{"ip":"68.1.120.91","total_events":11,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["11 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,408 bytes sent","bytes_sent":1408,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T09:09:10","last_seen":"2026-09-21T02:56:54","events_24h":0,"events_7d":1,"geo":{"country_code":"US","country_name":"United States","region":"Florida","city":"Pensacola","lat":30.4132,"lon":-87.3138,"asn":22773,"org":"Cox Communications Inc."},"source_domain":"ip68-1-120-91.pn.at.cox.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as22773","label":"Cox Communications","category":"isp","url":"https://www.peeringdb.com/asn/22773"},"cve_matches":[],"malware":[],"top_ports":[{"port":24224,"proto":"tcp","label":"","count":7},{"port":5555,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":2},{"date":"2026-08-30","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":3},{"date":"2026-09-11","count":1},{"date":"2026-09-16","count":1},{"date":"2026-09-21","count":1}],"recent_events":[{"timestamp":"2026-09-21T02:56:54","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"8e521e91-4c4f-40c3-b7d9-d03049f1e3ba","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}},{"timestamp":"2026-09-16T22:17:37","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"804822f3-1549-484c-bc2a-98f2c598d036","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}},{"timestamp":"2026-09-11T18:45:37","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"725e0bfe-7d71-4a26-8f33-2cd829d604d2","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}},{"timestamp":"2026-09-09T08:09:45","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"533e326a-edb9-4d92-a48f-e3bdd09022a4","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":11,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-09T06:23:31","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"b5da8b40-f3a0-49fa-808b-2c5986e95332","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":11,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-09T04:47:34","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"3dedf5b0-7cf0-4c81-862c-303a6e9e51c0","seq":1,"duration_ms":101,"bytes_in":310,"bytes_out":11,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-08T19:12:13","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"0330d74a-32b0-4dfc-a25f-e5db459525d4","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":11,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-09-03T04:47:57","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"91015372-4e12-4d6f-a4f5-4f25b53bc8d6","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}},{"timestamp":"2026-08-30T09:51:24","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"01ebe6d3-d5b2-4ca4-8278-d1de09552e6a","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}},{"timestamp":"2026-08-27T09:09:11","port":24224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0014��type�helo�options�","payload_hex":"0000001482a474797065a468656c6fa76f7074696f6e7380","method":"","user_agent":"","ja3":"","session":"77b63c4f-c6c8-428c-b739-29f0b7301bff","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"2d0a21825f837f7c","strings":["type","helo","options"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T14:47:20.456293+00:00"}