{"ip":"153.68.213.202","total_events":599,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"187+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 187 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,140 bytes sent","bytes_sent":16140,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T19:47:30","last_seen":"2026-09-10T10:31:39","events_24h":23,"events_7d":216,"geo":{"country_code":"CA","country_name":"Canada","region":"Quebec","city":"Montreal","lat":45.6085,"lon":-73.5493,"asn":852,"org":"TELUS Communications Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as852","label":"TELUS Communications","category":"isp","url":"https://www.peeringdb.com/asn/852"},"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":21},{"port":25566,"proto":"tcp","label":"","count":21},{"port":25573,"proto":"tcp","label":"","count":21},{"port":25571,"proto":"tcp","label":"","count":19},{"port":25567,"proto":"tcp","label":"","count":18},{"port":25572,"proto":"tcp","label":"","count":16},{"port":25570,"proto":"tcp","label":"","count":15},{"port":25563,"proto":"tcp","label":"","count":15},{"port":25568,"proto":"tcp","label":"","count":15},{"port":25559,"proto":"tcp","label":"","count":15},{"port":25558,"proto":"tcp","label":"","count":14},{"port":25561,"proto":"tcp","label":"","count":14},{"port":25569,"proto":"tcp","label":"","count":14},{"port":25577,"proto":"tcp","label":"","count":13},{"port":25560,"proto":"tcp","label":"","count":13}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":6},{"date":"2026-08-18","count":2},{"date":"2026-08-19","count":1},{"date":"2026-08-21","count":17},{"date":"2026-08-22","count":51},{"date":"2026-08-23","count":41},{"date":"2026-08-24","count":59},{"date":"2026-08-25","count":6},{"date":"2026-08-27","count":27},{"date":"2026-08-28","count":4},{"date":"2026-08-29","count":26},{"date":"2026-08-30","count":31},{"date":"2026-08-31","count":16},{"date":"2026-09-01","count":34},{"date":"2026-09-02","count":41},{"date":"2026-09-03","count":22},{"date":"2026-09-04","count":24},{"date":"2026-09-05","count":41},{"date":"2026-09-06","count":44},{"date":"2026-09-07","count":22},{"date":"2026-09-08","count":34},{"date":"2026-09-09","count":27},{"date":"2026-09-10","count":23}],"recent_events":[{"timestamp":"2026-09-10T10:31:39","port":25599,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63ff010100","method":"","user_agent":"","ja3":"","session":"37b3fbdd-4a3e-4ff4-97ee-2862dcce4d5c","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T10:31:36","port":25603,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>d\u0003\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>6403010100","method":"","user_agent":"","ja3":"","session":"23105132-3d52-4efe-89e3-ea522d567e8e","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"1a50a7a75e22cfd3","strings":["<HONEYPOT>d"]}},{"timestamp":"2026-09-10T10:31:34","port":25590,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63f6010100","method":"","user_agent":"","ja3":"","session":"45fc72c8-92c0-4a2f-b542-51fb57c715ba","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T10:31:31","port":25587,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63f3010100","method":"","user_agent":"","ja3":"","session":"e2e286b2-7584-43a6-9856-3d615734311c","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T08:57:28","port":25566,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63de010100","method":"","user_agent":"","ja3":"","session":"ae620cad-facc-485d-913f-719a48974538","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T08:41:55","port":25578,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63ea010100","method":"","user_agent":"","ja3":"","session":"5f211f2c-c57a-46c7-8c39-b900b90b518c","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T08:41:29","port":61130,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>eeca010100","method":"","user_agent":"","ja3":"","session":"21ce60cf-0f54-44eb-8f9f-80ced141e844","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-10T08:41:22","port":25579,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63eb010100","method":"","user_agent":"","ja3":"","session":"04e8c79f-c16a-404e-aee4-0ed329166d0e","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T08:41:18","port":25584,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63f0010100","method":"","user_agent":"","ja3":"","session":"8c0a72bb-0334-4dbf-8d8b-77431677b75f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T07:48:03","port":25561,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d9010100","method":"","user_agent":"","ja3":"","session":"419ad857-6979-4ad9-976f-0c20b383ddeb","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":187,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T23:04:10.000011+00:00"}