{"ip":"183.249.208.27","total_events":10,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"200 bytes sent","bytes_sent":200,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-21T11:09:16","last_seen":"2026-09-21T11:09:17","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":56041,"org":"China Mobile communications corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":4118,"proto":"tcp","label":"","count":1},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":1},{"port":2323,"proto":"tcp","label":"","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":50000,"proto":"tcp","label":"SAP","count":1},{"port":23,"proto":"tcp","label":"Telnet","count":1},{"port":7777,"proto":"tcp","label":"Oracle","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":2223,"proto":"tcp","label":"","count":1},{"port":9090,"proto":"tcp","label":"Prometheus","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11lun000_00000000_334359b9"]},"fingerprint_peers":{"b11lun000_00000000_334359b9":72},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-21","count":10}],"recent_events":[{"timestamp":"2026-09-21T11:09:17","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"8b04dbbb-f239-456d-8080-25fc1e69a48b","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:17","port":7777,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"05b1be89-33c0-4c00-b44e-94152eb260c8","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:17","port":9999,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"8e21f904-4d07-48ec-884d-4e48eca7cd86","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:17","port":2323,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"44d1bc4d-db8a-42d8-8cce-b7c1e036f289","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":12},{"timestamp":"2026-09-21T11:09:17","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"3e7564a3-e104-4ebb-82af-d7d28e58b938","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:17","port":50000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"7c768fc1-ffda-4b86-8be4-6d518116bbc0","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:16","port":2223,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"26fb092c-1802-4f2a-a4ab-f11d1ae3bdbb","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:16","port":9090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"16127bdc-3b00-4062-8a91-63630f76f4ce","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-09-21T11:09:16","port":23,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"043ac4ca-fd47-45af-8569-ee975e792842","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":12},{"timestamp":"2026-09-21T11:09:16","port":4118,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"e10e606a-cf4d-4dd1-b37f-b28b22695957","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":79}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":10,"ports":10}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T13:08:34.435537+00:00"}