{"ip":"212.56.48.80","total_events":3756,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"2119+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 2119 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"88,808 bytes sent","bytes_sent":88808,"session_seconds":21,"persistent":false}},"first_seen":"2026-08-08T03:41:52","last_seen":"2026-08-08T03:53:38","events_24h":0,"events_7d":3756,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":3257,"org":"GTT Communications Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as3257","label":"GTT Communications (AS3257)","category":"isp","url":"https://www.peeringdb.com/asn/3257"},"cve_matches":[],"malware":[],"top_ports":[{"port":40232,"proto":"tcp","label":"","count":6},{"port":25543,"proto":"tcp","label":"","count":5},{"port":5160,"proto":"tcp","label":"","count":5},{"port":22131,"proto":"tcp","label":"","count":5},{"port":49509,"proto":"tcp","label":"","count":5},{"port":39247,"proto":"tcp","label":"","count":5},{"port":48959,"proto":"tcp","label":"","count":5},{"port":25375,"proto":"tcp","label":"","count":5},{"port":26244,"proto":"tcp","label":"","count":5},{"port":2302,"proto":"tcp","label":"","count":5},{"port":26987,"proto":"tcp","label":"","count":5},{"port":41388,"proto":"tcp","label":"","count":5},{"port":11428,"proto":"tcp","label":"","count":5},{"port":23725,"proto":"tcp","label":"","count":5},{"port":36536,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-08","count":3756}],"recent_events":[{"timestamp":"2026-08-08T03:53:38","port":58570,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e4ca010100","method":"","user_agent":"","ja3":"","session":"944a28d0-d3c6-4b6c-90a3-2f5df4a205a9","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:38","port":58903,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�\u0017\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e617010100","method":"","user_agent":"","ja3":"","session":"7b1e6786-c349-446d-8c6e-b5ce278ab903","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"937ec92ecc113aca","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:38","port":58699,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�K\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e54b010100","method":"","user_agent":"","ja3":"","session":"972e81d8-8cfa-4aac-b2f2-77512af63758","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"664c6e2bb3ba4459","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:38","port":58637,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�\r\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e50d010100","method":"","user_agent":"","ja3":"","session":"b4d1f8c9-8172-4671-b10a-9b33f9d70d74","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"55a829cb52f7e089","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58973,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�]\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e65d010100","method":"","user_agent":"","ja3":"","session":"2650c151-0100-483b-a791-61ffc5decaba","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"09c72f6d1845254d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58800,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e5b0010100","method":"","user_agent":"","ja3":"","session":"e37c36b6-6438-4ed3-86b1-5b63d091fe33","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58509,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e48d010100","method":"","user_agent":"","ja3":"","session":"998ff783-6985-411c-a35a-c006e449be61","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58800,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e5b0010100","method":"","user_agent":"","ja3":"","session":"a1e7edb7-178e-4c1f-8c21-f9443c01a934","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58699,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>�K\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e54b010100","method":"","user_agent":"","ja3":"","session":"33609a14-1dc5-46dc-a717-b874cedbb878","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"664c6e2bb3ba4459","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-08T03:53:37","port":58820,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0000�\u0005\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1500fc050e<HONEYPOT>e5c4010100","method":"","user_agent":"","ja3":"","session":"077d7dc8-5e71-4f84-8381-3a6c26c5b468","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"4170428daf5f24f8","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":2119,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T18:32:49.928981+00:00"}