{"ipv4":17583,"ipv6":417,"mapped":17545,"nginx_total":37,"proto_counts":{"ARP":20,"GRE":2,"ICMP":8,"ICMPV6":121,"IGMP":22,"TCP":17040,"UDP":787},"rate":1.5,"top_asns":[{"asn":"AS215762 Bullet Group LTD","n":8642},{"asn":"AS4618 Internet Thailand Company Limited","n":5503},{"asn":"AS47890 Unmanaged Ltd","n":624},{"asn":"AS36352 HostPapa","n":496},{"asn":"AS48090 Techoff Srv Limited","n":416},{"asn":"AS53667 FranTech Solutions","n":297},{"asn":"AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.","n":234},{"asn":"AS63949 Akamai Connected Cloud","n":169},{"asn":"AS396982 Google LLC","n":94},{"asn":"AS25369 Hydra Communications Ltd","n":83},{"asn":"AS51396 Pfcloud UG (haftungsbeschrankt)","n":82},{"asn":"AS8075 Microsoft Corporation","n":80},{"asn":"AS60068 Datacamp Limited","n":66},{"asn":"AS50360 Tamatiya EOOD","n":65},{"asn":"AS267784 Flyservers S.A.","n":54},{"asn":"AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED","n":39},{"asn":"AS208137 Feo Prest SRL","n":38},{"asn":"AS13335 Cloudflare, Inc.","n":38},{"asn":"AS60223 Netiface Limited","n":33},{"asn":"AS215925 Vpsvault.host Ltd","n":23},{"asn":"AS30600 Metronet","n":22},{"asn":"AS215930 Cipher Operations Doo Beograd - Novi Beograd","n":17},{"asn":"AS206264 Amarutu Technology Ltd","n":16},{"asn":"AS211680 Sistemas Informaticos, S.A.","n":16},{"asn":"AS62610 Zenlayer Inc","n":16}],"top_countries":[{"cc":"SE","n":8654},{"cc":"TH","n":5504},{"cc":"US","n":1559},{"cc":"RO","n":421},{"cc":"BG","n":365},{"cc":"CN","n":274},{"cc":"NL","n":267},{"cc":"GB","n":107},{"cc":"PL","n":66},{"cc":"PA","n":54},{"cc":"DE","n":42},{"cc":"TW","n":39},{"cc":"HK","n":37},{"cc":"SC","n":23},{"cc":"PT","n":20},{"cc":"IR","n":19},{"cc":"NO","n":13},{"cc":"FR","n":10},{"cc":"ZA","n":8},{"cc":"JP","n":7},{"cc":"RU","n":6},{"cc":"TR","n":4},{"cc":"AE","n":4},{"cc":"PK","n":4},{"cc":"NI","n":4}],"top_endpoints":[{"n":8,"uri":"/"},{"n":2,"uri":"/favicon.ico"},{"n":1,"uri":"/form.html"},{"n":1,"uri":"/upl.php"},{"n":1,"uri":"/t4"},{"n":1,"uri":"/geoip/"},{"n":1,"uri":"/1.php"},{"n":1,"uri":"/systembc/password.php"},{"n":1,"uri":"/password.php"},{"n":1,"uri":"/Dr0v"},{"n":1,"uri":"/.env"},{"n":1,"uri":"/.env.backup"},{"n":1,"uri":"/.env.old"},{"n":1,"uri":"/.env.save"},{"n":1,"uri":"/.env.bak"},{"n":1,"uri":"/.env.prod"},{"n":1,"uri":"/.env.production"},{"n":1,"uri":"/.env.staging"},{"n":1,"uri":"/.env.local"},{"n":1,"uri":"/.envrc"},{"n":1,"uri":"/env"},{"n":1,"uri":"/config/.env"},{"n":1,"uri":"/app/.env"}],"top_ips":[{"asn":4618,"ip":"203.150.243.61","n":5503},{"asn":215762,"ip":"91.92.40.171","n":5179},{"asn":215762,"ip":"91.92.40.200","n":3463},{"asn":47890,"ip":"2.57.122.238","n":336},{"asn":53667,"ip":"209.141.33.46","n":295},{"asn":38365,"ip":"106.12.128.184","n":234},{"asn":48090,"ip":"195.178.110.217","n":229},{"asn":47890,"ip":"92.118.39.77","n":207},{"asn":36352,"ip":"198.12.67.118","n":160},{"asn":36352,"ip":"198.12.67.213","n":158},{"asn":36352,"ip":"198.12.67.20","n":158},{"asn":null,"ip":"fe80::216:3cff:fe37:92ef","n":145},{"asn":null,"ip":"fe80::216:3cff:fece:75b9","n":145},{"asn":63949,"ip":"198.74.56.46","n":86},{"asn":null,"ip":"68.69.177.112","n":77},{"asn":8075,"ip":"20.215.50.93","n":65},{"asn":60068,"ip":"212.102.40.218","n":64},{"asn":51396,"ip":"176.65.148.243","n":55},{"asn":267784,"ip":"45.227.254.170","n":54},{"asn":48090,"ip":"195.178.110.137","n":51},{"asn":48090,"ip":"45.148.10.157","n":45},{"asn":13335,"ip":"172.65.32.248","n":38},{"asn":60223,"ip":"185.242.3.195","n":32},{"asn":48090,"ip":"45.148.10.152","n":30},{"asn":48090,"ip":"45.148.10.141","n":30}],"top_methods":[{"method":"GET","n":32}],"top_ports":[{"n":15853,"port":22,"port_desc":"Secure Shell (SSH), secure logins, file transfers (scp, sftp) and port forwarding"},{"n":301,"port":80,"port_desc":"Hypertext Transfer Protocol (HTTP) uses TCP in versions 1.x and 2. HTTP/3 uses QUIC, a transport pro"},{"n":288,"port":21027,"port_desc":null},{"n":152,"port":1900,"port_desc":"Simple Service Discovery Protocol (SSDP), discovery of UPnP devices"},{"n":151,"port":443,"port_desc":"Hypertext Transfer Protocol Secure (HTTPS) uses TCP in versions 1.x and 2. HTTP/3 uses QUIC, a trans"},{"n":20,"port":48808,"port_desc":null},{"n":18,"port":48792,"port_desc":null},{"n":10,"port":24083,"port_desc":null},{"n":9,"port":137,"port_desc":"NetBIOS Name Service, used for name registration and resolution"},{"n":8,"port":23,"port_desc":"Telnet protocol\u2014unencrypted text communications"},{"n":8,"port":8728,"port_desc":"MikroTik RouterOS API"},{"n":8,"port":3389,"port_desc":"Microsoft Terminal Server (RDP) officially registered as Windows Based Terminal (WBT)"},{"n":8,"port":2222,"port_desc":"EtherNet/IP implicit messaging for IO data"},{"n":7,"port":23897,"port_desc":null},{"n":6,"port":5683,"port_desc":"Constrained Application Protocol (CoAP)"},{"n":5,"port":8080,"port_desc":"Alternative port for HTTP. See also ports 80 and 8008."},{"n":5,"port":8090,"port_desc":"Atlassian Confluence"},{"n":5,"port":5353,"port_desc":"League of Legends, a multiplayer online battle arena video game"},{"n":5,"port":24765,"port_desc":null},{"n":5,"port":22342,"port_desc":null},{"n":5,"port":8000,"port_desc":"Deno"},{"n":4,"port":8443,"port_desc":"SW Soft Plesk Control Panel"},{"n":4,"port":8088,"port_desc":"Asterisk management access via HTTP"},{"n":4,"port":6034,"port_desc":"X11\u2014used between an X client and server over the network"},{"n":4,"port":5006,"port_desc":"League of Legends, a multiplayer online battle arena video game"}],"top_types":[{"n":7478,"type":"PSH-ACK"},{"n":6599,"type":"ACK"},{"n":1693,"type":"SYN"},{"n":1028,"type":"FIN-ACK"},{"n":787,"type":"UDP"},{"n":160,"type":"RST"},{"n":121,"type":"RS"},{"n":37,"type":"HTTP"},{"n":24,"type":"RST-ACK"},{"n":22,"type":"IGMP"},{"n":20,"type":"REQUEST"},{"n":14,"type":"SYN-ACK"},{"n":7,"type":"ECHO-REQ"},{"n":6,"type":"FIN-PSH-ACK"},{"n":2,"type":"GRE"},{"n":1,"type":"UNREACH"},{"n":1,"type":"SYN-ECE-CWR"}],"top_useragents":[{"n":13,"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security  https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"},{"n":6,"ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"},{"n":2,"ua":"Mozilla/5.0"},{"n":2,"ua":"Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)"},{"n":2,"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"},{"n":1,"ua":"curl/8.1.2"},{"n":1,"ua":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"},{"n":1,"ua":"-"},{"n":1,"ua":"Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1"},{"n":1,"ua":"Mozilla/5.0 zgrab/0.x"},{"n":1,"ua":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"}],"total":18000,"unique_ips":631}