{"ip":"192.51.188.11","total_events":166,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"43+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 43 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,397 bytes sent","bytes_sent":4397,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-03T04:29:05","last_seen":"2026-09-30T22:19:54","events_24h":0,"events_7d":133,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":205960,"org":"Hdtidc Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":513,"proto":"tcp","label":"","count":8},{"port":427,"proto":"tcp","label":"","count":8},{"port":514,"proto":"tcp","label":"Syslog","count":6},{"port":2001,"proto":"tcp","label":"","count":6},{"port":1755,"proto":"tcp","label":"","count":6},{"port":1030,"proto":"tcp","label":"","count":4},{"port":199,"proto":"tcp","label":"","count":4},{"port":7,"proto":"tcp","label":"","count":4},{"port":2049,"proto":"tcp","label":"NFS","count":4},{"port":389,"proto":"tcp","label":"LDAP","count":4},{"port":1720,"proto":"tcp","label":"","count":4},{"port":1029,"proto":"tcp","label":"","count":4},{"port":4899,"proto":"tcp","label":"","count":4},{"port":5060,"proto":"tcp","label":"SIP","count":4},{"port":1900,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i781000_ab95583b6d39_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303e9888c7045b53ed802c864c194f54d082042a12f263ab94da00e9fc2100280d720f128c823ee26b18b5b30097a6bb4614d823480317e76ba12b5f1106cdb651d09009c130213031301003300390035002fc02cc03000a3009fcca9cca8ccaac0afc0adc0a3c09fc05dc061c057c053c02bc02f00a2009ec0aec0acc0a2c09ec05cc060c056c052c024c028006b006ac073c07700c400c3c023c02700670040c072c07600be00bdc00ac014003800880087c009c0130032009a009900450044009dc0a1c09dc051009cc0a0c09cc050003d00c0003c00ba00840096004100ff01000117000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00209907932aaaea3db07b9a2965ac39f563fd0a192c47b31f5d5f17a4cb9689490d0015007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["b3e88a126e6e0179ae465227a52f60ad"],"http_akin":["b10lun000_00000000_334359b9"]},"fingerprint_peers":{"b10lun000_00000000_334359b9":2217,"t13i781000_ab95583b6d39_d41ae481755e":319},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2218}},"user_agents":[],"timeline":[{"date":"2026-09-03","count":17},{"date":"2026-09-11","count":16},{"date":"2026-09-30","count":133}],"recent_events":[{"timestamp":"2026-09-30T22:19:54","port":1027,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"4094f678-1494-4603-a085-7fa1401a7e3f","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-30T22:19:54","port":5631,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"a9efc866-e0fa-49c4-8c9c-9be05264512b","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":13,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-09-30T22:19:53","port":2717,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"3e273029-c4b2-40b2-853a-6c343d8ec0ff","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":13,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-09-30T22:19:52","port":1030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"d0b0b3a5-6379-4e1c-a5d5-ac3298f589ac","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-30T22:19:52","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"abff5fc5-0442-4cdd-bbff-0fac93ff0e34","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-30T22:19:52","port":513,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"46041ed0-a7bd-46e7-a3e2-809fd32d5b41","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-30T22:19:49","port":37,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"4fba1023-2eda-4a47-aeea-dca6032951ae","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":13,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-09-30T22:19:49","port":5631,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"50edd0ed-7355-4aca-a024-fbbc73d7ce21","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-30T22:19:48","port":2717,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"da16ba76-c829-42a4-ba51-157723251d31","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":13,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-30T22:19:48","port":1027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a091cebc-69a1-4747-8b23-8aa6b374e91c","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":78}],"http_methods":[{"method":"GET","count":45},{"method":"OPTIONS","count":3}],"distinct_ports_total":43,"top_paths":[{"path":"/","count":46,"ports":40},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-02T01:10:11.970930+00:00"}