{"ip":"217.60.76.201","total_events":1191,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"315+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 315 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"55,977 bytes sent","bytes_sent":55977,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-13T07:18:36","last_seen":"2026-09-28T21:31:03","events_24h":499,"events_7d":782,"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"","city":"","lat":23.75,"lon":54.5,"asn":401626,"org":"Netiface America, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1143,"proto":"tcp","label":"","count":14},{"port":18471,"proto":"tcp","label":"","count":14},{"port":54225,"proto":"tcp","label":"","count":14},{"port":24417,"proto":"tcp","label":"","count":14},{"port":6857,"proto":"tcp","label":"","count":14},{"port":51887,"proto":"tcp","label":"","count":14},{"port":63079,"proto":"tcp","label":"","count":14},{"port":14347,"proto":"tcp","label":"","count":12},{"port":57659,"proto":"tcp","label":"","count":12},{"port":56756,"proto":"tcp","label":"","count":12},{"port":53334,"proto":"tcp","label":"","count":12},{"port":4330,"proto":"tcp","label":"","count":12},{"port":2490,"proto":"tcp","label":"","count":12},{"port":54701,"proto":"tcp","label":"","count":12},{"port":37036,"proto":"tcp","label":"","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-13","count":70},{"date":"2026-09-14","count":159},{"date":"2026-09-15","count":150},{"date":"2026-09-16","count":30},{"date":"2026-09-24","count":8},{"date":"2026-09-27","count":310},{"date":"2026-09-28","count":464}],"recent_events":[{"timestamp":"2026-09-28T21:31:03","port":22551,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"f5f5f66d-d398-4726-b681-13df0d9047ae","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:31:03","port":22551,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"c40bfdea-5366-4d6e-94cb-37de8cbed5c9","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:26:31","port":22551,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"e3c1ab96-8ec3-4043-a888-96be41d37e26","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:26:31","port":22551,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"eb9c7bce-e06e-4d9c-be28-85da41decd8a","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:25:25","port":29404,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ed40a77b-a696-4de6-9693-c41fa3cf3585","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:25:25","port":29404,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"179c5883-e931-4cc2-8d32-32c9eb9e9db3","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:08:44","port":52049,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"efd1525c-9bcd-4ce3-8c16-b8745ba60482","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:08:43","port":52049,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"dd34f301-2234-49b3-a4c5-df06209bf5d2","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:08:25","port":2490,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"f90a366a-5ebc-4ff8-8e7d-f55dce3d94fa","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-28T21:08:25","port":2490,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"1badcf65-1dce-4484-87e6-277d23546cae","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13}],"http_methods":[],"distinct_ports_total":315,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T21:33:04.154510+00:00"}