{"ip":"153.68.200.248","total_events":211,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"76+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 76 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,659 bytes sent","bytes_sent":5659,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T20:41:25","last_seen":"2026-09-29T11:18:01","events_24h":12,"events_7d":148,"geo":{"country_code":"CA","country_name":"Canada","region":"Quebec","city":"Montreal","lat":45.5059,"lon":-73.631,"asn":852,"org":"TELUS Communications Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as852","label":"TELUS Communications","category":"isp","url":"https://www.peeringdb.com/asn/852"},"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":11},{"port":25571,"proto":"tcp","label":"","count":11},{"port":25567,"proto":"tcp","label":"","count":9},{"port":25566,"proto":"tcp","label":"","count":8},{"port":25569,"proto":"tcp","label":"","count":8},{"port":25576,"proto":"tcp","label":"","count":7},{"port":25562,"proto":"tcp","label":"","count":7},{"port":25573,"proto":"tcp","label":"","count":6},{"port":25559,"proto":"tcp","label":"","count":6},{"port":25578,"proto":"tcp","label":"","count":6},{"port":25568,"proto":"tcp","label":"","count":6},{"port":25570,"proto":"tcp","label":"","count":6},{"port":25581,"proto":"tcp","label":"","count":5},{"port":25564,"proto":"tcp","label":"","count":5},{"port":25560,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-15","count":7},{"date":"2026-09-16","count":19},{"date":"2026-09-17","count":5},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":2},{"date":"2026-09-21","count":13},{"date":"2026-09-22","count":18},{"date":"2026-09-23","count":10},{"date":"2026-09-24","count":16},{"date":"2026-09-25","count":38},{"date":"2026-09-26","count":39},{"date":"2026-09-27","count":21},{"date":"2026-09-28","count":14},{"date":"2026-09-29","count":7}],"recent_events":[{"timestamp":"2026-09-29T11:18:01","port":25571,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e3010100","method":"","user_agent":"","ja3":"","session":"479c7f0f-0164-47b2-9f2b-3bae50eaf6cc","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T11:17:59","port":25567,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63df010100","method":"","user_agent":"","ja3":"","session":"99bf9c69-30d0-4715-a24c-cb64bbf95160","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T08:13:47","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"cbbc4bb8-170c-4441-9657-6a55a3a72791","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:51","port":25557,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d5010100","method":"","user_agent":"","ja3":"","session":"b15c2176-2d5d-4ba4-9083-5d4faca5584d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:42","port":25558,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d6010100","method":"","user_agent":"","ja3":"","session":"68509044-8eb0-49d8-aced-f2b5723a5c14","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:11","port":25576,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e8010100","method":"","user_agent":"","ja3":"","session":"56244620-ee6b-4807-975a-cecaf2095a35","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:06:53","port":25572,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e4010100","method":"","user_agent":"","ja3":"","session":"9741e834-3dbf-4b15-acd4-e6135b2fd13f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-28T22:33:38","port":25564,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63dc010100","method":"","user_agent":"","ja3":"","session":"f9f47eef-f681-496a-beb9-cf0953bb88ea","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-28T22:33:38","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"3ee58a68-8c4f-44bb-a690-a75db4514263","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-28T22:33:26","port":25572,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e4010100","method":"","user_agent":"","ja3":"","session":"1f9f2cd2-cf1a-44ca-9531-682348963912","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":76,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T21:27:26.361658+00:00"}