{"ip":"195.177.93.48","total_events":12847,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"5823+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 5823 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"298,388 bytes sent","bytes_sent":298388,"session_seconds":26,"persistent":false}},"first_seen":"2026-09-11T23:06:09","last_seen":"2026-09-11T23:17:49","events_24h":0,"events_7d":12847,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"","lat":47.3643,"lon":8.5437,"asn":212238,"org":"Datacamp Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":21109,"proto":"tcp","label":"","count":6},{"port":30628,"proto":"tcp","label":"","count":6},{"port":44527,"proto":"tcp","label":"","count":6},{"port":39823,"proto":"tcp","label":"","count":6},{"port":34074,"proto":"tcp","label":"","count":6},{"port":39680,"proto":"tcp","label":"","count":6},{"port":21266,"proto":"tcp","label":"","count":6},{"port":45961,"proto":"tcp","label":"","count":6},{"port":20467,"proto":"tcp","label":"","count":6},{"port":45248,"proto":"tcp","label":"","count":6},{"port":44142,"proto":"tcp","label":"","count":6},{"port":36802,"proto":"tcp","label":"","count":6},{"port":52664,"proto":"tcp","label":"","count":6},{"port":15947,"proto":"tcp","label":"","count":6},{"port":5221,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-11","count":12847}],"recent_events":[{"timestamp":"2026-09-11T23:17:49","port":56195,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"ec9fe753-f91c-4660-939f-8159f6c60563","seq":2,"duration_ms":10156,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-09-11T23:17:49","port":56217,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"28b3d748-673a-4448-afe2-f00ce8fe8f00","seq":2,"duration_ms":10157,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-09-11T23:17:49","port":56408,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�X\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>dc58010100","method":"","user_agent":"","ja3":"","session":"5da38d3f-8429-4a00-b4a5-977a5a564103","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"8fd231dac0eda137","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:49","port":56485,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>ܥ\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>dca5010100","method":"","user_agent":"","ja3":"","session":"0813b737-9070-4fee-9d24-c5bbb913a5ca","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"35cb4541f721cb12","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:49","port":56160,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"939bb444-13b4-447f-9802-9ce3c46510a1","seq":2,"duration_ms":11913,"bytes_in":24,"bytes_out":26},{"timestamp":"2026-09-11T23:17:49","port":54313,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�)\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>d429010100","method":"","user_agent":"","ja3":"","session":"e88f265b-7b31-4829-b1b4-e10b21da3392","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"30bc7e7580b1fc7d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:45","port":53592,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�X\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>d158010100","method":"","user_agent":"","ja3":"","session":"0ef62a10-1226-4beb-a3f2-4be3d473eb82","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"8fd231dac0eda137","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:43","port":53758,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>d1fe010100","method":"","user_agent":"","ja3":"","session":"288a4550-6c6f-4a4c-a465-222e738f72fd","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:43","port":53589,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�U\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>d155010100","method":"","user_agent":"","ja3":"","session":"a75e84f1-d1b7-487c-921c-7cea265dcbc5","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"7c3ba41c385e6f49","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-11T23:17:43","port":54400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>Ԁ\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>d480010100","method":"","user_agent":"","ja3":"","session":"bfe421e0-9094-40ff-92a3-7f3699bfbc8b","seq":1,"duration_ms":0,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"4dddbc97962998e1","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":5823,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-14T00:00:55.384270+00:00"}