{"ip":"221.133.9.25","data_as_of":"2026-10-27T00:41:55+00:00","observed":true,"total_events":77,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["77 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"900 bytes sent","bytes_sent":900,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-03-03T04:50:51","last_seen":"2026-10-24T23:53:39","events_24h":0,"events_7d":1,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"VN","country_name":"Vietnam","region":"","city":"","lat":16.1667,"lon":107.8333,"asn":7602,"org":"Sai gon Postel Corporation"},"source_domain":"mail.gemcenter.com.vn","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7602","label":"Saigon Postel Corp.","category":"isp","url":"https://www.peeringdb.com/asn/7602"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":64},{"port":445,"proto":"tcp","label":"SMB","count":13}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-04","count":3},{"date":"2026-08-06","count":2},{"date":"2026-09-07","count":1},{"date":"2026-10-03","count":1},{"date":"2026-10-18","count":3},{"date":"2026-10-24","count":1}],"recent_events":[{"timestamp":"2026-10-24T23:53:39","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000ac810000","method":"","user_agent":"","ja3":"","session":"a026bbab-6677-4030-b5d9-c2559a43b49b","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-10-18T05:18:13","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000a0e00000","method":"","user_agent":"","ja3":"","session":"38a83793-603d-4b4d-a3ce-0050ba8b92f9","seq":1,"duration_ms":101,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-10-18T05:18:02","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000a0e00000","method":"","user_agent":"","ja3":"","session":"0168e4a9-0301-4c7b-94cd-a55caf87864e","seq":1,"duration_ms":101,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-10-18T05:17:51","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000a0e00000","method":"","user_agent":"","ja3":"","session":"3ce1b3e4-fb9f-406d-9a1d-a05bbf63a34d","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-10-03T23:21:54","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���7\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffffa43700000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"189ef137-9f8a-4ac2-90e4-cefd171c1fa3","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"3e05da016d8e76f8","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-09-07T16:07:26","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffffe4bb00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"28a57758-c2e6-4f3e-9685-39a988be4e5b","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"5862ccd01e141636","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-08-06T19:32:36","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0001\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000ace40100","method":"","user_agent":"","ja3":"","session":"a83fd107-07e4-4bb7-8a06-9e309595e82a","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-08-06T19:32:25","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000��\u0001\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000ace40100","method":"","user_agent":"","ja3":"","session":"eac72c40-0bb4-4863-a80c-cf67d44cf879","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-08-04T02:09:48","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000x\u001f\u0003\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000781f0300","method":"","user_agent":"","ja3":"","session":"00d77404-a87f-4724-8165-bf6d1814d0c0","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-08-04T02:09:36","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000\u0000x\u001f\u0003\u0000","payload_hex":"1201002900000000000015000601001b000102001c000103001d0004ff0800015500000000781f0300","method":"","user_agent":"","ja3":"","session":"50f9d780-d1b8-49a2-ae57-f4e8a51ad8c9","seq":1,"duration_ms":101,"bytes_in":41,"bytes_out":12}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}