{"ip":"2.27.153.26","total_events":116,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"116+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 116 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,110 bytes sent","bytes_sent":4110,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-07T07:09:59","last_seen":"2026-10-07T08:53:02","events_24h":0,"events_7d":116,"geo":{"country_code":"PL","country_name":"Poland","region":"Mazovia","city":"Warsaw","lat":52.2299,"lon":21.0093,"asn":219543,"org":"German Kiselev"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":5976,"proto":"tcp","label":"","count":1},{"port":5950,"proto":"tcp","label":"","count":1},{"port":5955,"proto":"tcp","label":"","count":1},{"port":5948,"proto":"tcp","label":"","count":1},{"port":6010,"proto":"tcp","label":"","count":1},{"port":5947,"proto":"tcp","label":"","count":1},{"port":6022,"proto":"tcp","label":"","count":1},{"port":6653,"proto":"tcp","label":"","count":1},{"port":5943,"proto":"tcp","label":"","count":1},{"port":10001,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":5927,"proto":"tcp","label":"","count":1},{"port":5958,"proto":"tcp","label":"","count":1},{"port":6008,"proto":"tcp","label":"","count":1},{"port":5945,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-07","count":116}],"recent_events":[{"timestamp":"2026-10-07T08:53:02","port":6002,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"8a907be2-611f-4fbc-ac54-1310162bd179","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:51:23","port":5926,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"b0514b66-5c20-4dd0-a426-e16cfa36672a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:51:16","port":6010,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"fec79f67-dbec-4290-af1c-c18175a0e78a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:51:10","port":5932,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"4d089ae5-8ffa-442f-9604-48ec5a7a9fbb","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:49:16","port":5993,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"9323e42a-bcd8-4fa9-a1db-c24d5a9e1407","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:47:56","port":5987,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"e2b29cea-7648-4e9d-a3dd-2de3947b135d","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:47:35","port":5943,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"6c4e135b-545f-4150-863d-e8eebed6d7ad","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:45:40","port":5990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"a4cca37d-df4e-4bf4-819a-78b6af3923b5","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:45:14","port":5945,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"84e31e0d-ee92-49ff-bdfa-54504f264f98","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-10-07T08:44:44","port":5971,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"daa5399b-5443-41e2-83b5-e847e7444f1d","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":11,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":116,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-09T12:55:17.084775+00:00"}