{"ip":"137.131.232.50","total_events":87,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,392 bytes sent","bytes_sent":1392,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T17:31:00","last_seen":"2026-08-20T17:48:51","events_24h":12,"events_7d":87,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"São Paulo","lat":-23.5475,"lon":-46.6361,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":65},{"port":25568,"proto":"tcp","label":"","count":5},{"port":25567,"proto":"tcp","label":"","count":5},{"port":25566,"proto":"tcp","label":"","count":4},{"port":25569,"proto":"tcp","label":"","count":2},{"port":25560,"proto":"tcp","label":"","count":2},{"port":25561,"proto":"tcp","label":"","count":1},{"port":25564,"proto":"tcp","label":"","count":1},{"port":25570,"proto":"tcp","label":"","count":1},{"port":25562,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":11},{"date":"2026-08-16","count":13},{"date":"2026-08-17","count":17},{"date":"2026-08-18","count":17},{"date":"2026-08-19","count":17},{"date":"2026-08-20","count":12}],"recent_events":[{"timestamp":"2026-08-20T17:48:51","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"fb3068ce-bfa9-43b1-b312-ec32792348e7","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T16:35:52","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"12684041-1f6a-48e4-b313-c230acd99b1c","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T15:23:41","port":25570,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"7a5f4d07-077d-4ff6-9fb6-9cb305f0e551","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T13:12:46","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"d45e7605-a672-4ef1-94b8-6b17cb6f4888","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T13:00:15","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"00b70db7-aef7-47f9-99f9-1b4f8bfd5069","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T10:15:14","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"ea4f2253-2ba0-4797-b300-5c8768f20053","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T09:30:01","port":25566,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"cb5ba667-0fe8-4331-af72-0591d6e8d2b0","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T07:35:31","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"ffaa309b-e3aa-4fe3-91a6-d63a725c3500","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T07:19:02","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"ba50f748-3a98-43e6-b1dc-1d7709887603","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}},{"timestamp":"2026-08-20T06:19:38","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscanc�\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e63dd010100","method":"","user_agent":"","ja3":"","session":"b650bbfc-67d6-4e48-b2cc-aef332a9ce8a","seq":1,"duration_ms":101,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"16d0fe72cbc2e7f9","strings":["matscanc"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:21:36.876544+00:00"}