{"ip":"77.239.124.141","data_as_of":"2026-10-26T23:40:08+00:00","observed":true,"total_events":6797,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12806+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 12806 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 6,904 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"698,826 bytes sent","bytes_sent":698826,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-26T16:56:27","last_seen":"2026-10-26T21:46:43","events_24h":6797,"events_7d":6797,"interactive_sessions":6904,"interactive_sessions_24h":6904,"interactive_sessions_7d":6904,"interactive_protocols":[{"protocol":"adb","sessions":6776},{"protocol":"socks5","sessions":3},{"protocol":"telnet","sessions":1},{"protocol":"dns","sessions":1},{"protocol":"http","sessions":1},{"protocol":"pcworx","sessions":1},{"protocol":"s7comm","sessions":1},{"protocol":"atg","sessions":1},{"protocol":"sunrpc","sessions":1},{"protocol":"dvrip","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":6904,"first_seen":"2026-10-26T16:56:39","last_seen":"2026-10-26T21:46:43","verdicts":[{"verdict":"scan","sessions":6787},{"verdict":"unknown","sessions":117}],"personas":[{"persona":"adb@Android 9 TV box","sessions":6775},{"persona":"proxy@squid/4.13","sessions":3},{"persona":"ics@Schneider Modicon M340","sessions":2},{"persona":"atg@Veeder-Root TLS-350R","sessions":1},{"persona":"linux-ubuntu@24.04","sessions":1},{"persona":"nfs@nfs-kernel-server 2.6.1","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1},{"persona":"dns@BIND 9.18.28-0ubuntu0.24.04.1","sessions":1},{"persona":"rtsp@GStreamer RTSP server","sessions":1}],"services":[{"protocol":"adb","port":62838,"sessions":4},{"protocol":"adb","port":57262,"sessions":3},{"protocol":"tcp","port":39368,"sessions":3},{"protocol":"tcp","port":45144,"sessions":3},{"protocol":"adb","port":19934,"sessions":3},{"protocol":"tcp","port":50253,"sessions":3},{"protocol":"tcp","port":17089,"sessions":3},{"protocol":"adb","port":26414,"sessions":3},{"protocol":"adb","port":45236,"sessions":3},{"protocol":"adb","port":43587,"sessions":3},{"protocol":"tcp","port":42950,"sessions":3},{"protocol":"adb","port":26291,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"5dbad7dd0b9b122dcd9956884390f4aac4738caba8ff53498a7ab6718b176c30","name":"shell-1","size":11,"mime_type":"text/plain","kind":"adb-command","times":6774,"first_seen":"2026-10-26T16:56:37","last_seen":"2026-10-26T21:46:41","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":6787}]},"top_ports":[{"port":54875,"proto":"tcp","label":"","count":5,"sessions":0},{"port":6703,"proto":"tcp","label":"","count":4,"sessions":0},{"port":63793,"proto":"tcp","label":"","count":4,"sessions":0},{"port":64330,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":62838,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":58136,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":57262,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":54767,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":54209,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":50253,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":49099,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":45969,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":45236,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":45144,"proto":"tcp","label":"ADB","count":0,"sessions":4},{"port":43587,"proto":"tcp","label":"ADB","count":0,"sessions":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-26","count":6797,"sessions":6904}],"recent_events":[{"timestamp":"2026-10-26T21:46:42","port":62613,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"24e41b1b-cd2f-4df5-9f22-a0ae7880be50","seq":1,"duration_ms":101,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:39","port":20110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"106f645b-fa41-4e3c-a705-95a4eefae979","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:38","port":27045,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"0ec49c76-02d5-4b0c-b522-189b0e57e9d7","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:34","port":47315,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"4bea34f5-3e4f-4423-bbf0-c9596db6f249","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:30","port":8962,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"bd6c2067-3f3a-47d5-bd80-034ae9fc0ae0","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:26","port":499,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"686f7264-60e0-4543-b847-5444d2050027","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:23","port":4513,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"26aada16-0efd-4c3c-b647-dbd47b5168e3","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:21","port":44789,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"0bc9b7d0-bed8-4a91-899b-fb7b74c87db3","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:13","port":25376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"d1a4a9ea-3565-408c-9a33-a9a733bee5e6","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T21:46:13","port":22356,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"451b74c4-b9d1-4096-ad04-4deda6559750","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}}],"http_methods":[],"distinct_ports_total":12806,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}