{"ip":"66.240.223.214","total_events":235,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"cybcube","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (cybcube).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,617 bytes sent","bytes_sent":11617,"session_seconds":2,"persistent":false}},"first_seen":"2026-08-25T19:22:14","last_seen":"2026-09-24T02:49:46","events_24h":2,"events_7d":19,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":10439,"org":"CariNet, Inc."},"source_domain":"pdcscan9.scanning.cybcube.com","known_scanners":["cybcube"],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":36},{"port":445,"proto":"tcp","label":"SMB","count":32},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":14},{"port":139,"proto":"tcp","label":"SMB","count":14},{"port":5432,"proto":"tcp","label":"Postgres","count":13},{"port":5900,"proto":"tcp","label":"VNC","count":12},{"port":502,"proto":"tcp","label":"","count":12},{"port":53,"proto":"tcp","label":"DNS","count":12},{"port":27017,"proto":"tcp","label":"MongoDB","count":11},{"port":1900,"proto":"tcp","label":"","count":11},{"port":1433,"proto":"tcp","label":"MSSQL","count":10},{"port":1521,"proto":"tcp","label":"Oracle","count":10},{"port":443,"proto":"tcp","label":"HTTPS","count":9},{"port":80,"proto":"tcp","label":"HTTP","count":8},{"port":9200,"proto":"tcp","label":"Elastic","count":7}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f","t12i130500_2d7513195f68_021165082e1c"],"tls_client_hello":"160301007b0100007703032112ef326bc13ebb664480f4a4428a1795c585cc02e27da1423e955cfef0bbbb00001ac02fc02bc011c007c013c009c014c00a0005002f0035c012000a01000034000500050100000000000a00080006001700180019000b00020100000d0010000e0401040302010203040105010601ff010001","tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"http_akin":[]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1177,"t12i130500_2d7513195f68_021165082e1c":45,"084386fa7ae5039bcf6f07298a05a227":434},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-25","count":3},{"date":"2026-08-26","count":5},{"date":"2026-08-27","count":36},{"date":"2026-08-28","count":16},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":8},{"date":"2026-09-02","count":12},{"date":"2026-09-04","count":5},{"date":"2026-09-05","count":11},{"date":"2026-09-07","count":4},{"date":"2026-09-08","count":32},{"date":"2026-09-09","count":29},{"date":"2026-09-14","count":3},{"date":"2026-09-15","count":30},{"date":"2026-09-16","count":20},{"date":"2026-09-21","count":7},{"date":"2026-09-22","count":10},{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T02:49:46","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000001843c8000000000000000000000000fffffffe00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"822b2a7e-47f4-4fd3-a534-de7b866ef101","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"a119cd236d404812","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-09-24T02:49:45","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0002","payload_hex":"00000066fe534d424000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000000000000000000000000000000000000000000000000000001002","method":"","user_agent":"","ja3":"","session":"2d718fcc-4cb6-461f-9025-59b43b411332","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":14,"enriched":{"digest":"042813e3ac56b4a4","strings":["SMB@"]}},{"timestamp":"2026-09-22T06:48:06","port":502,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"4173c2e3-7b70-49a0-93a9-d67cbb7ac3b9","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-22T05:20:59","port":5353,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"685064b1-59fb-439a-8c83-a590be2f1b8c","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-22T05:17:58","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0002","payload_hex":"00000066fe534d424000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000000000000000000000000000000000000000000000000000001002","method":"","user_agent":"","ja3":"","session":"01cc4298-5212-4646-9330-f192754d468d","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":14,"enriched":{"digest":"042813e3ac56b4a4","strings":["SMB@"]}},{"timestamp":"2026-09-22T05:17:58","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000001843c8000000000000000000000000fffffffe00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"76531e51-5276-437b-9e74-730bd3cd1102","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"a119cd236d404812","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-09-22T04:39:55","port":2869,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"38f83b9d-26b0-4b0f-82df-3594c79ae987","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-22T04:00:03","port":5900,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"fc3b6d72-a160-46e0-a066-ea3356c697cc","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-22T02:08:51","port":9300,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e7cfe58e-4ae8-4928-a446-edabb6270049","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-22T02:06:29","port":1900,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"ee6701ad-b18f-4c76-a1a2-3ec472c502a2","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14}],"http_methods":[{"method":"GET","count":24}],"distinct_ports_total":20,"top_paths":[{"path":"/","count":24,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T13:42:29.736783+00:00"}