{"ip":"211.137.28.184","total_events":1894,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,894 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,894 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"178,036 bytes sent","bytes_sent":178036,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-25T09:38:11","last_seen":"2026-09-25T09:57:01","events_24h":0,"events_7d":1894,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":56044,"org":"China Mobile communications corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":1894}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":1894}],"recent_events":[{"timestamp":"2026-09-25T09:57:01","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000(�\u0000���R�h=J�{�;��K\u0014H\u001eׇ�NoK��\u001d��hSB�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000028a400d8fae652f6683d4a9d7bf43bf8ab4b14481ed787ca4e6f4b9ed81df69e685342e300000001","method":"","user_agent":"","ja3":"","session":"33c1e856-4032-4145-a3b4-3f5b2ea693ad","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u00009\f\u0000\u0012Rv�{wZB��%\t\";�\n`\"w�\r��G��K\u001c��\u0007��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000390c00125276af7b775a4291ed2509223ba40a602277cd0dcff6479fa24b1cf6bf0794e100000001","method":"","user_agent":"","ja3":"","session":"239ca4ea-053a-4af4-8331-54ef81eb85dc","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"1c0a009520308ef3","strings":["{wZB"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000H�\u0000�����&NI�l\u001e�@\u000b'ۈd\u000b\tؘ�K��\u0014������\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000048e800c084b8ab90264e49836c1eb7400b27db88640b09d898954b949214ceedaed1e2e000000001","method":"","user_agent":"","ja3":"","session":"db48e86e-605a-4a1a-bb1a-f4df6c1da75b","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000:(\u0000\\\u001c\u0012��\u0018�H��=T\u0003\u0005�]�x\u0004�W\u000f�F��\u0013JcC�$�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003a28005c1c12ede618ae48a9be3d540305985d9c780499570f824686a4134a6343ca24e000000001","method":"","user_agent":"","ja3":"","session":"dbbc211e-6970-470b-afda-1041a21925dd","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000=�\u0000<�hN[ނK�C\\=US�:�j��\u0007\\\u001fN��>\u001dT����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003de8003c83684e5bde824bbc435c3d5553a43aab6aac97075c1f4ebbe53e1d54d6ddd9e200000001","method":"","user_agent":"","ja3":"","session":"3d928284-4d5b-49ab-9359-057703273a4a","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"ede62504f9bca03a","strings":["C\\=US"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\r�\u0000O)��Yo�M�3�d]M�]�776P\u0002�F�\u001b�\u001f�l/)�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000000da0004f29bae8596f9c4d9833f3645d4dd55d943737365002d546bb1bb41f896c2f29e300000001","method":"","user_agent":"","ja3":"","session":"024acf81-02d3-4330-9d0b-4c0db774db81","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"ccb9e4361118fe8f","strings":["776P"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u0014L\u0000%��BM�=F�\\��RA\rVt�\u0013\u0013�ȈH�X�������\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04060632000001000000144c0025f2ae424d893d468a5cc19052410d5674af1313bec888488858c6f6a392bad6e200000001","method":"","user_agent":"","ja3":"","session":"f2b73fbc-dd44-44d7-bb73-0a9156b43428","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000V�\u0000���;\u0005�cG�Ⱦ���Pn��\u0007��* @���vх\u0017��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0406063200000100000056c400b9cff53b05ad6347bac8bedefc84506e97a907f5a92a2040a9ec8d76d18517a4e200000001","method":"","user_agent":"","ja3":"","session":"e802bde9-a210-47e7-b452-0ff955c373b0","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000:(\u0000�S2 V��G�hY�ŘiA�x\u0004�W\u000f�F��\u0013JcC�$�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000003a2800b953322056819347866859fbc59869419c780499570f824686a4134a6343ca24e100000001","method":"","user_agent":"","ja3":"","session":"cfe86399-0626-4750-8314-29d27f5b2a3a","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"e3f4e0a8587f5570","strings":["S2 V"]}},{"timestamp":"2026-09-25T09:56:57","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\u0006\u00062\u0000\u0000\u0001\u0000\u0000\u0000\u000e\b\u0000�zUC��DO�;��\u0000:�\n%\u0017�\u0007��.A�%�F���M�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040606320000010000000e0800937a55438f94444fa83b808b003ab10a2517a407d4e52e418c2594469df3dd4de100000001","method":"","user_agent":"","ja3":"","session":"b1602f72-222c-4bd5-b132-1b60e60a09d6","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T20:50:51.748376+00:00"}