{"ip":"36.255.97.174","total_events":74,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"36+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 36 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,258 bytes sent","bytes_sent":1258,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-29T16:04:53","last_seen":"2026-09-08T17:03:03","events_24h":0,"events_7d":0,"geo":{"country_code":"PK","country_name":"Pakistan","region":"","city":"","lat":30.0,"lon":70.0,"asn":205759,"org":"Ghosty Networks LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":33222,"proto":"tcp","label":"","count":3},{"port":22137,"proto":"tcp","label":"","count":3},{"port":51810,"proto":"tcp","label":"","count":2},{"port":51811,"proto":"tcp","label":"","count":2},{"port":51805,"proto":"tcp","label":"","count":2},{"port":51809,"proto":"tcp","label":"","count":2},{"port":10175,"proto":"tcp","label":"","count":2},{"port":51814,"proto":"tcp","label":"","count":2},{"port":51800,"proto":"tcp","label":"","count":2},{"port":51802,"proto":"tcp","label":"","count":2},{"port":51807,"proto":"tcp","label":"","count":2},{"port":51812,"proto":"tcp","label":"","count":2},{"port":51824,"proto":"tcp","label":"","count":2},{"port":51826,"proto":"tcp","label":"","count":2},{"port":51829,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":3},{"date":"2026-08-31","count":3},{"date":"2026-09-05","count":2},{"date":"2026-09-06","count":2},{"date":"2026-09-08","count":62}],"recent_events":[{"timestamp":"2026-09-08T17:03:03","port":51815,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"b6323c52-bd15-403f-bd93-86a44cf5d2fd","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51816,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"8b6acb96-3d00-4097-9984-25acc3460887","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51817,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"884ad72e-6fde-41f2-a639-7c16d020dc31","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51820,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"7cea8b5c-ed88-4ec4-9671-149846450682","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51819,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"8b861dc6-ce2c-4d83-942d-3f1281b66f79","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51818,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"4afe1a4e-df26-4be9-9d77-2fe3f69bc81f","seq":1,"duration_ms":102,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51823,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"ae499b28-05d5-4ab2-8fba-7e5e8f5bed95","seq":1,"duration_ms":102,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51822,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"640dd08d-95a1-4c77-bbcf-0ef1750dcc66","seq":1,"duration_ms":100,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51821,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"12f126a3-73f9-4503-a5de-9ab87fcca76f","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-09-08T17:03:03","port":51830,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"1ad1124b-2c6f-4c47-bcfa-a91cc8f80992","seq":1,"duration_ms":101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}}],"http_methods":[],"distinct_ports_total":36,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":74}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T09:25:45.531253+00:00"}