{"ip":"172.232.160.26","total_events":2304,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"145,602 bytes sent","bytes_sent":145602,"session_seconds":4,"persistent":false}},"first_seen":"2026-07-20T18:51:19","last_seen":"2026-09-17T10:31:59","events_24h":195,"events_7d":1361,"geo":{"country_code":"US","country_name":"United States","region":"Washington","city":"Tukwila","lat":47.4775,"lon":-122.2589,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172.232.160.26.socradar-curiosity-wide-scan-project.socradar.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63949","label":"Linode AS63949","category":"cdn","url":"https://www.peeringdb.com/asn/63949"},"cve_matches":[],"malware":[],"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":102},{"port":49153,"proto":"tcp","label":"","count":98},{"port":11211,"proto":"tcp","label":"Memcached","count":94},{"port":445,"proto":"tcp","label":"SMB","count":93},{"port":1433,"proto":"tcp","label":"MSSQL","count":93},{"port":554,"proto":"tcp","label":"","count":93},{"port":3389,"proto":"tcp","label":"RDP","count":92},{"port":2375,"proto":"tcp","label":"Docker","count":92},{"port":427,"proto":"tcp","label":"","count":92},{"port":1098,"proto":"tcp","label":"","count":90},{"port":23,"proto":"tcp","label":"Telnet","count":90},{"port":80,"proto":"tcp","label":"HTTP","count":90},{"port":53,"proto":"tcp","label":"DNS","count":90},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":88},{"port":548,"proto":"tcp","label":"","count":88}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0200_5594a17e7e7e","ge11nn0000_000000000000"]},"fingerprint_peers":{"ge10nn0200_5594a17e7e7e":1965,"ge11nn0000_000000000000":77},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.4.16 Chrome/114.0.5735.289 Electron/25.8.1 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15"],"timeline":[{"date":"2026-07-20","count":12},{"date":"2026-09-05","count":162},{"date":"2026-09-06","count":261},{"date":"2026-09-07","count":129},{"date":"2026-09-08","count":235},{"date":"2026-09-09","count":65},{"date":"2026-09-10","count":238},{"date":"2026-09-11","count":273},{"date":"2026-09-12","count":184},{"date":"2026-09-14","count":71},{"date":"2026-09-15","count":282},{"date":"2026-09-16","count":233},{"date":"2026-09-17","count":159}],"recent_events":[{"timestamp":"2026-09-17T10:31:59","port":1098,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"","session":"9faa121b-c1a1-4a24-9726-08a08f9dee09","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-17T10:31:54","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0001��\u0003","payload_hex":"fff6fffe01fffe03","method":"","user_agent":"","ja3":"","session":"ac14d844-1ab5-4da7-9dc4-4a5d4eb7d7ad","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":7},{"timestamp":"2026-09-17T10:31:53","port":3268,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"4d8a0f1d-69b8-4eca-b651-543a67e6ee5b","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-09-17T10:31:52","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"86eebe23-d6b6-4d1f-b23e-fb3d2f1b2045","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-09-17T10:31:52","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"62d521b3-52e9-4984-be83-58e1478af5c8","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":14},{"timestamp":"2026-09-17T10:31:51","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"d7071a15-15f5-4e75-bf9c-c1da04529c33","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":79},{"timestamp":"2026-09-17T10:31:50","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"da2a454e-8a22-4bf8-94b8-90cf72a847d2","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":79,"enriched":{"digest":"45f1bd546a73d03c","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/TCP nm;branch=foo","From: <sip:nm@nm>;tag=root","To: <sip:nm2@nm2>","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: <sip:nm@nm>","Accept: application/sdp"],"iocs":{"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-17T10:31:49","port":49153,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"A\u0000\u0000\u0000:0\u0000\u0000�����\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000����\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000�?\u0000","payload_hex":"410000003a300000ffffffffd407000000000000746573742e24636d640000000000ffffffff1b0000000173657276657253746174757300000000000000f03f00","method":"","user_agent":"","ja3":"","session":"4d27231e-278c-4c9a-8848-73381ebcfcb2","seq":1,"duration_ms":101,"bytes_in":65,"bytes_out":14,"enriched":{"digest":"adf77f2ce3d05f81","strings":["test.$cmd","serverStatus"]}},{"timestamp":"2026-09-17T10:31:49","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\b\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0001\u0000��\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000000801c8000000000000000000000000ffff0100ffff0000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"1a4d3f01-8714-4845-8144-8dd9e3e54866","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"a06f7a94030db16d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-17T10:31:49","port":548,"proto":"tcp","app_proto":"","app_protocol":"afp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000","payload_hex":"000300010000000000000002000000000f00","method":"","user_agent":"","ja3":"","session":"d16f95d6-8329-487b-aed1-0d1c9d723e6b","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":14}],"http_methods":[{"method":"GET","count":270}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":178,"ports":2},{"path":"/version","count":92,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-17T11:23:04.014822+00:00"}