{"ip":"172.233.117.214","total_events":2025,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"124,511 bytes sent","bytes_sent":124511,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T00:34:06","last_seen":"2026-09-13T17:06:23","events_24h":23,"events_7d":1722,"geo":{"country_code":"ES","country_name":"Spain","region":"Madrid","city":"Madrid","lat":40.4153,"lon":-3.694,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172.233.117.214.socradar-curiosity-wide-scan-project.socradar.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63949","label":"Linode AS63949","category":"cdn","url":"https://www.peeringdb.com/asn/63949"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":140},{"port":8081,"proto":"tcp","label":"","count":84},{"port":1433,"proto":"tcp","label":"MSSQL","count":83},{"port":80,"proto":"tcp","label":"HTTP","count":80},{"port":1098,"proto":"tcp","label":"","count":80},{"port":3389,"proto":"tcp","label":"RDP","count":79},{"port":6379,"proto":"tcp","label":"Redis","count":79},{"port":53,"proto":"tcp","label":"DNS","count":79},{"port":5060,"proto":"tcp","label":"SIP","count":78},{"port":1099,"proto":"tcp","label":"","count":78},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":77},{"port":445,"proto":"tcp","label":"SMB","count":77},{"port":50000,"proto":"tcp","label":"SAP","count":76},{"port":2049,"proto":"tcp","label":"NFS","count":76},{"port":3268,"proto":"tcp","label":"","count":75}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0200_5594a17e7e7e","ge11nn0000_000000000000"]},"fingerprint_peers":{"ge10nn0200_5594a17e7e7e":1970,"ge11nn0000_000000000000":80},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.5.8 Chrome/120.0.6099.283 Electron/28.2.3 Safari/537.36","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15"],"timeline":[{"date":"2026-09-05","count":139},{"date":"2026-09-06","count":164},{"date":"2026-09-07","count":154},{"date":"2026-09-08","count":165},{"date":"2026-09-09","count":263},{"date":"2026-09-10","count":329},{"date":"2026-09-11","count":484},{"date":"2026-09-12","count":304},{"date":"2026-09-13","count":23}],"recent_events":[{"timestamp":"2026-09-13T17:06:23","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"c3e7925a-273f-4270-a094-30e805ed5256","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-09-13T17:06:23","port":11211,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats\r\n","payload_hex":"73746174730d0a","method":"","user_agent":"","ja3":"","session":"f7b2dab2-b961-4f6f-89bc-56b6bcd13b87","seq":1,"duration_ms":101,"bytes_in":7,"bytes_out":15,"enriched":{"digest":"8ba3dc4bf81a4992","label":"Memcached","strings":["stats"]}},{"timestamp":"2026-09-13T17:06:23","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"67e6eb26-6e52-450c-8910-c89cc3204114","seq":1,"duration_ms":101,"bytes_in":223,"bytes_out":80,"enriched":{"digest":"45f1bd546a73d03c","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/TCP nm;branch=foo","From: <sip:nm@nm>;tag=root","To: <sip:nm2@nm2>","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: <sip:nm@nm>","Accept: application/sdp"],"iocs":{"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-13T17:06:21","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e332e31205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15","ja3":"","session":"0a78064b-1409-4df9-8ffa-2bd03ca10f24","seq":1,"duration_ms":101,"bytes_in":164,"bytes_out":80},{"timestamp":"2026-09-13T17:06:18","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\ninfo\r\n","payload_hex":"2a310d0a24340d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"29ad5a8c-ca42-47cc-a1ba-2c8cd024db26","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"4e3644f68e18a478","label":"Redis (RESP)","strings":["info"]}},{"timestamp":"2026-09-13T17:06:17","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=masscan\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6d61737363616e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e67380b0-2eca-4a99-b516-3b422e271688","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":15,"enriched":{"digest":"dae3182f5942a5c0","label":"RDP (X.224)","strings":["Cookie: mstshash=masscan"]}},{"timestamp":"2026-09-13T17:06:15","port":3268,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"dde2b7b1-a50b-4427-b551-f998a9e699da","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-09-13T17:06:11","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"061c7575-305a-40fe-850d-0ac1dd341850","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":15},{"timestamp":"2026-09-13T17:06:11","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"eaec1c31-479e-438a-a2d3-d9de5727d701","seq":1,"duration_ms":101,"bytes_in":22,"bytes_out":80,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-13T17:06:09","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6beb74ea-d8fb-4e8d-be26-b1c34625e611","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15}],"http_methods":[{"method":"GET","count":228}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":157,"ports":2},{"path":"/version","count":71,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-13T23:13:17.913274+00:00"}