{"ip":"172.105.56.8","total_events":1518,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"88,471 bytes sent","bytes_sent":88471,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T05:12:12","last_seen":"2026-09-13T12:27:49","events_24h":69,"events_7d":1284,"geo":{"country_code":"IN","country_name":"India","region":"Maharashtra","city":"Mumbai","lat":19.0748,"lon":72.8856,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172.105.56.8.socradar-curiosity-wide-scan-project.socradar.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63949","label":"Linode AS63949","category":"cdn","url":"https://www.peeringdb.com/asn/63949"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":110},{"port":548,"proto":"tcp","label":"","count":67},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":63},{"port":1098,"proto":"tcp","label":"","count":63},{"port":427,"proto":"tcp","label":"","count":61},{"port":554,"proto":"tcp","label":"","count":61},{"port":6005,"proto":"tcp","label":"","count":61},{"port":49153,"proto":"tcp","label":"","count":60},{"port":445,"proto":"tcp","label":"SMB","count":60},{"port":111,"proto":"tcp","label":"RPC","count":59},{"port":3389,"proto":"tcp","label":"RDP","count":58},{"port":53,"proto":"tcp","label":"DNS","count":57},{"port":2049,"proto":"tcp","label":"NFS","count":57},{"port":389,"proto":"tcp","label":"LDAP","count":57},{"port":27017,"proto":"tcp","label":"MongoDB","count":55}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0200_5594a17e7e7e","ge11nn0000_000000000000"]},"fingerprint_peers":{"ge10nn0200_5594a17e7e7e":1970,"ge11nn0000_000000000000":80},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-05","count":103},{"date":"2026-09-06","count":131},{"date":"2026-09-07","count":170},{"date":"2026-09-08","count":183},{"date":"2026-09-09","count":105},{"date":"2026-09-10","count":297},{"date":"2026-09-11","count":318},{"date":"2026-09-12","count":142},{"date":"2026-09-13","count":69}],"recent_events":[{"timestamp":"2026-09-13T12:27:49","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"7e07fc11-28c4-43db-87c4-5b094df03afe","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":12,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-13T12:27:49","port":548,"proto":"tcp","app_proto":"","app_protocol":"afp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000","payload_hex":"000300010000000000000002000000000f00","method":"","user_agent":"","ja3":"","session":"d41044ca-ce21-4e6b-8f5e-3e1441d48dac","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":12},{"timestamp":"2026-09-13T12:27:48","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"32e5f1ad-6436-4fa2-ab60-f83319e83e36","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":12},{"timestamp":"2026-09-13T12:27:46","port":1099,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"","session":"c52d529b-9fff-4daf-9076-17e661edd5fd","seq":1,"duration_ms":101,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-13T12:27:45","port":1098,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"","session":"386827aa-b25c-4e28-83b0-7760d190fc4a","seq":1,"duration_ms":101,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-13T12:27:41","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: ;tag=root\r\nTo: \r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: \r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"a86fa214-dcc0-436f-bd2e-a9a24b6ab8de","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":77,"enriched":{"digest":"45f1bd546a73d03c","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/TCP nm;branch=foo","From: ;tag=root","To: ","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: ","Accept: application/sdp"],"iocs":{"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-13T12:27:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"a828bb28-f57b-4f28-bb45-c047a67d1d86","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":77},{"timestamp":"2026-09-13T12:27:38","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\ninfo\r\n","payload_hex":"2a310d0a24340d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"0732553d-f0bf-4278-99e2-8b6832360d55","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"4e3644f68e18a478","label":"Redis (RESP)","strings":["info"]}},{"timestamp":"2026-09-13T12:27:37","port":6005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"6c000b000000000000000000","method":"","user_agent":"","ja3":"","session":"59ac316d-960f-44aa-957f-d62916d428ad","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":12},{"timestamp":"2026-09-13T12:27:36","port":49153,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"A\u0000\u0000\u0000:0\u0000\u0000�����\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000����\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000�?\u0000","payload_hex":"410000003a300000ffffffffd407000000000000746573742e24636d640000000000ffffffff1b0000000173657276657253746174757300000000000000f03f00","method":"","user_agent":"","ja3":"","session":"fb0cbff3-6c36-44a1-9e75-3676b0d21ed5","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":12,"enriched":{"digest":"adf77f2ce3d05f81","strings":["test.$cmd","serverStatus"]}}],"http_methods":[{"method":"GET","count":161}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":110,"ports":2},{"path":"/version","count":51,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-13T23:13:08.073876+00:00"}