{"ip":"1.0.203.159","total_events":227,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"47+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 47 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,127 bytes sent","bytes_sent":2127,"session_seconds":1,"persistent":false}},"first_seen":"2026-07-17T07:53:33","last_seen":"2026-07-26T12:28:02","events_24h":0,"events_7d":60,"geo":{"country_code":"TH","country_name":"Thailand","region":"Bangkok","city":"Bangkok","lat":13.7618,"lon":100.5324,"asn":23969,"org":"TOT Public Company Limited"},"source_domain":"node-exr.pool-1-0.dynamic.nt-isp.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as23969","label":"NT Broadband ISP","category":"isp","url":"https://www.peeringdb.com/asn/23969"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":12},{"port":5003,"proto":"tcp","label":"","count":6},{"port":5002,"proto":"tcp","label":"","count":6},{"port":6221,"proto":"tcp","label":"","count":6},{"port":5064,"proto":"tcp","label":"","count":6},{"port":30045,"proto":"tcp","label":"","count":6},{"port":5059,"proto":"tcp","label":"","count":6},{"port":5122,"proto":"tcp","label":"","count":6},{"port":2125,"proto":"tcp","label":"","count":6},{"port":2127,"proto":"tcp","label":"","count":6},{"port":4105,"proto":"tcp","label":"","count":6},{"port":6182,"proto":"tcp","label":"","count":6},{"port":8085,"proto":"tcp","label":"","count":6},{"port":5148,"proto":"tcp","label":"","count":6},{"port":28922,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-17","count":39},{"date":"2026-07-18","count":6},{"date":"2026-07-19","count":3},{"date":"2026-07-20","count":15},{"date":"2026-07-21","count":54},{"date":"2026-07-22","count":15},{"date":"2026-07-23","count":15},{"date":"2026-07-24","count":50},{"date":"2026-07-25","count":18},{"date":"2026-07-26","count":12}],"recent_events":[{"timestamp":"2026-07-26T12:28:02","port":28922,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"17c1cbf0-0c67-43e5-b9c5-621eff2a4472","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-07-26T12:27:32","port":28922,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"6805a3b4-e84d-43e8-ac4a-5efcb17cc1c5","seq":2,"duration_ms":589,"bytes_in":8,"bytes_out":22,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-07-26T12:27:32","port":28922,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"6805a3b4-e84d-43e8-ac4a-5efcb17cc1c5","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-07-26T09:21:49","port":2125,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"c6cb50b9-0192-4610-abbf-296c18dbf032","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-07-26T09:21:19","port":2125,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"cc38dae7-eab9-4b2f-98e3-bd4da93a0ecd","seq":2,"duration_ms":634,"bytes_in":8,"bytes_out":22,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-07-26T09:21:19","port":2125,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"cc38dae7-eab9-4b2f-98e3-bd4da93a0ecd","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-07-26T07:24:24","port":8729,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"d4964fc8-c670-478f-a33a-a459b83a4c36","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-07-26T07:23:54","port":8729,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"00a1fc39-62eb-43c7-9623-f7dacf0e5a72","seq":2,"duration_ms":604,"bytes_in":8,"bytes_out":22,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-07-26T07:23:54","port":8729,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"00a1fc39-62eb-43c7-9623-f7dacf0e5a72","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-07-26T05:04:05","port":2127,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"13be266d-5e8f-4169-a830-1da517695b22","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":47,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-31T12:58:42.656080+00:00"}