{"ip":"190.108.42.138","total_events":62,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,821 bytes sent","bytes_sent":2821,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T20:37:58","last_seen":"2026-10-05T20:40:12","events_24h":62,"events_7d":62,"geo":{"country_code":"AR","country_name":"Argentina","region":"La Pampa","city":"Trenel","lat":-35.7012,"lon":-64.1395,"asn":52308,"org":"AGUAS DEL COLORADO SAPEM"},"source_domain":"host-42-138.adc.net.ar","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":9,"protocols":[{"protocol":"dns","events":9}],"ports":[{"port":137,"events":9}],"dns_questions":[{"name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","events":9}],"quic_clients":[],"first_seen":"2026-10-05T20:38:05","last_seen":"2026-10-05T20:39:40","recent":[{"timestamp":"2026-10-05T20:39:40","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ebd00010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"77b26168-271f-48c3-8d59-522367271d0c","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:39:38","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ebd00010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"44ebd05f-dee0-4a46-9cef-f8d5bb2e0089","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:39:37","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ebd00000000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"46c85fb0-852b-4cb8-a3fe-2e5fd6bf5d19","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:14","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea640010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"96a561af-e456-4abe-8b90-6e14db39554e","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:13","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea640010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"995456c1-2bbb-4ff9-92a5-d02f4201e0a7","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:11","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea640000000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"d71cbc51-9779-4fb9-8163-ef230020ed2f","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:08","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea560010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"1b9434cb-b20d-4651-b1e2-c2bdd3a3132f","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:07","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea560010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"76c49f86-8e93-4681-b67d-cb3e1ae97514","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}},{"timestamp":"2026-10-05T20:38:05","port":137,"src_port":137,"proto":"udp","app_proto":"dns","app_protocol":"netbios","summary":"DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","payload_hex":"ea560000000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"e1f6609b-cc4f-44ea-aeba-f49e2b2be895","bytes_in":50,"source_verified":false,"dns":{"kind":"query","name":"CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","type":"SRV","class":"IN"}}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":16},{"port":445,"proto":"tcp","label":"SMB","count":8},{"port":443,"proto":"tcp","label":"HTTPS","count":8},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":8},{"port":549,"proto":"tcp","label":"","count":7},{"port":4899,"proto":"tcp","label":"","count":7},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":135,"proto":"tcp","label":"MSRPC","count":2},{"port":88,"proto":"tcp","label":"","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i750600_7f299a1aa72b_4446390ac224"],"tls_client_hello":"1603010200010001fc03030b7c890135288e8026108f2bb7fd9c72782288cee028fb9c47cd2234fce39e47000096c030c02cc028c024c014c00ac022c02100a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084008dc012c008c01cc01b00160013c00dc003000a008bc02fc02bc027c023c013c009c01fc01e00a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f00960041008cc011c007c00cc00200050004008a00ff0100013d000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f0010001100230000000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101001500cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c547b50b6845f397789bb4d89f8c0692"],"http_akin":["b11cun050_0004001b_4391a906","b11cun010_00040000_c4b2c4aa","b10cun000_00000000_334359b9"]},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":668,"b10cun000_00000000_334359b9":2188,"t12i750600_7f299a1aa72b_4446390ac224":2,"b11cun050_0004001b_4391a906":1},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-05","count":62}],"recent_events":[{"timestamp":"2026-10-05T20:40:12","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001853c8000000000000000000000000fffffffe00000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"7863a199-64a2-4e1d-bf36-53e4ebbdf416","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"c15f7fb4bd30e6f7","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-10-05T20:40:12","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001853c8000000000000000000000000fffffffe00000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"c4b906e5-8b23-48c0-bbf2-c97a5742c8c5","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"c15f7fb4bd30e6f7","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-10-05T20:39:41","port":135,"proto":"tcp","app_proto":"","app_protocol":"dce_rpc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000t\u0000\u0000\u0000\u0002\u0000\u0000\u0000�\u0016�\u0016\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0001\u0000����`R\u001b\u0010��\u0000�\u0000!4z\u0000\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0001\u0000\u0001\u0000����`R\u001b\u0010��\u0000�\u0000!4z\u0000\u0000\u0000\u0000,\u001c�l\u0012�@E\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000","payload_hex":"05000b03100000007400000002000000d016d016000000000200000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b1048600200000001000100c4fefc9960521b10bbcb00aa0021347a000000002c1cb76c12984045030000000000000001000000","method":"","user_agent":"","ja3":"","session":"adda0fb6-c5b6-4ee6-bf34-5e356e975ebe","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":14,"enriched":{"digest":"1d6affc13b36a2c2","label":"SOCKS5","strings":["!4z,"]}},{"timestamp":"2026-10-05T20:39:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b9903d20-2d61-4540-8c93-f8d0f4caac50","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":79},{"timestamp":"2026-10-05T20:39:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"37ab3a33-eb49-4cde-b5f7-278c4b900bec","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":79},{"timestamp":"2026-10-05T20:39:36","port":88,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000qj�n0�k�\u0003\u0002\u0001\u0005�\u0003\u0002\u0001\n��^0\\�\u0007\u0003\u0005\u0000P�\u0000\u0010�\u0004\u001b\u0002NM�\u00170\u0015�\u0003\u0002\u0001\u0000�\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM�\u0011\u0018\u000f19700101000000Z�\u0006\u0002\u0004\u001f\u001e�٨\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002","payload_hex":"000000716a816e30816ba103020105a20302010aa4815e305ca00703050050800010a2041b024e4da3173015a003020100a10e300c1b066b72627467741b024e4da511180f31393730303130313030303030305aa70602041f1eb9d9a8173015020112020111020110020117020101020103020102","method":"","user_agent":"","ja3":"","session":"e773e168-abc6-4703-8aa3-56d91af59330","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":14,"enriched":{"digest":"ea97999080776fef","strings":["krbtgt","19700101000000Z"]}},{"timestamp":"2026-10-05T20:39:35","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0000C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000000043c00000000000000000000000000000000000000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"a90860ff-9dbb-4e73-9bbb-8fc0377f8939","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"0e0133ef3c7f54ba","strings":["SMBr","NT LM 0.12","SMBrC"]}},{"timestamp":"2026-10-05T20:39:35","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001853c8000000000000000000000000fffffffe00000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"bb6698a5-b4e3-4a36-942a-dab6a742ee0e","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"c15f7fb4bd30e6f7","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-10-05T20:39:34","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c��random1random2random3random4\u0000\u0000\f\u0000/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000�\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002","payload_hex":"1603000069010000650303551ca7e472616e646f6d3172616e646f6d3272616e646f6d3372616e646f6d3400000c002f000a00130039000400ff01000030000d002c002a000100030002060106030602020102030202030103030302040104030402010101030102050105030502","method":"","user_agent":"","ja3":"c547b50b6845f397789bb4d89f8c0692","session":"0eeebd0f-15ed-44ac-8f6c-728ec3d3584f","seq":1,"duration_ms":310,"bytes_in":110,"bytes_out":14,"enriched":{"digest":"53bb04b2d6c97881","label":"TLS/SSL","strings":["random1random2random3random4"]}},{"timestamp":"2026-10-05T20:39:33","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G���,���`~�\u0000��{�Ֆ�w����<=�o�\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000","payload_hex":"16030000530100004f03003f47d7f7ba2ceeeab2607ef300fd827bb9d596c8779be6c4db3c3ddb6fef106e00002800160013000a006600050004006500640063006200610060001500120009001400110008000600030100","method":"","user_agent":"","ja3":"c547b50b6845f397789bb4d89f8c0692","session":"dba908d1-1a70-43d9-a607-cebe0493fce2","seq":1,"duration_ms":310,"bytes_in":88,"bytes_out":14,"enriched":{"digest":"28bd7217cbe4629c","label":"TLS/SSL","strings":["edcba`"]}}],"http_methods":[{"method":"GET","count":17},{"method":"OPTIONS","count":2}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":17,"ports":6},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-10-05T23:56:13.585393+00:00"}