{"ip":"117.132.143.173","total_events":197,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["197 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 18,518 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"18,518 bytes sent","bytes_sent":18518,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-25T09:38:11","last_seen":"2026-09-25T09:56:56","events_24h":0,"events_7d":197,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":56044,"org":"China Mobile communications corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":197}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":197}],"recent_events":[{"timestamp":"2026-09-25T09:56:56","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000=�\u0000�v�.\u000fD�I���~�\u0007Ч�j��\u0007\\\u001fN��>\u001dT����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003de800ec76892e0f44bb4988d3df7eb307d0a7ab6aac97075c1f4ebbe53e1d54d6ddd9e100000001","method":"","user_agent":"","ja3":"","session":"e8180011-2c7f-4d6a-a172-074b73094a45","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:52","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00009\f\u0000��\u000b��k\u001eJ�\u0003����\u000b�`\"w�\r��G��K\u001c��\u0007��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000390c00ac9d0bb6a96b1e4a8103a997b3c40b96602277cd0dcff6479fa24b1cf6bf0794e000000001","method":"","user_agent":"","ja3":"","session":"b3660e03-d3dc-46d0-a6e0-f24bdff0ad8c","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:52","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000!�\u0000�\r�\u0011�#O�+[�Y\u001c�S����C���@g����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000021e0007fb10d8a11a5234f9d2bee94a85b95591cc6539ab0f19d43a1fc9f4067dbd0e6df00000001","method":"","user_agent":"","ja3":"","session":"f7d1c99e-680d-464c-aad3-fd9a95e88436","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:52","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u000e\b\u0000�Z���\u001a�D�u8��G\u001d\u001c%\u0017�\u0007��.A�%�F���M�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000000e0800fe5abf8f921ab444877538c3f9471d1c2517a407d4e52e418c2594469df3dd4ddf00000001","method":"","user_agent":"","ja3":"","session":"5e5dd67f-e2f5-4cdd-ba4d-18c3ff4845f0","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:43","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000)�\u0000%q1��u�O��[��m�<�ӿ�\u0011F�B�׵�+�\u0011G�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000298000257131bcb375bb4fb2825be5c96da43cadd3bfc41146e342bed7b5d62bcb1147e000000001","method":"","user_agent":"","ja3":"","session":"dc4866d6-4b54-498d-89fb-cab080cbd450","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:43","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u0010�\u0000�x\u0019�tӷ@�\u001d�͊�-\b�W\u0019��f�N��\u0015P\u0011�u��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000010cc00af78199b74d3b740841dd6cd8af32d08f55719ff8366a84e8cc2155011ac75c0df00000001","method":"","user_agent":"","ja3":"","session":"2e7a5f91-8e39-46a3-bb3a-e63bfae169f7","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:32","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000U�\u0000��P����B���q/n\u0017��_�����J��ĨC\\h=�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000559800a4af50caf9c08d428ad9ea712f6e17e1da5f82cff6e9d44ab6b6c4a8435c683ddd00000001","method":"","user_agent":"","ja3":"","session":"268c6784-8f8e-402b-a2a9-2d785e84507a","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":15,"enriched":{"digest":"86567103a08b6fed","strings":["C\\h="]}},{"timestamp":"2026-09-25T09:56:32","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00006|\u0000j\u001e�2���M��p�h�A�6,��v�nB�<%��w�R�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000367c006a1ec73280c6fa4d9dfa70f6689941c7362c8b9676b16e42933c25979977ee52de00000001","method":"","user_agent":"","ja3":"","session":"23c3f408-85b9-4ff9-9bbb-4ae84644bda0","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":15},{"timestamp":"2026-09-25T09:56:31","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000<8\u0000vB@�@�BL�z���\u0005�cێ�~�T�B��AK�A���\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003c3800764240af40ee424ca17abdc4fd05b663db8ec87ed354f7428cd1414baa41bad2dd00000001","method":"","user_agent":"","ja3":"","session":"929c6907-f4c7-47d4-a4b9-51c8df00432e","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":15,"enriched":{"digest":"f52c2afdfa2e5768","strings":["<8vB@"]}},{"timestamp":"2026-09-25T09:56:31","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000J�\u0000\tK�{�n�D��T��k���Z���\f]E�g���\u0017�Z�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000004aec00094ba07bdb6ee244a8c854afa16b87aea95aa2f2af0c5d459b67b8f1b917d25add00000001","method":"","user_agent":"","ja3":"","session":"76db296f-8541-4594-b446-4062cfcdb36a","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":15}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T20:50:58.950856+00:00"}