{"ip":"116.98.255.239","total_events":36,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["36 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,152 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,152 bytes sent","bytes_sent":4152,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T11:04:55","last_seen":"2026-08-10T01:09:56","events_24h":0,"events_7d":36,"geo":{"country_code":"VN","country_name":"Vietnam","region":"Ho Chi Minh","city":"Ho Chi Minh City","lat":10.822,"lon":106.6257,"asn":7552,"org":"Viettel Group"},"source_domain":"dynamic-ip-adsl.viettel.vn","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7552","label":"Viettel","category":"isp","url":"https://www.peeringdb.com/asn/7552"},"cve_matches":[],"malware":[],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":24},{"port":139,"proto":"tcp","label":"SMB","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-09","count":24},{"date":"2026-08-10","count":12}],"recent_events":[{"timestamp":"2026-08-10T01:09:56","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"b7b814a2-b33f-461a-b1a0-a9620281a6a0","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:55","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"a5ab28bb-16de-4798-92af-a32625efd7b6","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:44","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"fef11496-40db-481f-a378-75a140421e4a","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:44","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"665e24fd-ed7c-49b3-b13b-f805fe0d71c8","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:43","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"f99a463f-b94b-4be4-b2b0-babbf7975bb9","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:42","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"7e8af8f6-0605-4191-9238-0a851d4e677b","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:22","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"76b18a35-3f24-4f16-a3a0-ad965912f970","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:22","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"0cc96e4a-d459-49d6-82fe-525241211bf8","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:11","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"9200d0c8-989a-41d2-a8be-5efe890d3490","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}},{"timestamp":"2026-08-10T01:09:10","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACACACACA\u0000 CKFDENECEDEMEJEFEOFECACACACACAAA\u0000","payload_hex":"8100004420434b4644454e45434644454646434647454646434341434143414341434143410020434b4644454e45434544454d454a4546454f464543414341434143414341414100","method":"","user_agent":"","ja3":"","session":"be6e035a-0dbf-46d7-a945-7ffdd40b4c94","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"770f0760a53e618d","strings":["D CKFDENECFDEFFCFGEFFCCACACACACACA","CKFDENECEDEMEJEFEOFECACACACACAAA","D CKFDENECFDEFFCFGEFFCCACACACACACA CKFDENECEDEMEJEFEOFECACACACACAAA"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T06:58:07.899043+00:00"}