{"ip":"123.184.38.31","total_events":366,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["366 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 34,404 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"34,404 bytes sent","bytes_sent":34404,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-25T09:38:12","last_seen":"2026-09-25T09:57:01","events_24h":0,"events_7d":366,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4134,"org":"Chinanet"},"source_domain":"31.38.184.123.broad.sy.ln.dynamic.163data.com.cn","known_scanners":[],"scanner_tag":{"key":"peeringdb:as4134","label":"China Telecom","category":"isp","url":"https://www.peeringdb.com/asn/4134"},"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":366}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":366}],"recent_events":[{"timestamp":"2026-09-25T09:57:01","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000U�\u0000�Fhւ�(A�\u001a�rC�\u001b��_�����J��ĨC\\h=�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000559800954668d682a228419d1ab772438c1be6da5f82cff6e9d44ab6b6c4a8435c683de300000001","method":"","user_agent":"","ja3":"","session":"2af89f85-dea3-4fad-a528-724b1ad26b0d","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"856456ab308a360e","strings":["C\\h="]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000U$\u0000���%��D��J�5!\u00173�\u0002�����G���:\u0017�V��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000552400e68f7fd025e1af4482a54ad435211733b502f49abadcde47a3d3d43a178d56c7e300000001","method":"","user_agent":"","ja3":"","session":"c8325032-49c6-41b1-86c4-dd03bd251307","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u0012H\u00000zC��\"\u000bL� \u0018CA�^���)[\u001a\u0019hM��@�KT3\u0001�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000124800307a4390a0220b4cbc20184341c65ec7cfd5295b1a19684d86c540de4b543301e300000001","method":"","user_agent":"","ja3":"","session":"9b87e0cd-9146-4627-bb3b-87faf3f3d4ae","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"a7e85f63aa1cd6cd","strings":["H0zC"]}},{"timestamp":"2026-09-25T09:56:51","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000MX\u0000�\u000fB���\u001aK�\u0003�\u0012Q!�γZ�a|\u0015�B�)Q�]ΐw�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000004d5800b70f42859ccf1a4bac03ba125121c8ceb35a8f617c15f342bf2951cf5dce9077dc00000001","method":"","user_agent":"","ja3":"","session":"e7eedba0-c5bb-43e2-86e0-4c8b313d4026","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:51","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000J�\u0000!hL��Q�C���\u001c�с_�Z���\f]E�g���\u0017�Z�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000004aec0021684c958951fb43a6b9c51c9bd1815fa95aa2f2af0c5d459b67b8f1b917d25ae100000001","method":"","user_agent":"","ja3":"","session":"b5c06172-6753-416f-8f2f-28b3ae78e552","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:43","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000!�\u0000�\u0016�wŇ�M� }�\u0000�9J$V\u0012�oo\u0007L�\u00031 +�\u001e\u001a�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000218800e916ee77c587964dbb207dfa00d3394a245612cc6f6f074c9f0331202bff1e1ade00000001","method":"","user_agent":"","ja3":"","session":"970804c2-0af3-4f09-9a5e-bde4a4f5e35d","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"4418036d23479cab","strings":["9J$V"]}},{"timestamp":"2026-09-25T09:56:42","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\r�\u0000\u001b S��f\\D�3�\"�]���776P\u0002�F�\u001b�\u001f�l/)�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000000da0001b20539adf665c44a233d222895d98e8943737365002d546bb1bb41f896c2f29e000000001","method":"","user_agent":"","ja3":"","session":"01402b8f-67de-43aa-aa47-0742d56a396e","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fd943f925d946d39","strings":["776P"]}},{"timestamp":"2026-09-25T09:56:36","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00006|\u0000�\"\u0007����G��q����6,��v�nB�<%��w�R�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000367c00b1220788f989e447bdc3717f86f48dcc362c8b9676b16e42933c25979977ee52df00000001","method":"","user_agent":"","ja3":"","session":"1605197c-0ed2-46ae-b66f-0ef457fdcdb5","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:36","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000:(\u0000��yE_;EC���A\u0000�m��x\u0004�W\u000f�F��\u0013JcC�$�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003a28009ad679455f3b4543aa93cc4100c96dad9c780499570f824686a4134a6343ca24dd00000001","method":"","user_agent":"","ja3":"","session":"42117f22-98e2-4a9d-9637-e7b8151950f9","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"dd5049576747703b","strings":["yE_;EC"]}},{"timestamp":"2026-09-25T09:56:32","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000)�\u0000�\u0001\n���bK������\u0010��ӿ�\u0011F�B�׵�+�\u0011G�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000029800093010a86a1d3624b83fca0fc99f010efadd3bfc41146e342bed7b5d62bcb1147de00000001","method":"","user_agent":"","ja3":"","session":"466201a1-0468-4a60-b597-99665280c50d","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T03:50:00.946975+00:00"}