{"ip":"109.236.48.223","total_events":326,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"169+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 169 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,322 bytes sent","bytes_sent":15322,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T15:39:07","last_seen":"2026-09-24T00:31:58","events_24h":15,"events_7d":219,"geo":{"country_code":"TR","country_name":"Türkiye","region":"Bursa Province","city":"Bursa","lat":40.1925,"lon":29.0587,"asn":215391,"org":"CAFER ESER"},"source_domain":"hostivon.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":25113,"proto":"tcp","label":"","count":4},{"port":40813,"proto":"tcp","label":"","count":4},{"port":11620,"proto":"tcp","label":"","count":4},{"port":38731,"proto":"tcp","label":"","count":4},{"port":3884,"proto":"tcp","label":"","count":4},{"port":57049,"proto":"tcp","label":"","count":4},{"port":11200,"proto":"tcp","label":"","count":4},{"port":54405,"proto":"tcp","label":"","count":4},{"port":25908,"proto":"tcp","label":"","count":4},{"port":48857,"proto":"tcp","label":"","count":4},{"port":13954,"proto":"tcp","label":"","count":4},{"port":22088,"proto":"tcp","label":"","count":3},{"port":44822,"proto":"tcp","label":"","count":3},{"port":59574,"proto":"tcp","label":"","count":3},{"port":42450,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-07","count":21},{"date":"2026-09-08","count":8},{"date":"2026-09-10","count":78},{"date":"2026-09-21","count":171},{"date":"2026-09-22","count":11},{"date":"2026-09-23","count":35},{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T00:31:58","port":23071,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"5fb3d6e1-b50f-4737-9b17-31ebf4810a0c","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-24T00:31:57","port":23071,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"67fd7015-f894-4f3c-9dab-67c7ba31611e","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T23:58:04","port":36194,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ddc9f2da-f973-43e9-8c45-cad4879e86e9","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T23:24:29","port":25113,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"44539fd6-2b49-4c3f-99f8-0eed9602c7d7","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T23:24:29","port":25113,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"0ccfbfb7-d9cb-4263-9aee-33f3bed56d7e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T22:59:52","port":65457,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"63e3003a-e935-4b60-a39e-fece26e79406","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T21:01:03","port":7927,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"f1248ff5-41c9-46ef-8438-752a21cc8a95","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T21:01:02","port":7927,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"80fdd188-a12e-40f6-9bae-cc2a9744a37d","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T20:14:44","port":13856,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d27f51fd-49d3-4726-a7e1-e533097b6fff","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-23T20:14:44","port":13856,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"65702232-4d1f-495b-83c3-681147ab790a","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14}],"http_methods":[],"distinct_ports_total":169,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T16:18:27.909208+00:00"}