{"ip":"80.66.85.222","total_events":92,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"88+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 88 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,074 bytes sent","bytes_sent":3074,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-11T17:47:51","last_seen":"2026-09-22T17:59:50","events_24h":0,"events_7d":82,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":207957,"org":"Serv.host Group Ltd"},"source_domain":"lisduka.serv.host","known_scanners":[],"scanner_tag":{"key":"peeringdb:as207957","label":"SERV.HOST GROUP","category":"isp","url":"https://www.peeringdb.com/asn/207957"},"cve_matches":[],"malware":[],"top_ports":[{"port":6006,"proto":"tcp","label":"","count":2},{"port":6002,"proto":"tcp","label":"","count":2},{"port":6000,"proto":"tcp","label":"X11","count":2},{"port":6008,"proto":"tcp","label":"","count":2},{"port":5915,"proto":"tcp","label":"","count":1},{"port":5925,"proto":"tcp","label":"","count":1},{"port":5990,"proto":"tcp","label":"","count":1},{"port":5976,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":5945,"proto":"tcp","label":"","count":1},{"port":5958,"proto":"tcp","label":"","count":1},{"port":6005,"proto":"tcp","label":"","count":1},{"port":6022,"proto":"tcp","label":"","count":1},{"port":6653,"proto":"tcp","label":"","count":1},{"port":5939,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-11","count":1},{"date":"2026-09-03","count":9},{"date":"2026-09-22","count":82}],"recent_events":[{"timestamp":"2026-09-22T17:59:50","port":5921,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"383b7027-bcc8-4062-8aa0-5fca1c4369e0","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:57:49","port":5979,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"245fcd06-e3cf-47c4-9b08-d7c66d6727df","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:55:41","port":6262,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"3db9148c-1e27-4530-95f5-87c693d1b713","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:54:52","port":5957,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"65c509cc-a19c-418f-b863-b4a9bca11726","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:54:21","port":5998,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"6af7ba0a-bac5-4c74-ac17-90518ec6a15c","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:53:34","port":5990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"2108f70e-23a0-4d97-8e91-7cd28fee211a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:51:56","port":6060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"83963027-6666-408a-9552-9f80f5c1d9ad","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:51:32","port":5939,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"d577f732-a061-48df-ae3c-cf9835b0f12b","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:50:44","port":5935,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"0dcf4901-94d0-4bad-a2be-3aa91b869466","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}},{"timestamp":"2026-09-22T17:49:18","port":5915,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REDQ\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000","payload_hex":"52454451020000000200000012000000000000000100000000000000000012000000","method":"","user_agent":"","ja3":"","session":"5419184b-adf5-4027-81e2-c63894295268","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":12,"enriched":{"digest":"93b636be3908c40d","strings":["REDQ"]}}],"http_methods":[],"distinct_ports_total":88,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T14:28:13.667554+00:00"}