{"ip":"124.95.131.71","total_events":3189,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,189 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["3,189 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"299,766 bytes sent","bytes_sent":299766,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-25T09:38:11","last_seen":"2026-09-25T09:57:01","events_24h":0,"events_7d":3189,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":3189}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":3189}],"recent_events":[{"timestamp":"2026-09-25T09:57:01","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u0014L\u0000'�ѥ���E���?�N_Vt�\u0013\u0013�ȈH�X�������\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000144c0027aad1a590b1c2459c8f8f3ff54e5f5674af1313bec888488858c6f6a392bad6e300000001","method":"","user_agent":"","ja3":"","session":"3bb25185-e84f-4246-bdce-822c4d595203","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"bf356bcbf9982a57","strings":["N_Vt"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000!�\u0000�N�,�ֺF�#�x\"G�h\u001c�S����C���@g����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000021e000ec4e8e2cd6d6ba46992398782247af681cc6539ab0f19d43a1fc9f4067dbd0e6e000000001","method":"","user_agent":"","ja3":"","session":"9e40fcff-58fe-4515-97ef-e4c45b8a8f3b","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000S�\u0000\u001a�yC釠J�s��'����Zt\u0007��\u0000J�$?L�B)\"�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000053ec001ae57943e987a04aa273d9eb278cad81b15a7407fef9004aa6243f4c88422922e300000001","method":"","user_agent":"","ja3":"","session":"3279db82-15a6-4f4d-a329-e94deb82532e","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000<8\u0000G\u0002;���\"J����\u0003�\u0017�ێ�~�T�B��AK�A���\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003c380047023bfc9af3224abebfe1bd03f71787db8ec87ed354f7428cd1414baa41bad2e300000001","method":"","user_agent":"","ja3":"","session":"ad4e3c63-4f51-4dbe-bec4-aeaaa3a0b216","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00006|\u0000���\u001fF#�C�ř���W(6,��v�nB�<%��w�R�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000367c00e0f1e21f4623be43b1c599e08b905728362c8b9676b16e42933c25979977ee52e300000001","method":"","user_agent":"","ja3":"","session":"9b8f746e-c269-4567-892d-de6301af68aa","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"aee14ac78f1c38ee","strings":["W(6,"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000J�\u0000�\u001d�`�W�E�����?�\u0012�Z���\f]E�g���\u0017�Z�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000004aec00891def608c57a045b7e19ff4dc3fe812a95aa2f2af0c5d459b67b8f1b917d25ae300000001","method":"","user_agent":"","ja3":"","session":"8c393e7f-ea47-4366-92e7-b9ac272eaf2e","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00009\f\u0000�2��Bi�E�\n�\u0010#U��`\"w�\r��G��K\u001c��\u0007��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000390c009832c2c54269f445b50ab7102355eabb602277cd0dcff6479fa24b1cf6bf0794e200000001","method":"","user_agent":"","ja3":"","session":"830d5887-d7d9-4637-9e22-d4ebe0ee0fc9","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u0002�\u0000�\u0017{SڈRC��\u0001����l8��:��B��E,\u000f\bs��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000002e800af177b53da885243b8b2017fa1aec2e46c38aaa53abadf4298c2452c0f0873f1e100000001","method":"","user_agent":"","ja3":"","session":"6d8bbd94-0636-4135-aa99-00ea2ae429da","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000!�\u0000pj}˶��G�\u000e�\u001d�Z�v\u001c�S����C���@g����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000021e000706a7dcbb687e147980e841d9a5ac3761cc6539ab0f19d43a1fc9f4067dbd0e6e100000001","method":"","user_agent":"","ja3":"","session":"b5ad8ab9-d10f-4eaf-a805-b26f511878a7","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000!�\u0000�.�!�<1G�oM�\u001a!|�$V\u0012�oo\u0007L�\u00031 +�\u001e\u001a�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000218800e72ee721923c3147836f4dc01a217cb1245612cc6f6f074c9f0331202bff1e1ae100000001","method":"","user_agent":"","ja3":"","session":"2727a7c0-f6b0-4bf1-9598-8ab829864e9b","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T23:47:06.761125+00:00"}