{"ip":"172.105.93.118","total_events":1390,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"891+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 891 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,847 bytes sent","bytes_sent":11847,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-10T11:33:42","last_seen":"2026-08-10T11:34:01","events_24h":0,"events_7d":1390,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172-105-93-118.ip.linodeusercontent.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":55055,"proto":"tcp","label":"","count":5},{"port":9,"proto":"tcp","label":"","count":4},{"port":2135,"proto":"tcp","label":"","count":4},{"port":1107,"proto":"tcp","label":"","count":4},{"port":700,"proto":"tcp","label":"","count":4},{"port":5903,"proto":"tcp","label":"","count":4},{"port":10616,"proto":"tcp","label":"","count":4},{"port":32781,"proto":"tcp","label":"","count":4},{"port":1086,"proto":"tcp","label":"","count":4},{"port":2065,"proto":"tcp","label":"","count":4},{"port":3370,"proto":"tcp","label":"","count":4},{"port":1052,"proto":"tcp","label":"","count":4},{"port":1556,"proto":"tcp","label":"","count":4},{"port":2099,"proto":"tcp","label":"","count":4},{"port":6059,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_ed383ed8462e"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":1504,"po11nn0600_ed383ed8462e":331,"ge11nn0400_88d30a62b7ad":4815,"084386fa7ae5039bcf6f07298a05a227":647},"user_agents":["Mozilla/5.0 zgrab/0.x","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15"],"timeline":[{"date":"2026-08-10","count":1390}],"recent_events":[{"timestamp":"2026-08-10T11:34:01","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000001843c8000000000000000000000000fffffffe00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"aa0843f3-f300-4b79-bed3-f20a847f2588","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"a119cd236d404812","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-08-10T11:34:01","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000020000001a00060100200001020021000103002200040400260001ff00000000000001000000000000","method":"","user_agent":"","ja3":"","session":"547aeffc-c479-4bfb-bb87-d3cee84bc3c8","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":3322,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"2986636f-0e6f-4c93-9620-a780c1391c8c","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":714,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"6da5bda3-c5ef-4537-b11b-daf58cb63c84","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":1031,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e2931fe2-ba34-47e5-82d5-5b8633937845","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":2605,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"60e13074-9259-4cef-a777-2bb4aa2413da","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":3005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"201dcdc8-93de-4f6c-9a29-b9e2ca22812a","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":49159,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"982f392c-a365-4e7d-a7e3-fa338536b902","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":56738,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"a48cea38-98ad-4e71-9ef0-ebc065a34423","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-08-10T11:34:01","port":497,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9cd008de-a794-4cb1-98fc-b95c2f91095f","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":14}],"http_methods":[{"method":"GET","count":27},{"method":"POST","count":2}],"distinct_ports_total":891,"top_paths":[{"path":"/","count":27,"ports":18},{"path":"/ipp","count":2,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:55:36.908329+00:00"}