{"ip":"172.233.62.80","total_events":2496,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"146,070 bytes sent","bytes_sent":146070,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T02:13:58","last_seen":"2026-09-12T21:18:24","events_24h":0,"events_7d":1977,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172.233.62.80.socradar-curiosity-wide-scan-project.socradar.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63949","label":"Linode AS63949","category":"cdn","url":"https://www.peeringdb.com/asn/63949"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":203},{"port":3389,"proto":"tcp","label":"RDP","count":98},{"port":53,"proto":"tcp","label":"DNS","count":98},{"port":548,"proto":"tcp","label":"","count":97},{"port":6379,"proto":"tcp","label":"Redis","count":96},{"port":554,"proto":"tcp","label":"","count":96},{"port":50000,"proto":"tcp","label":"SAP","count":95},{"port":6005,"proto":"tcp","label":"","count":95},{"port":1433,"proto":"tcp","label":"MSSQL","count":94},{"port":5060,"proto":"tcp","label":"SIP","count":94},{"port":1098,"proto":"tcp","label":"","count":93},{"port":8081,"proto":"tcp","label":"","count":92},{"port":3268,"proto":"tcp","label":"","count":92},{"port":1099,"proto":"tcp","label":"","count":91},{"port":111,"proto":"tcp","label":"RPC","count":91}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0000_000000000000","ge10nn0200_5594a17e7e7e"]},"fingerprint_peers":{"ge11nn0000_000000000000":80,"ge10nn0200_5594a17e7e7e":1970},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.4.13 Chrome/114.0.5735.289 Electron/25.8.1 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"],"timeline":[{"date":"2026-09-05","count":234},{"date":"2026-09-06","count":285},{"date":"2026-09-07","count":330},{"date":"2026-09-08","count":287},{"date":"2026-09-09","count":227},{"date":"2026-09-10","count":424},{"date":"2026-09-11","count":466},{"date":"2026-09-12","count":243}],"recent_events":[{"timestamp":"2026-09-12T21:18:24","port":88,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000qj�n0�k�\u0003\u0002\u0001\u0005�\u0003\u0002\u0001\n��^0\\�\u0007\u0003\u0005\u0000P�\u0000\u0010�\u0004\u001b\u0002NM�\u00170\u0015�\u0003\u0002\u0001\u0000�\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM�\u0011\u0018\u000f19700101000000Z�\u0006\u0002\u0004\u001f\u001e�٨\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002","payload_hex":"000000716a816e30816ba103020105a20302010aa4815e305ca00703050050800010a2041b024e4da3173015a003020100a10e300c1b066b72627467741b024e4da511180f31393730303130313030303030305aa70602041f1eb9d9a8173015020112020111020110020117020101020103020102","method":"","user_agent":"","ja3":"","session":"b38f02d2-f52c-46e6-b4f9-0c42af4c880a","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":13,"enriched":{"digest":"ea97999080776fef","strings":["krbtgt","19700101000000Z"]}},{"timestamp":"2026-09-12T21:18:23","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\ninfo\r\n","payload_hex":"2a310d0a24340d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"87a84741-2300-4dc9-9682-4d26656f740e","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"4e3644f68e18a478","label":"Redis (RESP)","strings":["info"]}},{"timestamp":"2026-09-12T21:18:21","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"089ddb91-07d6-4313-b573-f6227ed1a335","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-12T21:18:20","port":548,"proto":"tcp","app_proto":"","app_protocol":"afp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000","payload_hex":"000300010000000000000002000000000f00","method":"","user_agent":"","ja3":"","session":"62b56135-f140-4a28-a6f5-7ee723f8a1bf","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":13},{"timestamp":"2026-09-12T21:18:20","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=masscan\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6d61737363616e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"60ebdaf1-4dbb-48bb-bf70-2d5bb8e926a2","seq":1,"duration_ms":101,"bytes_in":45,"bytes_out":13,"enriched":{"digest":"dae3182f5942a5c0","label":"RDP (X.224)","strings":["Cookie: mstshash=masscan"]}},{"timestamp":"2026-09-12T21:18:19","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\b\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0001\u0000��\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000000801c8000000000000000000000000ffff0100ffff0000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"70f22bd7-eb42-4f98-82ed-94c8f4954452","seq":1,"duration_ms":105,"bytes_in":73,"bytes_out":13,"enriched":{"digest":"a06f7a94030db16d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-12T21:18:17","port":50000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"9e7c19ee-521d-4cde-bf29-118223b624cc","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-12T21:18:15","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"384ec3f6-03f2-4cbe-a68e-8726418bf152","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":78},{"timestamp":"2026-09-12T21:18:12","port":3268,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"afd40eb1-3b64-4da0-86a8-618b4f7df2fe","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-09-12T21:18:11","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"1d5cb3c3-a13e-488f-9a0a-edac04daf3b3","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":78,"enriched":{"digest":"45f1bd546a73d03c","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/TCP nm;branch=foo","From: <sip:nm@nm>;tag=root","To: <sip:nm2@nm2>","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: <sip:nm@nm>","Accept: application/sdp"],"iocs":{"paths":["/2.0/TCP"]}}}],"http_methods":[{"method":"GET","count":263}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":173,"ports":2},{"path":"/version","count":90,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-13T23:13:01.674002+00:00"}