{"ip":"201.231.68.230","data_as_of":"2026-10-29T03:10:38+00:00","observed":true,"total_events":185,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"86+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 86 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 40 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,036 bytes sent","bytes_sent":6036,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-09-10T03:25:09","last_seen":"2026-10-29T00:37:16","events_24h":7,"events_7d":30,"interactive_sessions":40,"interactive_sessions_24h":0,"interactive_sessions_7d":24,"interactive_protocols":[{"protocol":"minecraft","sessions":3}],"geo":{"country_code":"AR","country_name":"Argentina","region":"Cordoba","city":"Córdoba","lat":-31.4057,"lon":-64.1849,"asn":7303,"org":"Telecom Argentina S.A."},"source_domain":"230-68-231-201.fibertel.com.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7303","label":"TELECOM ARGENTINA","category":"isp","url":"https://www.peeringdb.com/asn/7303"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":40,"first_seen":"2026-10-18T19:08:06","last_seen":"2026-10-28T01:19:58","verdicts":[{"verdict":"scan","sessions":39},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"minecraft@Purpur 1.19.4","sessions":3}],"services":[{"protocol":"minecraft","port":25565,"sessions":3},{"protocol":"tcp","port":25569,"sessions":3},{"protocol":"tcp","port":25575,"sessions":3},{"protocol":"tcp","port":25592,"sessions":2},{"protocol":"tcp","port":25560,"sessions":2},{"protocol":"tcp","port":25552,"sessions":1},{"protocol":"tcp","port":25567,"sessions":1},{"protocol":"tcp","port":31666,"sessions":1},{"protocol":"tcp","port":25577,"sessions":1},{"protocol":"tcp","port":25719,"sessions":1},{"protocol":"tcp","port":25594,"sessions":1},{"protocol":"tcp","port":25572,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":39}]},"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":9,"sessions":3},{"port":25566,"proto":"tcp","label":"","count":10,"sessions":1},{"port":25571,"proto":"tcp","label":"","count":10,"sessions":0},{"port":25560,"proto":"tcp","label":"","count":8,"sessions":2},{"port":25569,"proto":"tcp","label":"","count":7,"sessions":3},{"port":25570,"proto":"tcp","label":"","count":8,"sessions":1},{"port":25564,"proto":"tcp","label":"","count":7,"sessions":1},{"port":25567,"proto":"tcp","label":"","count":7,"sessions":1},{"port":25568,"proto":"tcp","label":"","count":7,"sessions":0},{"port":25557,"proto":"tcp","label":"","count":6,"sessions":0},{"port":25563,"proto":"tcp","label":"","count":6,"sessions":0},{"port":25577,"proto":"tcp","label":"","count":5,"sessions":1},{"port":25695,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25561,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25562,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-10","count":8,"sessions":0},{"date":"2026-09-11","count":6,"sessions":0},{"date":"2026-09-12","count":1,"sessions":0},{"date":"2026-09-13","count":2,"sessions":0},{"date":"2026-09-14","count":2,"sessions":0},{"date":"2026-09-15","count":8,"sessions":0},{"date":"2026-09-16","count":3,"sessions":0},{"date":"2026-09-19","count":1,"sessions":0},{"date":"2026-09-22","count":2,"sessions":0},{"date":"2026-09-24","count":3,"sessions":0},{"date":"2026-09-25","count":4,"sessions":0},{"date":"2026-09-26","count":6,"sessions":0},{"date":"2026-09-27","count":7,"sessions":0},{"date":"2026-09-28","count":1,"sessions":0},{"date":"2026-09-29","count":1,"sessions":0},{"date":"2026-09-30","count":3,"sessions":0},{"date":"2026-10-01","count":1,"sessions":0},{"date":"2026-10-02","count":1,"sessions":0},{"date":"2026-10-03","count":4,"sessions":0},{"date":"2026-10-04","count":6,"sessions":0},{"date":"2026-10-05","count":3,"sessions":0},{"date":"2026-10-06","count":6,"sessions":0},{"date":"2026-10-07","count":8,"sessions":0},{"date":"2026-10-08","count":8,"sessions":0},{"date":"2026-10-09","count":2,"sessions":0},{"date":"2026-10-10","count":11,"sessions":0},{"date":"2026-10-11","count":2,"sessions":0},{"date":"2026-10-12","count":9,"sessions":0},{"date":"2026-10-13","count":5,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-15","count":4,"sessions":0},{"date":"2026-10-17","count":5,"sessions":0},{"date":"2026-10-18","count":2,"sessions":7},{"date":"2026-10-19","count":14,"sessions":2},{"date":"2026-10-20","count":2,"sessions":3},{"date":"2026-10-21","count":2,"sessions":4},{"date":"2026-10-23","count":0,"sessions":1},{"date":"2026-10-24","count":6,"sessions":3},{"date":"2026-10-25","count":10,"sessions":2},{"date":"2026-10-26","count":3,"sessions":8},{"date":"2026-10-27","count":4,"sessions":9},{"date":"2026-10-28","count":3,"sessions":1},{"date":"2026-10-29","count":4,"sessions":0}],"recent_events":[{"timestamp":"2026-10-29T00:37:16","port":25581,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63ed010100","method":"","user_agent":"","ja3":"","session":"03ff27e6-655f-4a2c-8ff5-009fff74830b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-29T00:37:05","port":25570,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e2010100","method":"","user_agent":"","ja3":"","session":"52f08fc9-e734-40ed-b159-148c513025ed","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-29T00:36:53","port":25577,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e9010100","method":"","user_agent":"","ja3":"","session":"2dfc9676-241e-4952-8825-07e7b1c2e88f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-29T00:36:45","port":25564,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63dc010100","method":"","user_agent":"","ja3":"","session":"04578be0-1a70-4467-a0c1-7164b52b5c90","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T20:02:40","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"248a3a94-d141-4552-b7db-975a9bc2b3e8","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T16:26:01","port":25566,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63de010100","method":"","user_agent":"","ja3":"","session":"a2918c9b-6017-4bb2-87e3-852746951100","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T03:43:34","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63e0010100","method":"","user_agent":"","ja3":"","session":"dfa50e51-591b-4c2e-b2fc-bcca10666322","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-28T01:19:56","port":35487,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d3c484f4e4559504f543e8a9f010100","method":"","user_agent":"","ja3":"","session":"41483f57-45ba-4eb2-bc82-7da86cb86af8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"89df74f276179d84","strings":["<HONEYPOT>"]},"interactive":true},{"timestamp":"2026-10-27T22:39:10","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e3c484f4e4559504f543e63e1010100","method":"","user_agent":"","ja3":"","session":"87926c6d-8908-484e-a654-6676cc4cc830-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]},"interactive":true},{"timestamp":"2026-10-27T22:38:59","port":25560,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e3c484f4e4559504f543e63d8010100","method":"","user_agent":"","ja3":"","session":"7fb19fed-23a2-485f-a6b8-0ceb76a21824-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]},"interactive":true}],"http_methods":[],"distinct_ports_total":86,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}