{"ip":"24.118.142.76","total_events":17,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["17 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,270 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,270 bytes sent","bytes_sent":5270,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-08T16:40:54","last_seen":"2026-09-09T00:19:53","events_24h":0,"events_7d":17,"geo":{"country_code":"US","country_name":"United States","region":"Minnesota","city":"Saint Paul","lat":45.0139,"lon":-93.1545,"asn":7922,"org":"Comcast Cable Communications, LLC"},"source_domain":"c-24-118-142-76.hsd1.mn.comcast.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7922","label":"Comcast","category":"isp","url":"https://www.peeringdb.com/asn/7922"},"cve_matches":[],"malware":[],"top_ports":[{"port":5555,"proto":"tcp","label":"","count":17}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-08","count":16},{"date":"2026-09-09","count":1}],"recent_events":[{"timestamp":"2026-09-09T00:19:53","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"44763e60-2f47-4949-9526-61a9648057f5","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T22:59:45","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"b1572697-9378-4597-a349-1dbb3c162984","seq":1,"duration_ms":101,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T21:50:55","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"7dea06ba-3398-45fc-ab7e-a5da641ce282","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T20:46:12","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"79f0a735-bee9-497d-ac0a-0948b3888eb6","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T20:00:02","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"855ad87a-a3d5-4f25-967e-aed816e32373","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T19:25:32","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"84b70aa7-9785-4621-bc2d-854c27eeea66","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T18:56:19","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"26530023-f59d-4b23-8ad6-56839a29a14a","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T18:34:01","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"416dd5bb-2db6-404f-ad70-78410633b98c","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T18:09:45","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"5cdef42e-305c-4ebc-8836-ffc4e17f8881","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T17:50:22","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"1e559b79-edad-4fe7-80dc-7359cd1d25db","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":13,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T08:59:30.105995+00:00"}