{"ip":"38.66.91.191","data_as_of":"2026-10-25T04:38:22+00:00","observed":true,"total_events":120,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"56+ ports swept","confidence":"medium","network_type":"network service provider","why":["No exploit payloads observed.","Swept 56 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 19 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,726 bytes sent","bytes_sent":3726,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-08-27T20:56:22","last_seen":"2026-10-25T03:03:44","events_24h":7,"events_7d":24,"interactive_sessions":19,"interactive_sessions_24h":0,"interactive_sessions_7d":17,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Pennsylvania","city":"Kutztown","lat":40.5201,"lon":-75.7768,"asn":174,"org":"Cogent Communications, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as174","label":"Cogent Communications, Inc.","category":"isp","url":"https://www.peeringdb.com/asn/174"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":19,"first_seen":"2026-10-15T13:03:36","last_seen":"2026-10-21T15:50:41","verdicts":[{"verdict":"scan","sessions":19}],"personas":[],"services":[{"protocol":"tcp","port":25573,"sessions":2},{"protocol":"tcp","port":25559,"sessions":2},{"protocol":"tcp","port":25572,"sessions":2},{"protocol":"tcp","port":25574,"sessions":2},{"protocol":"tcp","port":25582,"sessions":1},{"protocol":"tcp","port":25571,"sessions":1},{"protocol":"tcp","port":25558,"sessions":1},{"protocol":"tcp","port":25568,"sessions":1},{"protocol":"tcp","port":25566,"sessions":1},{"protocol":"tcp","port":25581,"sessions":1},{"protocol":"tcp","port":25579,"sessions":1},{"protocol":"tcp","port":25561,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":19}]},"top_ports":[{"port":25569,"proto":"tcp","label":"","count":6,"sessions":1},{"port":25572,"proto":"tcp","label":"","count":5,"sessions":2},{"port":25568,"proto":"tcp","label":"","count":5,"sessions":1},{"port":25561,"proto":"tcp","label":"","count":5,"sessions":1},{"port":25567,"proto":"tcp","label":"","count":5,"sessions":1},{"port":25573,"proto":"tcp","label":"","count":4,"sessions":2},{"port":25560,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25570,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25563,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25576,"proto":"tcp","label":"","count":5,"sessions":0},{"port":25565,"proto":"tcp","label":"Minecraft","count":4,"sessions":0},{"port":25578,"proto":"tcp","label":"","count":4,"sessions":0},{"port":25593,"proto":"tcp","label":"","count":3,"sessions":0},{"port":25555,"proto":"tcp","label":"","count":3,"sessions":0},{"port":25694,"proto":"tcp","label":"","count":3,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":1,"sessions":0},{"date":"2026-08-28","count":9,"sessions":0},{"date":"2026-08-29","count":2,"sessions":0},{"date":"2026-08-30","count":3,"sessions":0},{"date":"2026-09-02","count":3,"sessions":0},{"date":"2026-09-03","count":5,"sessions":0},{"date":"2026-09-09","count":2,"sessions":0},{"date":"2026-09-10","count":7,"sessions":0},{"date":"2026-09-11","count":3,"sessions":0},{"date":"2026-09-12","count":1,"sessions":0},{"date":"2026-09-16","count":1,"sessions":0},{"date":"2026-09-19","count":1,"sessions":0},{"date":"2026-09-23","count":1,"sessions":0},{"date":"2026-09-24","count":2,"sessions":0},{"date":"2026-09-26","count":2,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-09-28","count":1,"sessions":0},{"date":"2026-09-30","count":1,"sessions":0},{"date":"2026-10-01","count":1,"sessions":0},{"date":"2026-10-02","count":4,"sessions":0},{"date":"2026-10-03","count":4,"sessions":0},{"date":"2026-10-04","count":1,"sessions":0},{"date":"2026-10-05","count":3,"sessions":0},{"date":"2026-10-07","count":2,"sessions":0},{"date":"2026-10-08","count":3,"sessions":0},{"date":"2026-10-09","count":3,"sessions":0},{"date":"2026-10-10","count":5,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-12","count":1,"sessions":0},{"date":"2026-10-13","count":9,"sessions":0},{"date":"2026-10-14","count":9,"sessions":0},{"date":"2026-10-15","count":4,"sessions":1},{"date":"2026-10-18","count":4,"sessions":2},{"date":"2026-10-19","count":2,"sessions":1},{"date":"2026-10-20","count":4,"sessions":5},{"date":"2026-10-21","count":6,"sessions":10},{"date":"2026-10-24","count":4,"sessions":0},{"date":"2026-10-25","count":4,"sessions":0}],"recent_events":[{"timestamp":"2026-10-25T03:03:44","port":54753,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>d5e1010100","method":"","user_agent":"","ja3":"","session":"b9bcaeae-f14e-4c9e-a76d-d21938bada35","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}},{"timestamp":"2026-10-25T03:03:40","port":25694,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>d^\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>645e010100","method":"","user_agent":"","ja3":"","session":"ef9d6260-4b56-4eb1-915a-b193a6c75633","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"1849ab83a83905be","strings":["<HONEYPOT>d^"]}},{"timestamp":"2026-10-25T02:31:48","port":25571,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e3010100","method":"","user_agent":"","ja3":"","session":"5426836c-c934-4efb-ab23-37df1af940c0","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-25T01:48:45","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e0010100","method":"","user_agent":"","ja3":"","session":"9cfa8ef5-6eb1-4675-983f-8830c2ed45ac","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-24T05:22:09","port":25572,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e4010100","method":"","user_agent":"","ja3":"","session":"da7d3cfe-dfa9-458d-b11e-ec0ca591a70f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-24T05:22:04","port":25579,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63eb010100","method":"","user_agent":"","ja3":"","session":"78776d57-dfe7-45c9-82c0-fee4c140a972","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-24T05:22:01","port":25563,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63db010100","method":"","user_agent":"","ja3":"","session":"995bb179-1190-423e-81a2-0d640e8e407b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-24T02:04:57","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"816c787c-589f-4bff-a600-e27c7f0fc66e","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-21T17:12:19","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63e0010100","method":"","user_agent":"","ja3":"","session":"c2306a3f-5855-4e48-b8d5-05447552cf9f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-10-21T17:11:59","port":25561,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63d9010100","method":"","user_agent":"","ja3":"","session":"95478817-541f-49fa-9639-550981e02aee","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":56,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}