{"ip":"42.96.19.35","total_events":1294,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"397+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 397 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"24,586 bytes sent","bytes_sent":24586,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-10T14:14:11","last_seen":"2026-09-16T08:08:07","events_24h":0,"events_7d":1294,"geo":{"country_code":"VN","country_name":"Vietnam","region":"","city":"","lat":16.1667,"lon":107.8333,"asn":131423,"org":"Branch of Long Van System Solution JSC - Hanoi"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":7173,"proto":"tcp","label":"","count":8},{"port":2213,"proto":"tcp","label":"","count":8},{"port":50743,"proto":"tcp","label":"","count":8},{"port":53230,"proto":"tcp","label":"","count":8},{"port":15448,"proto":"tcp","label":"","count":6},{"port":57018,"proto":"tcp","label":"","count":6},{"port":33220,"proto":"tcp","label":"","count":6},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":6},{"port":21838,"proto":"tcp","label":"","count":6},{"port":27934,"proto":"tcp","label":"","count":6},{"port":44493,"proto":"tcp","label":"","count":6},{"port":7260,"proto":"tcp","label":"","count":6},{"port":32608,"proto":"tcp","label":"","count":6},{"port":28871,"proto":"tcp","label":"","count":6},{"port":34174,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-10","count":126},{"date":"2026-09-12","count":333},{"date":"2026-09-13","count":218},{"date":"2026-09-15","count":344},{"date":"2026-09-16","count":273}],"recent_events":[{"timestamp":"2026-09-16T08:08:07","port":58817,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3611c098-e26f-4902-a437-c2f8a0f2636f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:04:01","port":13830,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"620656d7-3cc6-418f-a492-28fdfaedf358","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:04:01","port":13830,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"d9fb060d-9978-462f-9a90-a4fe18aae33b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:03:27","port":16352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"8efd7d8e-dafb-4699-a08e-9a2fcc080c4c","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:03:27","port":16352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"0fe4fc59-4170-423e-b149-4b1d99842bfd","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:01:43","port":7173,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"92ab0762-8d5d-4217-bc63-257a810c2883","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T08:01:43","port":7173,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3b57f878-a1b5-430a-a1c5-9abbf1f791d0","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T07:58:00","port":54789,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"b21ef3c6-b9bb-445c-bda9-f6e4a2987120","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T07:57:59","port":54789,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"60db2ced-3fe7-464a-8b0d-d27f4a229874","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T07:57:20","port":7636,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"33cbeeaf-662e-4bf3-8914-57d1598a5882","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":397,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-17T11:45:48.918764+00:00"}