{"ip":"194.195.252.210","total_events":1608,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"95,720 bytes sent","bytes_sent":95720,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T02:54:18","last_seen":"2026-09-12T10:03:57","events_24h":0,"events_7d":1385,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8672,"lon":151.1997,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"194.195.252.210.socradar-curiosity-wide-scan-project.socradar.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63949","label":"Linode AS63949","category":"cdn","url":"https://www.peeringdb.com/asn/63949"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":106},{"port":389,"proto":"tcp","label":"LDAP","count":69},{"port":1099,"proto":"tcp","label":"","count":67},{"port":53,"proto":"tcp","label":"DNS","count":67},{"port":6005,"proto":"tcp","label":"","count":66},{"port":88,"proto":"tcp","label":"","count":65},{"port":49153,"proto":"tcp","label":"","count":64},{"port":3268,"proto":"tcp","label":"","count":63},{"port":27017,"proto":"tcp","label":"MongoDB","count":63},{"port":50000,"proto":"tcp","label":"SAP","count":62},{"port":1433,"proto":"tcp","label":"MSSQL","count":61},{"port":111,"proto":"tcp","label":"RPC","count":60},{"port":11211,"proto":"tcp","label":"Memcached","count":59},{"port":2049,"proto":"tcp","label":"NFS","count":59},{"port":2375,"proto":"tcp","label":"Docker","count":58}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0200_5594a17e7e7e","ge11nn0000_000000000000"]},"fingerprint_peers":{"ge10nn0200_5594a17e7e7e":1970,"ge11nn0000_000000000000":80},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0","Mozilla/5.0 (X11; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-05","count":94},{"date":"2026-09-06","count":129},{"date":"2026-09-07","count":203},{"date":"2026-09-08","count":160},{"date":"2026-09-09","count":268},{"date":"2026-09-10","count":295},{"date":"2026-09-11","count":280},{"date":"2026-09-12","count":179}],"recent_events":[{"timestamp":"2026-09-12T10:03:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132312e302e302e30205361666172692f3533372e3336204564672f3132312e302e302e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0","ja3":"","session":"845c217b-7a17-4b02-8759-dea67a0c63a4","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":80},{"timestamp":"2026-09-12T10:03:53","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132312e302e302e30205361666172692f3533372e3336204564672f3132312e302e302e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0","ja3":"","session":"2b5ed956-0cff-4725-8321-c2b0cd5a3581","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":80},{"timestamp":"2026-09-12T10:03:52","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"1a1b7cee-a377-4b73-8d6e-5f85e57d4da4","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":15},{"timestamp":"2026-09-12T10:03:51","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001��\u0003","payload_hex":"fffe01fffe03","method":"","user_agent":"","ja3":"","session":"e60f1a06-ba0c-4c2c-8cf5-5b5f9354b84b","seq":2,"duration_ms":285,"bytes_in":8,"bytes_out":14},{"timestamp":"2026-09-12T10:03:51","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��","payload_hex":"fff6","method":"","user_agent":"","ja3":"","session":"e60f1a06-ba0c-4c2c-8cf5-5b5f9354b84b","seq":1,"duration_ms":100,"bytes_in":2,"bytes_out":7},{"timestamp":"2026-09-12T10:03:50","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"494222a2-3b62-4231-8ecb-2af3fc3ae869","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":15,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-12T10:03:46","port":49153,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"A\u0000\u0000\u0000:0\u0000\u0000�����\u0007\u0000\u0000\u0000\u0000\u0000\u0000test.$cmd\u0000\u0000\u0000\u0000\u0000����\u001b\u0000\u0000\u0000\u0001serverStatus\u0000\u0000\u0000\u0000\u0000\u0000\u0000�?\u0000","payload_hex":"410000003a300000ffffffffd407000000000000746573742e24636d640000000000ffffffff1b0000000173657276657253746174757300000000000000f03f00","method":"","user_agent":"","ja3":"","session":"a7b24bd3-3d20-4f40-9b78-abdb68226f8f","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":15,"enriched":{"digest":"adf77f2ce3d05f81","strings":["test.$cmd","serverStatus"]}},{"timestamp":"2026-09-12T10:03:45","port":1098,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"","session":"e46e224d-d697-4588-9d7f-4467b119f3c8","seq":1,"duration_ms":104,"bytes_in":7,"bytes_out":15,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-12T10:03:44","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000","payload_hex":"1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200480f0000","method":"","user_agent":"","ja3":"","session":"02dbf2b1-41b6-4db2-b260-545ea1f9521e","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":15,"enriched":{"digest":"9852857ade38ccb3","strings":["MSSQLServer","UMSSQLServerH"]}},{"timestamp":"2026-09-12T10:03:43","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\b\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0001\u0000��\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000000801c8000000000000000000000000ffff0100ffff0000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"e9b5fef3-66ac-45ef-a25b-7ee37cf7e490","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":15,"enriched":{"digest":"a06f7a94030db16d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}}],"http_methods":[{"method":"GET","count":173}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":115,"ports":2},{"path":"/version","count":58,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-13T23:13:18.017450+00:00"}