{"ip":"23.17.98.160","total_events":129,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"129+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 129 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,386 bytes sent","bytes_sent":4386,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-09T00:09:12","last_seen":"2026-09-09T01:50:45","events_24h":0,"events_7d":129,"geo":{"country_code":"CA","country_name":"Canada","region":"Alberta","city":"Edmonton","lat":53.563,"lon":-113.5656,"asn":852,"org":"TELUS Communications Inc."},"source_domain":"d23-17-98-160.abhsia.telus.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as852","label":"TELUS Communications","category":"isp","url":"https://www.peeringdb.com/asn/852"},"cve_matches":[],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":1},{"port":5958,"proto":"tcp","label":"","count":1},{"port":5972,"proto":"tcp","label":"","count":1},{"port":5915,"proto":"tcp","label":"","count":1},{"port":5916,"proto":"tcp","label":"","count":1},{"port":5987,"proto":"tcp","label":"","count":1},{"port":6633,"proto":"tcp","label":"","count":1},{"port":5970,"proto":"tcp","label":"","count":1},{"port":5933,"proto":"tcp","label":"","count":1},{"port":5945,"proto":"tcp","label":"","count":1},{"port":6060,"proto":"tcp","label":"","count":1},{"port":5931,"proto":"tcp","label":"","count":1},{"port":6697,"proto":"tcp","label":"","count":1},{"port":6100,"proto":"tcp","label":"","count":1},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-09","count":129}],"recent_events":[{"timestamp":"2026-09-09T01:50:45","port":5937,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"9c04a1b1-0538-4432-8e99-a7a483792e3e","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:46:59","port":5904,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"d736378b-f9d3-4a50-8205-35805d45f0a5","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:46:43","port":6633,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"d072182d-99a8-4be7-be86-f19b58d552b1","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:46:14","port":6081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"6618e6f1-cc8b-4413-9d11-688b10f283b0","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:45:51","port":5977,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"4a7874fd-2b30-4a9a-b989-3c3ffa76071a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:45:12","port":5915,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"9717d5e7-dfec-43ca-bd30-387da7074694","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:44:54","port":5958,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"3003c6fb-0505-4a4f-b494-03c8b9015c57","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:43:21","port":7000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"f918f460-0c19-4b9e-88fb-b5d2f91f6bfc","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:43:20","port":5978,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"4e843fc9-0752-4d0b-a4c6-ad78c3c4e728","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-09T01:43:18","port":5939,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"ca0bbf78-a6e1-43d2-be3b-776330dbf700","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":129,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T23:41:48.237226+00:00"}