nExpires: Mon, 07 Sep 2026 14:47:24 GMT\r\n","banner_hash_sha256":"061b47d1004a9d5bb01c2f9577ee9f949f115f37482f5e678d8695b667dd3ba0","endpoint_type":"HTTP","hostname":"185.100.87.136","http":{"body":"User-agent: *\r\nDisallow: /\r\n","body_hash_sha1":"88a8390db1c2c7a883f0590d8e50eed4bac2ef63","body_hash_sha256":"a8f31103361fca68bef71fc69cff844b7c23bd3d64d2b872d74690cbda656bfc","body_size":28,"headers":{"Connection":{"headers":["close"]},"Content-Encoding":{"headers":["identity"]},"Content-Length":{"headers":["28"]},"Content-Type":{"headers":["text/plain"]},"Date":{"headers":[""]},"Expires":{"headers":["Mon, 07 Sep 2026 14:47:24 GMT"]},"X-Your-Address-Is":{"headers":["66.132.172.197"]}},"protocol":"HTTP/1.0","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.0"],"uri":"http://185.100.87.136/robots.txt"},"ip":"185.100.87.136","path":"/robots.txt","port":80,"scan_time":"2026-09-06T14:47:05Z","transport_protocol":"tcp"}],"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-9-16","scan_time":"2026-09-07T03:13:37Z"},"labels":[{"confidence":0.75,"evidence":[{"data_path":"http.html_title","found_value":"This is a Tor Exit Router","literal_match":"This is a Tor Exit Router"}],"source":"censys","value":"PROXY_SERVER"}],"port":80,"protocol":"HTTP","scan_time":"2026-09-06T22:46:51Z","software":[{"confidence":0.75,"cpe":"cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.html_title","found_value":"This is a Tor Exit Router","literal_match":"This is a Tor Exit Router"}],"part":"a","product":"tor","source":"censys","type":["PROXY_SERVER"],"vendor":"torproject"}],"transport_protocol":"tcp"},{"banner":"SSH-2.0-OpenSSH_9.9","banner_hash_sha256":"607685352506d4de6404d09cb1ff43b3304d3845dbe6c3b04c291a88ae21fb8b","banner_hex":"5353482d322e302d4f70656e5353485f392e39","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-09-07T02:04:41Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":7288,"protocol":"SSH","scan_time":"2026-09-07T01:37:21Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"9.9"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_9.9","software_version":"OpenSSH_9.9"},"hassh_fingerprint":"b1bff636ebbdbaa9dd2ad97fd173c956","kex_init_message":{"client_to_server_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","ext-info-s","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"UUoBOoUINl0JCxNInaB38OEbyY23Lh6GJvidyx+7IA==","y":"+Nb8x05vRmvKPIFofduYn2OlA60GchNP5ACrqQo1QjM="},"fingerprint_sha256":"148e3493937499b0630b4bcb1cbbf6b77d6be4e712b0c566dfe9676b5feb2e6a"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=9.5p1 && <=9.9p1"}],"id":"CVE-2025-26466","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"percentile":0.986,"score":0.398}},"name":"CVE-2025-26466","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]},{"cert":{"added_at":"2026-09-07T03:08:36Z","ever_seen_in_scan":true,"fingerprint_md5":"9564dca0a9450bf1532448f1cd101c3c","fingerprint_sha1":"2c759100780362c62eaec65f9355272d7dc5f16f","fingerprint_sha256":"dd7fc450edd33765b7e484a7ac4d6d3449e65a6031e1158fce7dd9820743291d","modified_at":"2026-09-07T03:08:36Z","names":["www.ocydpjp6pm4t6.net"],"parse_status":"success","parsed":{"extensions":{},"issuer":{"common_name":["www.rh52bxijqzz3owdru.com"]},"issuer_dn":"CN=www.rh52bxijqzz3owdru.com","ja4x":"7022c563de38_7022c563de38_e3b0c44298fc","serial_number":"14209954343118186666","serial_number_hex":"c533e630001428aa","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"7ec7f740de424b48976f3d08f27f1d5b6d899f3f8ffc83b178776480fa82a3be5c3ff6e2d388c1eba2852ecbf3b2812c662debc49379734fd6e7aeb49ea6ea1fdcf70a936b01dce1ea1f0e08e7878682633453f14c4ed95d1e77ed364033b132d51a163d018e872569e35fc798117b99bb4b914d989f767eaa11e27347ff9db3"},"subject":{"common_name":["www.ocydpjp6pm4t6.net"]},"subject_dn":"CN=www.ocydpjp6pm4t6.net","subject_key_info":{"fingerprint_sha256":"75d7ef1389b96f776600730fae4deb2117a501cbd8802f6af280b7c9bed63085","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"91ccb515cb229208206fff106c617999f5af7027fe825217f9f814aae6cdfa39c32ca443c766905b8c12932663412b35514660a33a20706e5cdf2485a06e390b9e2521a4a5da211e81c4298d3a5078201fb8555d3d446e8610d9c3f8e26fab17914f77e80752e6f18b5881cf0f50bff070d5ce71c787ea2625321c78399e7ce81df3794acaf993dbd111b1e31bb0665f4adc3ea33300b3c4730b9b5343f06b8b8116d7b6311ebd63deb41a895c6affb3ba44af11ff35576d8df4feb1d891d2c1284039b9f343fedcc2cf2a28ee18b60d27c9ecd16e002670bfa2e59f1e6a2487c9e78cb7412e5aca0864363219fc16b71037f66748837a473cedd6de651ed41f"}},"validity_period":{"length_seconds":18403200,"not_after":"2026-11-24T23:59:59Z","not_before":"2026-04-26T00:00:00Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"3dba2c17aded0b13bf0920a76316e89c78f58de4a3b2b223e2eb75276d4755d2","spki_subject_fingerprint_sha256":"3dba2c17aded0b13bf0920a76316e89c78f58de4a3b2b223e2eb75276d4755d2","tbs_fingerprint_sha256":"1d094e544fc21f4eeda225c1b969d37d8643f4245e405c812c749802e59219de","tbs_no_ct_fingerprint_sha256":"baaf6035a22c75a6ac0ba2ec52c33b34cc6d1125190152a825a7f48720b986c3","validated_at":"2026-09-07T03:08:36Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_authority_key_identifier_missing","e_ext_authority_key_identifier_no_key_identifier","e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_eku_missing","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2026-09-07T03:08:36Z","version":3,"warnings_present":true}},"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-09-04T03:44:52Z"},"jarm":{"cipher_and_version_fingerprint":"2ad2ad16d2ad2ad00042d42d000000","fingerprint":"2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa","ip":"185.100.87.136","is_success":true,"port":9001,"scan_time":"2026-09-07T04:04:38Z","tls_extensions_sha256":"332dc9cd7d90589195193c8bb05d84fa","transport_protocol":"tcp"},"port":9001,"protocol":"UNKNOWN","scan_time":"2026-09-07T03:08:30Z","tls":{"cipher_selected":"TLS_AES_256_GCM_SHA384","fingerprint_sha256":"dd7fc450edd33765b7e484a7ac4d6d3449e65a6031e1158fce7dd9820743291d","ja3s":"15af977ce25de452b96affa2addb1036","ja4s":"t130200_1302_a56c5b993250","version_selected":"tlsv1_3","versions":[{"ja3s":"15af977ce25de452b96affa2addb1036","ja4s":"t130200_1302_a56c5b993250","version":"tlsv1_3"},{"ja3s":"0debd3853f330c574b05e0b6d882dc27","ja4s":"t120200_c030_344b4dce5a52","version":"tlsv1_2"}]},"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["185.100.87.0/24"],"created":"2015-12-15T00:00:00Z","handle":"FLOKINET-ROMANIA","name":"FlokiNET Ltd","updated":"2026-06-15T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@flokinet.is","handle":"AR74596-RIPE","name":"Abuse-C Role"}],"address":"Skólavörðustíg 12\\n101\\nReykjavík\\nICELAND","admin_contacts":[{"email":"noc@flokinet.is","handle":"FN3741-RIPE","name":"FlokiNET NOC"}],"handle":"ORG-FE72-RIPE","name":"FlokiNET ehf"}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-07T01:37:22.032143Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-12-31T09:36:43.701571Z","transport_protocol":"TCP"},{"end_time":"2026-09-07T01:31:09.69269Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2026-08-08T00:20:38.52518Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T22:46:52.306682Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2026-08-07T17:57:35.464663Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T05:55:29.397231Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-12-31T09:32:57.1497Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T09:46:17.155811Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2026-06-26T19:52:25.060425Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T09:37:59.385172Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-31T16:36:12.707731Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T20:50:24.759082Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-12-09T00:48:01.16086Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T15:39:10.177935Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-30T15:39:09.177935Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T11:39:54.904189Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-15T18:40:02.751495Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T08:43:36.01245Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-12-09T10:37:50.563227Z","transport_protocol":"TCP"},{"end_time":"2025-12-15T14:41:57.240706Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-09T08:37:05.924993Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T15:45:58.627135Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-11-16T14:01:55.180009Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T09:35:22.076607Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-11-16T09:08:07.828315Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T08:22:42.591586Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-11-16T19:32:51.344364Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T17:48:05.866132Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-10-25T04:03:10.427389Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T10:47:18.073154Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-10-25T00:41:32.460808Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T08:03:47.411418Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-10-25T23:38:41.947418Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T12:58:59.103129Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-10-02T15:47:33.36523Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T10:51:19.856866Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-10-02T10:44:46.6807Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T10:47:19.350366Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-10-02T21:42:45.464936Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T04:32:40.05703Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-09-10T11:18:22.074061Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:52:37.627564Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-09-23T12:38:53.521099Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T09:38:39.027858Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-09-10T08:50:26.939053Z","transport_protocol":"TCP"},{"end_time":"2025-09-23T08:42:52.136165Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-09-10T06:49:10.93404Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T23:12:02.195513Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-08-19T04:47:41.790999Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:04:48.768015Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-08-18T13:05:39.244997Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T05:44:54.57181Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-08-19T09:40:09.305937Z","transport_protocol":"TCP"}]}}} +{"ip":"144.172.108.79","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":24,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"144.172.108.0/24","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"forward_dns":{"egress.akunpy.com":{"name":"egress.akunpy.com","record_type":"a","resolve_time":"2026-09-06T21:07:52Z"}},"names":["egress.akunpy.com"],"reverse_dns":{"names":["79.108.172.144.static.cloudzy.com"],"resolve_time":"2026-09-04T19:27:40Z"}},"ip":"144.172.108.79","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Ogden","continent":"North America","coordinates":{"latitude":41.223,"longitude":-111.97383},"country":"United States","country_code":"US","postal_code":"84401","province":"Utah","timezone":"America/Denver"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.472},"service_count":4,"services":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"144.172.108.79","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://144.172.108.79/"},"ip":"144.172.108.79","path":"/","port":80,"scan_time":"2026-09-07T09:44:08Z","transport_protocol":"tcp"}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T16:34:40Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":80,"protocol":"HTTP","scan_time":"2026-09-07T09:44:08Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"id":"CENSYS-2022-1046","metrics":{},"name":"Exposed MSSQL Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T00:06:15Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"source":"censys","value":"DATABASE"}],"mssql":{"encrypt_mode":"ENCRYPT_ON","prelogin_options":{"encrypt_mode":"ENCRYPT_ON","mars":false,"server_version":{"build_number":1600,"major":10}},"version":"10.0.1600"},"port":1433,"protocol":"MSSQL","scan_time":"2026-09-06T13:40:15Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"part":"a","source":"censys","type":["DATABASE"]},{"confidence":0.75,"cpe":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","evidence":[{"data_path":"mssql.version","found_value":"10.0.1600"}],"part":"a","product":"sql_server","source":"censys","vendor":"microsoft","version":"10.0.1600"}],"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-21528","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.325,"score":0.004}},"name":"CVE-2023-21528","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-21718","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.522,"score":0.007}},"name":"CVE-2023-21718","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-23384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":{"percentile":0.565,"score":0.009}},"name":"CVE-2023-23384","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":"<16.0.4100.1"}],"id":"CVE-2024-0056","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"},"epss":{"percentile":0.653,"score":0.012}},"name":"CVE-2024-0056","risk_source":"cve","severity":"high","source":"third_party","year":2024}]},{"cert":{"added_at":"2026-08-19T02:46:48Z","ever_seen_in_scan":true,"fingerprint_md5":"5732798bb452f4e6aa595c507075503e","fingerprint_sha1":"75d885ffeba6a5a9590779927a9c076d848fe2f7","fingerprint_sha256":"6647814dc6e63d48a1fc5798d664dc359c033e18ec6f87b3d77a0cceeaba34c2","modified_at":"2026-08-19T02:46:48Z","names":["windows-Utah-8g"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["windows-Utah-8g"]},"issuer_dn":"CN=windows-Utah-8g","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"43549124598608788025244499971269866447","serial_number_hex":"20c3419da39957be4052d4479c6633cf","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"2fc95115b2bdbcb629f432fcbc9a90adde61661be1e0c10c6b04bc8ed06a286a0a655319c3d899e2050aea8d0ec6157e36835ace0d0d8a25da0c26a03cd0e8b4bf493604014f77ba772bc49b413f98f52809af0170671822d9b1dd3b161ee3a3672f045b7cf159302fda9757aae0cfaa1cda62374b8e780700c6820b007a506d9e5549f7e79641677eba475f520d66e2e27b5195a001d1e4528df1dc7a39bcb559948bb08f7d7aaba8ff90b8c5b99674d86b4ebb6b90d6bb3928b20a7c1d4ebce54437abee52687b04d75591933d03ed501b8bdec2bb5c853c4ec08e83face75630fec30df582653f335014acd0640bbae578629e08b372126e29b5838653086"},"subject":{"common_name":["windows-Utah-8g"]},"subject_dn":"CN=windows-Utah-8g","subject_key_info":{"fingerprint_sha256":"ab44108ea092a469fa1f78fce4e9c12628dd53d11c8cef447826693d6b4f83ff","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"b2ef1557b59a53feb8035c8e844b03ec48775c8f41da72a282bc5282cbb95c6fc1e9dbea4872d1061f11d9efbe4a25985c826a4f024e7628f05f0372e471805dbef1e3baa82c86f47f85866bb303e3e7e9c5ae7e6f66976f6e4e466c1f826cf4b30505e62f500663393b6660e42eb9874a4df632dc90d686cadf6a2c56e8dbf2338c6806758a06446309f101dfb548ca69fa2a0ecf5431f2fca12db1456177c94c4542c69cfc4368ef1a3b832eb4954e341570dbd8f2e0f8c15d41bea1b809cfcb4e3b3dc988cbda19928bc07840bbca76405e8ffcc57a7a18d35bcffd055415cea5d493dc25903cae4bbb3830e780249fa4eff984726fbefcfeb23210805287"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-15T06:21:54Z","not_before":"2026-08-16T06:21:54Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"4787b44148c732fb38910f312ca04bf119f24ec52a1acad22282e2937b8775e9","spki_subject_fingerprint_sha256":"4787b44148c732fb38910f312ca04bf119f24ec52a1acad22282e2937b8775e9","tbs_fingerprint_sha256":"d2abc76a417ce90f29bdc1bcb22e279bacf400cfaa7ad18cd10c4b082cc67b38","tbs_no_ct_fingerprint_sha256":"d2abc76a417ce90f29bdc1bcb22e279bacf400cfaa7ad18cd10c4b082cc67b38","validated_at":"2026-09-06T19:43:54Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-19T02:46:48Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T00:42:21Z"},"jarm":{"cipher_and_version_fingerprint":"00006b00006b06b06b06b06b06b06b","fingerprint":"00006b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"144.172.108.79","is_success":true,"port":3389,"scan_time":"2026-09-02T04:17:45Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"cert.parsed.subject_dn"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-06T19:35:57Z","screenshots":[{"extracted_text":"","handle":"7fedb6bef0e04b93b649e8301ac6f091","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"6647814dc6e63d48a1fc5798d664dc359c033e18ec6f87b3d77a0cceeaba34c2","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"144.172.108.79","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://144.172.108.79:47001/"},"ip":"144.172.108.79","path":"/","port":47001,"scan_time":"2026-09-07T06:49:24Z","transport_protocol":"tcp"}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T16:16:59Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-07T06:49:24Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["144.172.108.0/24"],"created":"2025-05-17T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2025-05-17T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T19:35:58.727024Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-09-02T03:58:15.580519Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T15:01:31.973243Z","ip":"144.172.108.79","port":"47001","protocol":"HTTP","start_time":"2026-08-18T16:54:58.484047Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T13:40:16.101933Z","ip":"144.172.108.79","port":"1433","protocol":"MSSQL","start_time":"2026-08-18T20:24:47.368396Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T03:59:27.610106Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-08-18T14:49:20.893613Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T00:51:02.802488Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-09-02T00:51:01.802488Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T03:28:18.151299Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-26T10:49:11.488469Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T03:43:19.627126Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-25T03:35:16.807295Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T04:43:13.034598Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-24T00:43:01.327804Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T00:29:26.379935Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-22T10:20:03.859227Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T07:33:52.904817Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-22T07:33:51.904817Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T04:25:21.993702Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-22T04:25:20.993702Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T06:56:55.626294Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-21T06:56:54.626294Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T05:56:02.040133Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-20T05:56:01.040133Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T03:50:59.753086Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-19T02:46:44.339408Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T18:58:33.178992Z","ip":"144.172.108.79","port":"445","protocol":"SMB","start_time":"2026-08-17T18:58:32.178992Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T03:33:49.320735Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-07-09T13:37:39.936831Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T00:50:15.071097Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2026-07-10T13:19:55.857956Z","transport_protocol":"TCP"},{"end_time":"2026-08-09T08:57:32.081455Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-07-09T23:12:14.061472Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T12:46:36.514836Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-06-11T12:46:35.514836Z","transport_protocol":"TCP"},{"end_time":"2026-06-10T22:58:13.238364Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-06-06T07:49:03.109175Z","transport_protocol":"TCP"},{"end_time":"2026-06-04T20:02:36.5399Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-29T09:31:58.852695Z","transport_protocol":"TCP"},{"end_time":"2026-06-04T08:14:57.340482Z","ip":"144.172.108.79","port":"5000","protocol":"HTTP","start_time":"2026-06-04T08:14:56.340482Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T21:25:13.844373Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-27T17:49:15.672097Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:38:55.693696Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-27T13:38:01.53542Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:36:14.181109Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-27T13:36:13.181109Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:36:09.354487Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-26T13:07:01.003156Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T03:07:56.95296Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-11T07:36:36.369406Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T06:43:56.012367Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-10T06:43:55.012367Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T10:32:23.687506Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-06T05:24:02.983289Z","transport_protocol":"TCP"},{"end_time":"2026-05-06T04:27:49.916565Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-06T04:27:48.916565Z","transport_protocol":"TCP"},{"end_time":"2026-05-05T18:33:09.789724Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-03-27T21:33:01.320022Z","transport_protocol":"TCP"},{"end_time":"2026-03-26T16:20:11.425027Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-03-23T13:19:35.689748Z","transport_protocol":"TCP"},{"end_time":"2026-03-12T11:57:23.138713Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2026-02-16T01:18:15.578913Z","transport_protocol":"TCP"},{"end_time":"2026-03-12T05:56:33.38736Z","ip":"144.172.108.79","port":"10050","protocol":"UNKNOWN","start_time":"2026-02-16T01:20:19.508345Z","transport_protocol":"TCP"},{"end_time":"2026-03-11T15:55:07.28716Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-02-16T04:40:31.682759Z","transport_protocol":"TCP"},{"end_time":"2026-03-11T15:49:52.740486Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-02-13T11:49:09.770692Z","transport_protocol":"TCP"},{"end_time":"2026-02-05T00:32:10.712362Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-31T21:13:33.767753Z","transport_protocol":"TCP"},{"end_time":"2026-02-04T21:47:20.441163Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-31T22:45:42.714961Z","transport_protocol":"TCP"},{"end_time":"2026-02-04T17:53:50.063568Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-31T08:05:06.601742Z","transport_protocol":"TCP"},{"end_time":"2025-12-31T01:30:57.850745Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-09T07:31:00.720191Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T23:01:06.466157Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-09T00:54:22.276685Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T21:52:25.383351Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-08T20:44:22.852167Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T06:31:15.873921Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-04T17:08:43.863221Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T01:06:30.038478Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-07T21:54:25.919436Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T00:41:14.761906Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-08T00:34:22.258486Z","transport_protocol":"TCP"},{"end_time":"2025-12-07T22:55:44.98817Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-04T16:53:17.878809Z","transport_protocol":"TCP"},{"end_time":"2025-12-07T15:55:15.05588Z","ip":"144.172.108.79","port":"2096","protocol":"HTTP","start_time":"2025-12-04T06:30:06.452886Z","transport_protocol":"TCP"},{"end_time":"2025-11-27T13:35:11.155215Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-11-16T21:18:06.173329Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T22:34:30.4677Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-11-02T23:19:20.810476Z","transport_protocol":"TCP"},{"end_time":"2025-11-02T10:09:15.290795Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2025-11-02T10:09:14.290795Z","transport_protocol":"TCP"},{"end_time":"2025-11-01T09:53:52.687506Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-10-25T04:50:20.119179Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T10:48:32.696299Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-10-02T21:23:20.011506Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:53:41.489072Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-09-10T02:38:22.812699Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T02:20:10.297531Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-09-05T22:58:01.034395Z","transport_protocol":"TCP"}]}}} +{"ip":"193.143.1.66","asn":"AS198953","name":"PROTON66","honeylabs_events":24,"host":{"err":"{\"result\":{\"extensions\":{},\"resource\":{\"autonomous_system\":{\"asn\":198953,\"bgp_prefix\":\"193.143.1.0/2"},"services":{"result":{"next_page_token":"35d55dcf2355a8ffc254daad:+VjfEuLhU+OspTvWWMJ4h1ViS0ucG/bcMl3+vti1D4Y+3Bc9dfk2T32Y1JjucMOULaSu300Ahq/ZQO90aZFpkAy6jMCvoDmwrMryzQPHgRtRYF3+L6aNc1FExW9yQZkA4CesENeVfDobWSuwDnhjIbdDJi2QuCW1vDm73saoRGw9UdWL6lsd0j07aZxlnxNRiR6KMPrXpcWmH4crZdV+qtj6sXnktMlXHSQVmzEiwVJFhjvVghjpP0yclM/c2frVigThtrNB2jwO8qCKnVdqb6YqGAAUrncd2KRySGTcHAAQT2fGBImmVe08Frj8JABRwG5zcyDli/gD4EG25sa0BT355Jv2HzepiQph/Ry8fXyIkbGrrMc+31j3eJEibvtdNyE7B+HU/nDZuhqigtZJ64f2ybVLGIOD8aRMTGIzs7g/6w4pOGTU6M960F9AuHsKCZVMIEx2ANCVD4GsZ7NztuTmnaFF3BbXWUJchEV3yWRNgoSjZAwMMaDmsvVPO8ae0r50lyOAPra3KF8P9A7rwGPOxezJcDrELYbPb1GgI4ipesJ0JVHLL/EZvOhquYMyS7IzNIWLFLBEFCRb68IcQUwe+2Q/fU0q6EJTUo9wXVHf6s4q1kEDmfQaEN1e2Vja+OPBzoQAQBqRlySfzDovBVZT6DWrpt6UI+BCK/SUEp9rg67LRh+/BY9o2tuF27lUk0EUvCKxs+gMMBZmbZayjnp0+pRRooNdf9Fw/Jz6HdoTKxTyuBXHXYL5BYEl0IlwJfVx+S2y","ranges":[{"end_time":"2026-09-07T01:35:43.612628Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-09-04T17:07:04.768455Z","transport_protocol":"TCP"},{"end_time":"2026-09-07T01:34:37.658266Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-09-04T12:58:22.413892Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T23:39:18.762254Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-09-04T20:08:55.223952Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T22:54:21.428656Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-09-04T09:39:20.661948Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T20:38:30.102283Z","ip":"193.143.1.66","port":"137","protocol":"NETBIOS","start_time":"2026-09-03T18:19:49.37029Z","transport_protocol":"UDP"},{"end_time":"2026-09-06T13:57:24.709929Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-09-04T09:29:16.868419Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T13:14:06.860998Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-26T09:09:43.908292Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T01:02:27.570169Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-09-04T12:10:21.068874Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T09:54:44.61244Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-30T06:18:29.247996Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T08:35:41.455302Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-18T21:29:43.809474Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T08:35:28.036746Z","ip":"193.143.1.66","port":"9090","protocol":"UNKNOWN","start_time":"2026-09-03T08:35:27.036746Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:03:28.138118Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-31T17:24:12.584999Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:02:25.877937Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-08-07T00:47:44.100933Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T01:39:28.852479Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-08-08T05:49:58.401209Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T22:07:41.979172Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-08-28T14:09:51.162359Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T00:52:16.098712Z","ip":"193.143.1.66","port":"137","protocol":"NETBIOS","start_time":"2026-08-09T23:56:02.280172Z","transport_protocol":"UDP"},{"end_time":"2026-08-30T12:35:08.914766Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-30T12:35:07.914766Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:47.97546Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-29T16:41:46.892237Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:05.796153Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-29T16:41:04.796153Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:02.922899Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-28T15:36:06.900731Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T07:58:06.585542Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-27T22:15:56.325742Z","transport_protocol":"TCP"},{"end_time":"2026-08-28T15:35:43.787558Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-25T09:42:36.238855Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T11:49:26.197763Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-08-06T21:58:58.894719Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T17:48:08.152599Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-09T03:11:34.174544Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T22:50:47.654382Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-25T14:34:50.836785Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T05:04:41.068833Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-25T05:04:40.068833Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T06:11:20.401666Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-22T03:59:38.056653Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T04:51:06.013531Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-13T20:46:43.391901Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:41:11.048836Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:41:08.066765Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:38:39.199409Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-20T06:59:53.11178Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T22:36:58.940817Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-09T06:16:11.064479Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T19:20:22.500126Z","ip":"193.143.1.66","port":"9090","protocol":"UNKNOWN","start_time":"2026-08-03T14:22:48.413706Z","transport_protocol":"TCP"},{"end_time":"2026-08-16T04:05:57.916075Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-07T05:52:49.821608Z","transport_protocol":"TCP"},{"end_time":"2026-08-12T08:29:58.519067Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-08T00:55:39.69008Z","transport_protocol":"TCP"},{"end_time":"2026-08-03T14:22:59.475037Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-03T14:22:58.475037Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T22:42:21.024176Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-05-31T22:42:20.024176Z","transport_protocol":"TCP"},{"end_time":"2026-05-30T18:42:16.245613Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-30T18:42:15.245613Z","transport_protocol":"TCP"},{"end_time":"2026-05-30T10:43:44.936073Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-30T10:43:43.936073Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T18:34:02.748312Z","ip":"193.143.1.66","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-28T17:42:56.17522Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T09:47:02.779064Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-29T09:47:01.779064Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T16:15:20.796192Z","ip":"193.143.1.66","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-26T16:15:19.796192Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T16:13:27.625759Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-05-26T16:13:26.625759Z","transport_protocol":"TCP"},{"end_time":"2026-05-25T10:01:02.529001Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-25T10:01:01.529001Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T21:16:33.718151Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-23T21:16:32.718151Z","transport_protocol":"TCP"},{"end_time":"2026-05-20T01:34:45.325764Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-18T08:13:12.573011Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T21:39:20.616594Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-05-15T21:39:19.616594Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T22:33:01.672725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-11T22:33:00.672725Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T02:34:01.973858Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-05-11T02:34:00.973858Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T22:01:57.394612Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-05-10T22:01:56.394612Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T01:45:14.159691Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-05-10T01:45:13.159691Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T16:42:44.276507Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-05-09T16:42:43.276507Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:11:31.654974Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-05-08T21:11:30.654974Z","transport_protocol":"TCP"},{"end_time":"2026-05-04T08:30:00.030608Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-04T08:29:59.030608Z","transport_protocol":"TCP"},{"end_time":"2026-05-02T22:48:53.414442Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-01T22:34:46.68277Z","transport_protocol":"TCP"},{"end_time":"2026-05-01T18:33:17.013725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-01T18:33:09.994957Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T17:33:14.790325Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-04-30T17:33:11.249967Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T16:59:19.448061Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-04-14T17:04:13.64869Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T23:41:04.52868Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-26T23:41:03.52868Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T09:32:02.043214Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-24T07:57:33.87038Z","transport_protocol":"TCP"},{"end_time":"2026-04-25T14:03:56.670139Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-24T13:44:03.187993Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T22:49:11.748724Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-24T22:49:10.748724Z","transport_protocol":"TCP"},{"end_time":"2026-04-23T14:00:31.788962Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-21T07:41:23.847256Z","transport_protocol":"TCP"},{"end_time":"2026-04-23T02:31:23.752673Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-21T01:18:39.850522Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T12:46:42.135144Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-21T12:02:11.359464Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T02:53:44.933691Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-18T00:52:42.034927Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T10:58:48.150649Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-19T10:58:47.150649Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T08:45:20.003859Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-19T08:45:19.003859Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T05:51:23.390285Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-17T05:43:22.051071Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T04:36:31.67985Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-17T03:59:39.416911Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T04:07:45.45165Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-17T02:20:28.795831Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T19:34:02.13616Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-16T19:32:55.328918Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T17:54:42.775725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-15T00:24:50.352802Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T01:03:16.643574Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-16T01:03:15.643574Z","transport_protocol":"TCP"},{"end_time":"2026-04-15T22:20:26.391495Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-15T22:20:25.391495Z","transport_protocol":"TCP"},{"end_time":"2026-04-15T18:37:15.079377Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-15T18:37:14.079377Z","transport_protocol":"TCP"},{"end_time":"2026-04-14T20:41:16.185987Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-14T20:41:15.185987Z","transport_protocol":"TCP"},{"end_time":"2026-04-14T09:41:05.341217Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-14T09:41:04.341217Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T21:28:16.20156Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-13T21:28:15.20156Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T10:52:50.21427Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-12T10:14:46.851715Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T10:16:12.90948Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-13T10:16:11.90948Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T07:51:20.436738Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-13T07:51:19.436738Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T01:38:26.659442Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-04-13T01:38:25.659442Z","transport_protocol":"TCP"},{"end_time":"2026-04-12T05:23:56.543152Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-12T05:23:55.543152Z","transport_protocol":"TCP"},{"end_time":"2026-04-12T01:21:21.24045Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-04-12T01:21:20.24045Z","transport_protocol":"TCP"},{"end_time":"2026-04-11T23:12:09.270239Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-11T23:12:08.270239Z","transport_protocol":"TCP"},{"end_time":"2026-04-11T21:42:24.606813Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-11T21:42:23.606813Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T16:55:59.3963Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-10T16:55:58.3963Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T05:51:18.963916Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-10T05:51:17.963916Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T04:18:30.398983Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-10T04:18:29.398983Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T12:07:07.411847Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-09T12:07:06.411847Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T01:06:41.126821Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-05T22:01:40.517984Z","transport_protocol":"TCP"},{"end_time":"2026-04-08T23:34:27.684598Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-07T22:45:23.88789Z","transport_protocol":"TCP"},{"end_time":"2026-04-07T23:06:36.609241Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-07T23:06:35.609241Z","transport_protocol":"TCP"},{"end_time":"2026-04-06T08:52:45.880888Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-06T08:52:44.880888Z","transport_protocol":"TCP"},{"end_time":"2026-04-06T02:35:09.073603Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-05T02:17:03.772209Z","transport_protocol":"TCP"},{"end_time":"2026-04-05T03:50:00.750144Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-05T03:49:59.750144Z","transport_protocol":"TCP"},{"end_time":"2026-04-04T16:58:05.633695Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-04T16:58:04.633695Z","transport_protocol":"TCP"},{"end_time":"2026-04-03T16:49:10.444128Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-03T16:49:09.444128Z","transport_protocol":"TCP"},{"end_time":"2026-04-03T11:08:44.94217Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-03T11:08:43.94217Z","transport_protocol":"TCP"},{"end_time":"2026-04-02T20:30:08.980103Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-02T20:30:07.980103Z","transport_protocol":"TCP"}]}}} +{"ip":"144.172.99.200","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":16,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"144.172.99.0/24","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"reverse_dns":{"names":["200.99.172.144.static.cloudzy.com"],"resolve_time":"2026-09-04T23:12:08Z"}},"ip":"144.172.99.200","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Ogden","continent":"North America","coordinates":{"latitude":41.223,"longitude":-111.97383},"country":"United States","country_code":"US","postal_code":"84401","province":"Utah","timezone":"America/Denver"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.568},"service_count":1,"services":[{"cert":{"added_at":"2026-08-26T03:25:59Z","ever_seen_in_scan":true,"fingerprint_md5":"1b9133b537f0870b27909ee5c2256018","fingerprint_sha1":"7f0064f774506e9c629188241a6116da8840f902","fingerprint_sha256":"b89e8e07f901f4ea249fee100f5e5bf8c500ddc7b5789553bf81933745c132a9","modified_at":"2026-08-26T03:25:59Z","names":["ubuntu-Utah-2gb"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["ubuntu-Utah-2gb"]},"issuer_dn":"CN=ubuntu-Utah-2gb","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"158455660151971640403772937517763029869","serial_number_hex":"7735733813fa47a246d559e259426b6d","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"9068cfd9f3e9be827c9e8dad70efdaa627f9e65433cb33c02e028cf1d25bf00c512df04b1d3695282efda5898b249b78e8f5727fba82703ce12c66bd698cf6a9ae7ce311370f1cc5c96ca209884a6e27382cfe919b4f87a36c93d22c48e0d63ee7e4edfdacf8daf4304615e324b1ed9aa7906a33ef6daa8b738fc2c7f4bd613b2ad87c9e0ad0b04499bb3c1264f318e800211ba761a0e834c65cdb4668bed18998f8f8d3815ff132ce2bb7e80b46cf68fbe97efcff2a66fd2f34af0df10565335d28467acb361307fc976eaa228edcfcc55788e6df5f57ef43ef607f29eb4ffff96f6d092409342946945170900d96a6d2f12f05aae5073c587019f06ac473e7"},"subject":{"common_name":["ubuntu-Utah-2gb"]},"subject_dn":"CN=ubuntu-Utah-2gb","subject_key_info":{"fingerprint_sha256":"57de34d90942fbadb75d04ff9111230db00dd38912c1fcda28651c81145522be","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"a2ef1211a0107c3d0dd9eb42112c4f5d478dd3c9dc23b81a9ea6c9954c375cbb9ed16628725c328e8e242ccfae983e148736c771d02da666ef905ccf3e00abee0e015a044b6d9a5a2f8a841b542e1815270b0129ad30ebd4782ab73885786bab20b0cb7f95ef9ef1a73a64aa82e1cc36b6216d34a29ff34bf32322be74958c9f0d8ba5346914edf03f877eb98bd8994f546f7010e2e835e4f75a214188cc842f9a33faef8a3486ec4a564387fa7866cdaebb87e1b84c7c405b0b308d2e8387bd135fac6465ee78c98abdc56b76e866c9ab71fb0ae5ffb492cced165de21833b9d6c823938fbda323ab7ea2bd08ec847e548c52b50cd5a41a9d39d1d9c773bed7"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-23T17:53:44Z","not_before":"2026-08-24T17:53:44Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"38c920c6580e90da9488ac7ad52c9581ec4e9ee57b067c9d98fb598bee896809","spki_subject_fingerprint_sha256":"38c920c6580e90da9488ac7ad52c9581ec4e9ee57b067c9d98fb598bee896809","tbs_fingerprint_sha256":"4d14e6afc62ed26bca4e87a1ef38b39a1002abecf4ce381b452eaa3b07dbf89a","tbs_no_ct_fingerprint_sha256":"4d14e6afc62ed26bca4e87a1ef38b39a1002abecf4ce381b452eaa3b07dbf89a","validated_at":"2026-09-06T22:37:36Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-26T03:25:59Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.99.200","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:48:29Z"},"jarm":{"cipher_and_version_fingerprint":"06b06b00006b06b06b06b06b06b06b","fingerprint":"06b06b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"144.172.99.200","is_success":true,"port":3389,"scan_time":"2026-09-04T19:04:54Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-07T07:46:04Z","screenshots":[{"extracted_text":"","handle":"fa5b97ca12ee43ee983c371d904cdde0","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"b89e8e07f901f4ea249fee100f5e5bf8c500ddc7b5789553bf81933745c132a9","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["144.172.99.0/24"],"created":"2026-03-09T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2026-03-09T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T05:31:31.391628Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-09-04T18:45:07.119227Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T03:13:39.075931Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-28T20:59:35.640925Z","transport_protocol":"TCP"},{"end_time":"2026-08-28T14:14:20.309699Z","ip":"144.172.99.200","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-27T23:27:41.005255Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T07:12:49.991603Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-26T03:25:36.279979Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T20:14:44.068321Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-25T20:14:43.068321Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T20:40:33.981853Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-17T02:54:59.079101Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T12:54:31.193073Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-08-16T07:06:29.510465Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T05:46:54.34858Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-16T10:32:15.604317Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T16:34:31.942615Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-07T16:01:28.514065Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T09:35:30.792975Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-07T19:07:39.879492Z","transport_protocol":"TCP"},{"end_time":"2026-08-09T20:31:24.661625Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-08-03T12:14:54.866528Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T09:39:23.546787Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-03T17:07:04.743357Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T01:10:18.462747Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-30T10:07:36.836955Z","transport_protocol":"TCP"},{"end_time":"2026-08-02T03:14:37.676159Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-07-27T08:10:33.637398Z","transport_protocol":"TCP"},{"end_time":"2026-08-02T02:37:47.688601Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-27T10:38:43.752172Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T05:18:49.909324Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-27T08:23:56.727333Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T19:34:23.081087Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-07-13T17:50:41.676436Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T10:34:57.743666Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-13T08:01:36.944334Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T09:57:09.664184Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-18T11:43:01.631573Z","transport_protocol":"TCP"},{"end_time":"2026-07-16T15:34:01.662279Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-14T07:46:01.543092Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T17:35:04.406476Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-07T10:52:46.02117Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T15:34:40.900645Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-06-18T01:36:40.756877Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T09:34:41.943864Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-03T08:48:24.859834Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T19:01:25.441212Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-05-26T19:48:18.738634Z","transport_protocol":"TCP"},{"end_time":"2026-07-02T06:40:50.078216Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-06-18T01:36:40.596668Z","transport_protocol":"TCP"},{"end_time":"2026-05-12T03:02:40.136776Z","ip":"144.172.99.200","port":"22","protocol":"SSH","start_time":"2026-04-28T13:06:04.660627Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T18:27:31.973241Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-03-17T05:12:25.133769Z","transport_protocol":"TCP"}]}}} \ No newline at end of file -- cgit v1.2.3