{"ip":"162.248.100.206","observed":true,"total_events":136,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"132+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 132 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,624 bytes sent","bytes_sent":4624,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-11T05:50:53","last_seen":"2026-10-12T14:12:10","events_24h":0,"events_7d":4,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":397031,"org":"GALAXYGATE, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as397031","label":"GALAXYGATE","category":"enterprise","url":"https://www.peeringdb.com/asn/397031"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":5991,"proto":"tcp","label":"","count":2},{"port":5966,"proto":"tcp","label":"","count":2},{"port":5918,"proto":"tcp","label":"","count":2},{"port":5911,"proto":"tcp","label":"","count":2},{"port":6653,"proto":"tcp","label":"","count":1},{"port":5958,"proto":"tcp","label":"","count":1},{"port":5945,"proto":"tcp","label":"","count":1},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":1},{"port":5916,"proto":"tcp","label":"","count":1},{"port":5987,"proto":"tcp","label":"","count":1},{"port":6633,"proto":"tcp","label":"","count":1},{"port":5915,"proto":"tcp","label":"","count":1},{"port":5973,"proto":"tcp","label":"","count":1},{"port":5970,"proto":"tcp","label":"","count":1},{"port":5930,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-11","count":132},{"date":"2026-10-12","count":4}],"recent_events":[{"timestamp":"2026-10-12T14:12:10","port":5991,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"2e34c3be-89cd-4208-afd1-c5546e526422","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-12T14:09:25","port":5966,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"c6d271fd-494a-4047-904e-8397ae04e50e","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-12T14:08:10","port":5918,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"a373439a-9c80-4981-a1c7-9c09d5eb229d","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-12T14:05:36","port":5911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"8b8929cb-14a9-4253-9322-d24055161a75","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:35:39","port":5905,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"447c7c80-fc2f-4738-8d40-b8895aa76757","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:35:34","port":6036,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"e1e8eeec-606e-4ad8-ab02-94f545dc3e13","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:35:21","port":6500,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"cfe9e6c6-4212-4384-994e-28e369ab95e5","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:34:34","port":5981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"c107f983-d7ee-40d5-b315-5ec15cc86024","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:32:58","port":5962,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"e1058675-7a8a-4f4b-8e43-c4302680dbff","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-11T07:32:06","port":5976,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"7e70e515-139e-4e63-ac32-aae9f14f5df9","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":15,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":132,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T07:32:19.984798+00:00"}