{"ip":"5.253.38.204","total_events":299,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"151+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 151 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,332 bytes sent","bytes_sent":10332,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-10T05:22:07","last_seen":"2026-09-18T13:25:02","events_24h":0,"events_7d":151,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0544,"lon":-118.244,"asn":7488,"org":"CNServer LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as7488","label":"CnServer LLC","category":"isp","url":"https://www.peeringdb.com/asn/7488"},"cve_matches":[],"malware":[],"top_ports":[{"port":5953,"proto":"tcp","label":"","count":2},{"port":5950,"proto":"tcp","label":"","count":2},{"port":10001,"proto":"tcp","label":"","count":2},{"port":6653,"proto":"tcp","label":"","count":2},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":2},{"port":5945,"proto":"tcp","label":"","count":2},{"port":5915,"proto":"tcp","label":"","count":2},{"port":5988,"proto":"tcp","label":"","count":2},{"port":5916,"proto":"tcp","label":"","count":2},{"port":5987,"proto":"tcp","label":"","count":2},{"port":5958,"proto":"tcp","label":"","count":2},{"port":6633,"proto":"tcp","label":"","count":2},{"port":5930,"proto":"tcp","label":"","count":2},{"port":5973,"proto":"tcp","label":"","count":2},{"port":6100,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-10","count":148},{"date":"2026-09-18","count":151}],"recent_events":[{"timestamp":"2026-09-18T13:25:02","port":6482,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"e5cf4208-af5c-4922-9fd7-a298a574eba4","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:23:47","port":5992,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"44ec71dc-5f42-4484-896e-0a0b18fe9a6a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:20:34","port":5500,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"dd16675e-2e00-4bfd-89dc-f8bd7c26d9c1","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:20:13","port":5977,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"3e9bb7f0-a5d6-426b-8fd9-3b0a91d34141","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:20:12","port":5973,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"2a2ad891-e6fe-4837-ab4e-94c7d5eaa3eb","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:20:10","port":6050,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"205e9189-b1d6-40f7-bb73-1cb913fd7b50","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:19:49","port":5986,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"431843f7-c428-4f03-8efd-640c8697dc33","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:18:59","port":5949,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"11e28d0d-f1e9-47f3-9de1-0fb9abab0cec","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:18:23","port":5948,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"b986c06b-48bd-46b5-8295-99257755a42d","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-18T13:17:50","port":5919,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"3ecb2cae-6834-427b-b02b-c6a390f5da98","seq":1,"duration_ms":101,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":151,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T14:02:33.498690+00:00"}