{"ip":"193.107.20.41","total_events":14391,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"7330+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 7330 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"332,344 bytes sent","bytes_sent":332344,"session_seconds":30,"persistent":false}},"first_seen":"2026-08-27T00:13:59","last_seen":"2026-08-27T00:27:45","events_24h":14391,"events_7d":14391,"geo":{"country_code":"LI","country_name":"Liechtenstein","region":"Vaduz","city":"Vaduz","lat":47.1322,"lon":9.5115,"asn":62240,"org":"Clouvider Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as62240","label":"Clouvider","category":"cdn","url":"https://www.peeringdb.com/asn/62240"},"cve_matches":[],"malware":[],"top_ports":[{"port":44073,"proto":"tcp","label":"","count":6},{"port":18347,"proto":"tcp","label":"","count":6},{"port":30169,"proto":"tcp","label":"","count":6},{"port":23711,"proto":"tcp","label":"","count":6},{"port":6687,"proto":"tcp","label":"","count":6},{"port":23930,"proto":"tcp","label":"","count":6},{"port":42764,"proto":"tcp","label":"","count":6},{"port":5371,"proto":"tcp","label":"","count":6},{"port":59813,"proto":"tcp","label":"","count":6},{"port":52335,"proto":"tcp","label":"","count":5},{"port":42559,"proto":"tcp","label":"","count":5},{"port":49598,"proto":"tcp","label":"","count":5},{"port":64886,"proto":"tcp","label":"","count":5},{"port":31574,"proto":"tcp","label":"","count":5},{"port":38762,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":14391}],"recent_events":[{"timestamp":"2026-08-27T00:27:45","port":65141,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�u\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>fe75010100","method":"","user_agent":"","ja3":"","session":"94fd0d89-5cf0-4982-b232-0e47a3e90edf","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"2f200bdcb2695bd5","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-27T00:27:30","port":64949,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"b6c2a20d-1884-49c1-b116-2acd0b0256ba","seq":2,"duration_ms":1807,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-08-27T00:27:28","port":64949,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001","payload_hex":"1500fc050e<HONEYPOT>fdb501","method":"","user_agent":"","ja3":"","session":"b6c2a20d-1884-49c1-b116-2acd0b0256ba","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"793ddd0f6d7b101d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-27T00:27:28","port":64656,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"00346124-346b-4446-ae87-6c118e6b2ff7","seq":2,"duration_ms":4677,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-08-27T00:27:27","port":64405,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>fb95010100","method":"","user_agent":"","ja3":"","session":"75b8b676-ad14-41e2-8ead-0e1676aef577","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-27T00:27:27","port":64300,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�,\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>fb2c010100","method":"","user_agent":"","ja3":"","session":"e714c5ca-75a6-4432-b85e-c38513022c8a","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"736017a862fd108d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-27T00:27:23","port":64656,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001","payload_hex":"1500fc050e<HONEYPOT>fc9001","method":"","user_agent":"","ja3":"","session":"00346124-346b-4446-ae87-6c118e6b2ff7","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"793ddd0f6d7b101d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-27T00:27:21","port":65170,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"f5146b74-fb41-4076-a22f-b86233495413","seq":2,"duration_ms":11437,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-08-27T00:27:18","port":64574,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"4a5bb639-7ce7-40ae-80ff-35ae86a3ebc5","seq":2,"duration_ms":1869,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-08-27T00:27:16","port":64574,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�>\u0001","payload_hex":"1500fc050e<HONEYPOT>fc3e01","method":"","user_agent":"","ja3":"","session":"4a5bb639-7ce7-40ae-80ff-35ae86a3ebc5","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"4ee67f5dfb9ca42f","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":7330,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-27T11:00:27.382949+00:00"}