{"ip":"70.77.41.25","total_events":158,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"75+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 75 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,252 bytes sent","bytes_sent":4252,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-19T21:15:46","last_seen":"2026-09-10T21:11:20","events_24h":21,"events_7d":47,"geo":{"country_code":"CA","country_name":"Canada","region":"Alberta","city":"Calgary","lat":51.0207,"lon":-114.1011,"asn":6327,"org":"Shaw Communications"},"source_domain":"S01061036aaeffc1e.cg.shawcable.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as6327","label":"Shaw Cablesystems","category":"isp","url":"https://www.peeringdb.com/asn/6327"},"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":8},{"port":25569,"proto":"tcp","label":"","count":7},{"port":25556,"proto":"tcp","label":"","count":6},{"port":25574,"proto":"tcp","label":"","count":5},{"port":25560,"proto":"tcp","label":"","count":5},{"port":25562,"proto":"tcp","label":"","count":5},{"port":25567,"proto":"tcp","label":"","count":5},{"port":25573,"proto":"tcp","label":"","count":5},{"port":25564,"proto":"tcp","label":"","count":4},{"port":25586,"proto":"tcp","label":"","count":4},{"port":25571,"proto":"tcp","label":"","count":4},{"port":25580,"proto":"tcp","label":"","count":4},{"port":25583,"proto":"tcp","label":"","count":3},{"port":25568,"proto":"tcp","label":"","count":3},{"port":25566,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-19","count":14},{"date":"2026-08-23","count":8},{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":7},{"date":"2026-08-30","count":48},{"date":"2026-09-01","count":4},{"date":"2026-09-02","count":24},{"date":"2026-09-03","count":5},{"date":"2026-09-04","count":5},{"date":"2026-09-07","count":14},{"date":"2026-09-08","count":7},{"date":"2026-09-10","count":21}],"recent_events":[{"timestamp":"2026-09-10T21:11:20","port":25573,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e5010100","method":"","user_agent":"","ja3":"","session":"4f33cc8a-c72c-4a29-a592-a985621d5ab8","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T21:11:14","port":25586,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63f2010100","method":"","user_agent":"","ja3":"","session":"5605e295-4d48-4332-a6e6-d17caa0c7c5f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T21:11:08","port":25583,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63ef010100","method":"","user_agent":"","ja3":"","session":"015573f6-89ca-47c4-95e4-14f9f1915d5d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T20:14:15","port":25571,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63e3010100","method":"","user_agent":"","ja3":"","session":"8f1b9ce3-ed6f-4cb2-9e11-629996a6dba8","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T18:14:24","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"2e1d279e-6ce1-4817-a5fe-648e7519863b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T18:14:15","port":25579,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63eb010100","method":"","user_agent":"","ja3":"","session":"78bb8d35-a0d7-4658-85f9-13cb24bc3198","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T16:04:32","port":25573,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e5010100","method":"","user_agent":"","ja3":"","session":"ecb79aae-91ce-4126-9c2f-8fcc22af543d","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T16:04:21","port":25562,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63da010100","method":"","user_agent":"","ja3":"","session":"b8c02d41-27b4-416f-b175-95ea81029beb","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T16:04:18","port":25556,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d4010100","method":"","user_agent":"","ja3":"","session":"8b639354-cb51-45fc-96b5-023e4857d91a","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-10T10:31:56","port":25605,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>d\u0005\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>6405010100","method":"","user_agent":"","ja3":"","session":"b6380240-4b90-485c-9b21-7fbfa52319f0","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"54c2b0d055e47c2a","strings":["<HONEYPOT>d"]}}],"http_methods":[],"distinct_ports_total":75,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T23:03:44.738792+00:00"}