{"ip":"103.20.223.41","total_events":183,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"136+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 136 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,124 bytes sent","bytes_sent":6124,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-13T21:30:13","last_seen":"2026-10-08T16:57:14","events_24h":44,"events_7d":44,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":40065,"org":"CNSERVERS LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as40065","label":"CNSERVERS","category":"isp","url":"https://www.peeringdb.com/asn/40065"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":6011,"proto":"tcp","label":"","count":3},{"port":6009,"proto":"tcp","label":"","count":3},{"port":5978,"proto":"tcp","label":"","count":2},{"port":5911,"proto":"tcp","label":"","count":2},{"port":6008,"proto":"tcp","label":"","count":2},{"port":5973,"proto":"tcp","label":"","count":2},{"port":5937,"proto":"tcp","label":"","count":2},{"port":6512,"proto":"tcp","label":"","count":2},{"port":5941,"proto":"tcp","label":"","count":2},{"port":5925,"proto":"tcp","label":"","count":2},{"port":5962,"proto":"tcp","label":"","count":2},{"port":5926,"proto":"tcp","label":"","count":2},{"port":5917,"proto":"tcp","label":"","count":2},{"port":6482,"proto":"tcp","label":"","count":2},{"port":5971,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-13","count":10},{"date":"2026-08-14","count":2},{"date":"2026-09-26","count":127},{"date":"2026-10-08","count":44}],"recent_events":[{"timestamp":"2026-10-08T16:57:14","port":5954,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"b5289fd3-da46-4131-ba82-c5aaa5f84008","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:52:53","port":657,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0010\u0002\u0001\u0000PCMRDC\u0000\u0000\u0001\u0000\u0000\u0000 \u0000\u0000\u0000\u0001\u0000\u0000\u0000 \u0000\u0000\u0000�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000��������\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000`\u0000\u0000\u00008\u0000\u0000\u0000�\u0000\u0000\u0000\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000e��j\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000��\u0000\u0000\u0010\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00008\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000&\u0000\u0000\u0000(\u0000\u0000\u0000*\u0000\u0000\u0000,\u0000\u0000\u0000.\u0000\u0000\u00000\u0000\u0000\u0000C\u0000C\u0000C\u0000C\u0000C\u0000C\u0000.\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002[]\u0000\u0000\u0000\u0000","payload_hex":"c80000001002010050434d524443000001000000200000000100000020000000a8000000010000000000000004000000ffffffffffffffff00000000000000006000000038000000980000000a000000000000000000000065cac76a0000000000000000a2000000ffff000010000000ffff000000000000000000000000000038000000000000002400000026000000280000002a0000002c0000002e000000300000004300430043004300430043002e00000000000000810100000001000000025b5d00000000","method":"","user_agent":"","ja3":"","session":"6f00231c-af0c-4647-8402-8ef7a6a78991","seq":1,"duration_ms":100,"bytes_in":200,"bytes_out":13,"enriched":{"digest":"59f429f5c50229f2","strings":["PCMRDC","8$&(*,.0CCCCCC."]}},{"timestamp":"2026-10-08T16:46:03","port":5987,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"46d1722c-62b4-4940-88fc-1380ffe485ad","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:43:35","port":5973,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"6e973cf2-f732-4663-a9db-a5568ece12f9","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:40:01","port":6036,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"97f484b5-e28b-4de5-8ce9-82b798c7bbc3","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:40:01","port":6100,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"f19d5064-b489-4135-aa0c-aed9906d2190","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:36:54","port":7415,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"04722e0e-cbdb-42f7-9abd-0c419800c8af","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:22:23","port":5929,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"8d3450af-7719-4bbf-821f-6dfdb929655e","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:18:58","port":5902,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"dc7ccb0a-aeb3-4c95-934a-ebfa01bf511c","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-08T16:18:43","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"f95774c7-fab3-4e75-ba82-21dae717694f","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":13,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":136,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-09T13:35:43.102942+00:00"}