{"ip":"70.74.220.158","total_events":316,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"103+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 103 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,505 bytes sent","bytes_sent":8505,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T03:27:33","last_seen":"2026-09-10T21:11:13","events_24h":47,"events_7d":191,"geo":{"country_code":"CA","country_name":"Canada","region":"Alberta","city":"Edmonton","lat":53.5534,"lon":-113.4982,"asn":6327,"org":"Shaw Communications"},"source_domain":"S010600cb7a043b6c.ed.shawcable.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as6327","label":"Shaw Cablesystems","category":"isp","url":"https://www.peeringdb.com/asn/6327"},"cve_matches":[],"malware":[],"top_ports":[{"port":25568,"proto":"tcp","label":"","count":15},{"port":25570,"proto":"tcp","label":"","count":14},{"port":25571,"proto":"tcp","label":"","count":12},{"port":25569,"proto":"tcp","label":"","count":11},{"port":25558,"proto":"tcp","label":"","count":10},{"port":25564,"proto":"tcp","label":"","count":10},{"port":25580,"proto":"tcp","label":"","count":9},{"port":25566,"proto":"tcp","label":"","count":9},{"port":25574,"proto":"tcp","label":"","count":9},{"port":25581,"proto":"tcp","label":"","count":8},{"port":25565,"proto":"tcp","label":"Minecraft","count":8},{"port":25572,"proto":"tcp","label":"","count":8},{"port":25563,"proto":"tcp","label":"","count":8},{"port":25556,"proto":"tcp","label":"","count":8},{"port":25553,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-30","count":16},{"date":"2026-08-31","count":27},{"date":"2026-09-01","count":27},{"date":"2026-09-02","count":32},{"date":"2026-09-03","count":23},{"date":"2026-09-04","count":20},{"date":"2026-09-05","count":30},{"date":"2026-09-06","count":30},{"date":"2026-09-07","count":22},{"date":"2026-09-08","count":18},{"date":"2026-09-09","count":25},{"date":"2026-09-10","count":46}],"recent_events":[{"timestamp":"2026-09-10T21:11:13","port":25572,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e4010100","method":"","user_agent":"","ja3":"","session":"6caaa2d6-68af-4a1b-8946-2b2b61bf9098","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T21:11:13","port":25569,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e1010100","method":"","user_agent":"","ja3":"","session":"4f2d52cb-568f-4956-91d5-4fdb81cd9cd0","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T21:11:13","port":25584,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63f0010100","method":"","user_agent":"","ja3":"","session":"d2d9a897-a0ac-4793-ac0b-740d44e1c3c5","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T20:19:58","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"24d40552-e120-4e74-b3a6-f52b7bce94e7","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T18:14:16","port":25558,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d6010100","method":"","user_agent":"","ja3":"","session":"eba22df0-45a6-45c3-8152-8e8ef24a6808","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T18:14:10","port":25581,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63ed010100","method":"","user_agent":"","ja3":"","session":"3a900709-f013-4ebd-8815-80c3043eed24","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T18:14:09","port":56593,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>�\u0011\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>dd11010100","method":"","user_agent":"","ja3":"","session":"bf927850-3d1a-4f16-9a73-9e1f983446f6","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"727ad6ba78175a80","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-10T16:51:55","port":41877,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>a395010100","method":"","user_agent":"","ja3":"","session":"f1a67c59-f901-4515-92f2-d6283a57f49e","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-10T16:47:58","port":25572,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e4010100","method":"","user_agent":"","ja3":"","session":"a8b79c60-d509-468f-90ec-509ac72c57f4","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T16:04:23","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e0010100","method":"","user_agent":"","ja3":"","session":"0d4053c8-92c3-4fcc-8855-5c46b1a529c6","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":103,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T23:04:08.193540+00:00"}