{"ip":"71.227.205.95","total_events":172,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"85+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 85 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,654 bytes sent","bytes_sent":7654,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-14T02:04:56","last_seen":"2026-08-14T17:28:48","events_24h":172,"events_7d":172,"geo":{"country_code":"US","country_name":"United States","region":"Washington","city":"Seattle","lat":47.6137,"lon":-122.3104,"asn":7922,"org":"Comcast Cable Communications, LLC"},"source_domain":"c-71-227-205-95.hsd1.wa.comcast.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7922","label":"Comcast","category":"isp","url":"https://www.peeringdb.com/asn/7922"},"cve_matches":[],"malware":[],"top_ports":[{"port":38866,"proto":"tcp","label":"","count":4},{"port":49389,"proto":"tcp","label":"","count":2},{"port":63548,"proto":"tcp","label":"","count":2},{"port":59583,"proto":"tcp","label":"","count":2},{"port":19212,"proto":"tcp","label":"","count":2},{"port":14382,"proto":"tcp","label":"","count":2},{"port":55056,"proto":"tcp","label":"","count":2},{"port":26835,"proto":"tcp","label":"","count":2},{"port":14185,"proto":"tcp","label":"","count":2},{"port":46648,"proto":"tcp","label":"","count":2},{"port":39768,"proto":"tcp","label":"","count":2},{"port":18894,"proto":"tcp","label":"","count":2},{"port":10852,"proto":"tcp","label":"","count":2},{"port":31779,"proto":"tcp","label":"","count":2},{"port":63244,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-14","count":172}],"recent_events":[{"timestamp":"2026-08-14T17:28:48","port":44189,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"404884b4-b277-4fbb-abc7-29c74a0d8729","seq":2,"duration_ms":374,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T17:28:48","port":44189,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>ac9d010100","method":"","user_agent":"","ja3":"","session":"404884b4-b277-4fbb-abc7-29c74a0d8729","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-14T17:11:07","port":39257,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"5c0a1282-b4db-47c2-acc6-12b73a41da52","seq":2,"duration_ms":373,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T17:11:07","port":39257,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>�Y\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>9959010100","method":"","user_agent":"","ja3":"","session":"5c0a1282-b4db-47c2-acc6-12b73a41da52","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"d344b3d9572f51c3","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-14T17:04:33","port":18894,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"86c0d6c0-52c4-43ba-a958-7a2495bd4ca2","seq":2,"duration_ms":375,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T17:04:33","port":18894,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>I�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>49ce010100","method":"","user_agent":"","ja3":"","session":"86c0d6c0-52c4-43ba-a958-7a2495bd4ca2","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"835c0d5eb911936d","strings":["<HONEYPOT>I"]}},{"timestamp":"2026-08-14T17:02:48","port":30312,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"e22045f1-ee4c-4486-9ee7-4219ab17ac0d","seq":2,"duration_ms":375,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T17:02:48","port":30312,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>vh\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>7668010100","method":"","user_agent":"","ja3":"","session":"e22045f1-ee4c-4486-9ee7-4219ab17ac0d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"9c473ac70197aad4","strings":["<HONEYPOT>vh"]}},{"timestamp":"2026-08-14T16:57:41","port":38683,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"8abf88b5-11c5-457f-9cf8-23ad5c157495","seq":2,"duration_ms":377,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T16:57:41","port":38683,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>�\u001b\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>971b010100","method":"","user_agent":"","ja3":"","session":"8abf88b5-11c5-457f-9cf8-23ad5c157495","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"4d784a8f4d9bdc05","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":85,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T17:51:15.140938+00:00"}