{"ip":"119.60.131.114","total_events":2239,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"2,239 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["2,239 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"210,466 bytes sent","bytes_sent":210466,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T00:06:24","last_seen":"2026-09-26T00:15:39","events_24h":0,"events_7d":2239,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4134,"org":"Chinanet"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4134","label":"China Telecom","category":"isp","url":"https://www.peeringdb.com/asn/4134"},"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":2239}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":2239}],"recent_events":[{"timestamp":"2026-09-26T00:15:39","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000N�\u0000\u0011Z��\u000fg\u001cN���\t����C�Vq���C��\u0014Es\r\u0015�U\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000004ecc00115ae88b0f671c4e819df4098cb8a6b343e15671ebf6f043addd1445730d158e5500000001","method":"","user_agent":"","ja3":"","session":"f99bd019-a3ae-4fe9-9913-efa50b694067","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T00:15:39","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000N�\u0000\u0004�����XL�\u0019�s\u0012�u!j�t����I�\u000b4k\u0019\u0018FhU\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000004ef40004f6bdefbec8584c9919da7312cc75216ac874f8d6e8a849b90b346b191846685500000001","method":"","user_agent":"","ja3":"","session":"8a87a15a-ed53-4e22-883a-f7e414e8a79e","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000't\u0000WANK�.�E����.H\u0010\u0010����j��I�|ҩ\u001b\u0018\\7Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe00000100000027740057414e4bc72ea645b4d8d8d12e481010af959d8e6a9a9049937cd2a91b185c375a00000001","method":"","user_agent":"","ja3":"","session":"63fd29da-cc29-4de3-8ac8-f2fd9be190c8","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"004a4b628bf5025f","strings":["WANK","'tWANK"]}},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000#d\u0000���H�\bqJ�\u000f\u001a��y�w���<…�I�\u0007#A��T#Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe000001000000236400f581f0488708714a850f1aa0b5799c7784a69e3cc285e349a9072341d2dc54235a00000001","method":"","user_agent":"","ja3":"","session":"2c223b76-fff2-40ae-857e-4d48854f3fb2","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000=h\u0000El>f͝�B��\u0006����\u001e\u0004�(j�!\u001aI�e�1)�T~Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000003d6800456c3e66cd9df24280a306c0fdf0d31e0481286ab5211a499465883129bc547e5a00000001","method":"","user_agent":"","ja3":"","session":"695dd0cf-d9bb-48a3-9943-9b991d208b4f","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"c8dc2f9aa7e245ca","strings":["El>f","=hEl>f"]}},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000>\b\u0000�8�f���A�uof�\n�j\u0003��N��\nH�H\\j��_�Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000003e0800c9388766f0c1d141a4756f669c0aca6a03a1ca4ee3cd0a48b3485c6adaf65fd65a00000001","method":"","user_agent":"","ja3":"","session":"13bd91cb-becb-42fc-81fd-cb53206ed5bf","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000I4\u0000���/��{E�$I�-*!z�~X�N��L��@7J\u000f*GZ\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe000001000000493400a2ed842fc1d87b45b92449f22d2a217ae97e58d84eb5ae4c9bd340374a0f2a475a00000001","method":"","user_agent":"","ja3":"","session":"78052c3d-4442-438c-8379-9c1760b24150","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"b97e4332c87dc4f3","strings":["-*!z"]}},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000K�\u0000�Z\\R�\"�C��\u0015����A�t��c\u001dI��y!�\u001e\u001e�Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000004b8400c35a5c52fa22e543add315af90aeb6417fc974b5b3631d498efc7921ac1e1e9f5a00000001","method":"","user_agent":"","ja3":"","session":"c6e4e7ba-a908-40d2-8143-f9d60539631b","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000\u0010�\u0000��u�F\neL�Q}���s\u0006��v�4udC�\\��)c��Z\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe000001000000109800b08175bf460a654ca2517dac88f97306acd376a8347564439d5c81fa296389b45a00000001","method":"","user_agent":"","ja3":"","session":"415ccca3-ffc8-4651-a1c2-0d6c6b2f9ca9","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"2cc8cce102752020","strings":["4udC"]}},{"timestamp":"2026-09-26T00:15:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b#�\u0000\u0000\u0001\u0000\u0000\u0000*�\u0000Th�܂�4J��#��!����i5�E�N�������UZ\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040823fe0000010000002ac00054689edc82de344a90d72390dd21a78ae4fa6935fc45884ebaa7defedcf2d0555a00000001","method":"","user_agent":"","ja3":"","session":"d3f75b92-9f92-4fd6-a78f-8ea6b433e584","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T14:58:48.869307+00:00"}