{"ip":"43.157.40.157","total_events":100,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"20+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 20 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,237 bytes sent","bytes_sent":2237,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T13:49:52","last_seen":"2026-09-20T13:50:15","events_24h":0,"events_7d":100,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[],"malware":[],"top_ports":[{"port":24,"proto":"tcp","label":"","count":5},{"port":26,"proto":"tcp","label":"","count":5},{"port":83,"proto":"tcp","label":"","count":5},{"port":43,"proto":"tcp","label":"","count":5},{"port":9,"proto":"tcp","label":"","count":5},{"port":37,"proto":"tcp","label":"","count":5},{"port":1,"proto":"tcp","label":"","count":5},{"port":3,"proto":"tcp","label":"","count":5},{"port":4,"proto":"tcp","label":"","count":5},{"port":6,"proto":"tcp","label":"","count":5},{"port":79,"proto":"tcp","label":"","count":5},{"port":82,"proto":"tcp","label":"","count":5},{"port":7,"proto":"tcp","label":"","count":5},{"port":32,"proto":"tcp","label":"","count":5},{"port":17,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-20","count":100}],"recent_events":[{"timestamp":"2026-09-20T13:50:15","port":7,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"cb75b334-c622-4528-b855-29181b6b6058","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-20T13:50:15","port":1,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"bdbdacf0-c703-4a7e-942f-f58ba10fa69f","seq":1,"duration_ms":101,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-20T13:50:15","port":79,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"97290603-c6ca-4789-8643-d4b04c05151b","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-20T13:50:12","port":17,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"41af28e8-1fbb-43aa-a1eb-964ed816c33e","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-20T13:50:12","port":32,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6b9c182a-4954-408a-9a30-c22705f15331","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-20T13:50:12","port":3,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6abb65b1-e80c-4a87-a030-4086c8b6690d","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-20T13:50:12","port":42,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"43f30546-3470-4ec5-a294-697cff112f8e","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-20T13:50:12","port":82,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"b1b6dab6-45a3-41e4-9f38-a2b3e9d1fe49","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-20T13:50:12","port":24,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d7c3e7c1-8d97-4ed3-b70a-9dc605003770","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-20T13:50:12","port":83,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"3f03361c-58e6-47c5-abdf-9d122803c1c6","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":78,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}}],"http_methods":[{"method":"GET","count":23},{"method":"OPTIONS","count":20}],"distinct_ports_total":20,"top_paths":[{"path":"/","count":40,"ports":20},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":3,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T16:01:30.776202+00:00"}