Arista Networks
Grand Junction Networks, Inc.

ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections.


Grand Junction Networks, Inc.
Arista Networks


ip addresses with this tag have been observed attempting to negotiate an ssh session.


cache-control content-type user-agent content-length host

server connection content-type x-powered-by date content-length

connection content-type date content-length

close
text/plain; charset=utf-8
tue, 25 aug 2026 11:06:09 gmt
94

Mozilla/5.0 (Windows NT 10.0; Win64; x64)

ip addresses with this tag have been seen crawling http(s) servers around the internet.

ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.).

generic suspicious linux command in request


content-type user-agent content-length cache-control host

content-type server x-powered-by content-length connection date

close
text/plain; charset=utf-8
tue, 25 aug 2026 10:31:45 gmt
94


host content-type content-length cache-control user-agent


content-type content-length user-agent cache-control host

content-type server content-length x-powered-by connection date

close
text/plain; charset=utf-8
tue, 25 aug 2026 09:03:03 gmt
94


ip addresses with this tag have been observed crawling the internet for ssh servers running on ports other than 22/tcp.

ssh alternative port crawler
ssh connection attempt


user-agent accept-encoding host content-type content-length secret

content-length accept-encoding content-type secret


ip addresses with this tag have been observed sending quic traffic.


cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.

generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.


date connection content-type server content-length x-powered-by

close
text/plain; charset=utf-8
sat, 22 aug 2026 15:14:55 gmt
94


content-type content-length x-powered-by date connection server

close
text/plain; charset=utf-8
sat, 22 aug 2026 15:03:43 gmt
94


content-type connection date x-powered-by content-length server

close
text/plain; charset=utf-8
sat, 22 aug 2026 14:43:10 gmt
94


ip addresses with this tag have been observed sending dns traffic.