{"ip":"220.185.85.27","total_events":59,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["59 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"354 bytes sent","bytes_sent":354,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-11T08:56:29","last_seen":"2026-08-11T09:02:19","events_24h":0,"events_7d":59,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4134,"org":"Chinanet"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4134","label":"China Telecom","category":"isp","url":"https://www.peeringdb.com/asn/4134"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":58},{"port":2121,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-11","count":59}],"recent_events":[{"timestamp":"2026-08-11T09:02:19","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"cd85061f-b3d5-4652-9c36-5dd8eae2fa1e","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:02:14","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"2285bf62-1c45-4334-b432-831648f8926b","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:02:14","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"2285bf62-1c45-4334-b432-831648f8926b","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:02:14","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"2285bf62-1c45-4334-b432-831648f8926b","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:02:05","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"e6e39eeb-28f5-4516-a09d-773ff61800ce","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:02:00","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"bbb7e848-f84b-4231-8781-ab89e37501f7","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:01:54","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"97b7394e-7e62-4a16-901f-d7c3cb33d9eb","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:01:46","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"644c7abb-fdb7-4517-8abb-8b032d45757f","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:01:37","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"ffa2b691-a280-4bd0-81aa-656e04789bcd","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-11T09:01:32","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"2384449d-fb0a-496f-a598-96e0207ed015","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T23:42:43.574154+00:00"}