{"ip":"90.21.130.216","total_events":298,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"140+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 140 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"13,261 bytes sent","bytes_sent":13261,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-25T21:56:24","last_seen":"2026-08-15T02:20:21","events_24h":0,"events_7d":44,"geo":{"country_code":"FR","country_name":"France","region":"Bourgogne","city":"Dijon","lat":47.3167,"lon":5.0139,"asn":3215,"org":"Orange"},"source_domain":"aorleans-159-1-25-216.w90-21.abo.wanadoo.fr","known_scanners":[],"scanner_tag":{"key":"peeringdb:as3215","label":"Orange France","category":"isp","url":"https://www.peeringdb.com/asn/3215"},"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":16},{"port":9025,"proto":"tcp","label":"","count":4},{"port":25690,"proto":"tcp","label":"","count":4},{"port":22269,"proto":"tcp","label":"","count":2},{"port":52446,"proto":"tcp","label":"","count":2},{"port":27566,"proto":"tcp","label":"","count":2},{"port":19541,"proto":"tcp","label":"","count":2},{"port":49389,"proto":"tcp","label":"","count":2},{"port":60495,"proto":"tcp","label":"","count":2},{"port":9135,"proto":"tcp","label":"","count":2},{"port":64245,"proto":"tcp","label":"","count":2},{"port":12739,"proto":"tcp","label":"","count":2},{"port":48664,"proto":"tcp","label":"","count":2},{"port":25720,"proto":"tcp","label":"","count":2},{"port":49279,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-25","count":46},{"date":"2026-06-26","count":208},{"date":"2026-08-14","count":42},{"date":"2026-08-15","count":2}],"recent_events":[{"timestamp":"2026-08-15T02:20:21","port":51799,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"23b97b98-8830-4d3d-a210-813b5bf2a131","seq":2,"duration_ms":224,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-15T02:20:21","port":51799,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>�W\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>ca57010100","method":"","user_agent":"","ja3":"","session":"23b97b98-8830-4d3d-a210-813b5bf2a131","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"59d454a693c618eb","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-14T22:47:46","port":18873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"0dd07761-0cdf-4586-b310-14444a6ffa82","seq":2,"duration_ms":224,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T22:47:46","port":18873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>I�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>49b9010100","method":"","user_agent":"","ja3":"","session":"0dd07761-0cdf-4586-b310-14444a6ffa82","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"835c0d5eb911936d","strings":["<HONEYPOT>I"]}},{"timestamp":"2026-08-14T22:27:10","port":60495,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"2195828f-e99c-47c6-b8b2-be4ecd357428","seq":2,"duration_ms":228,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T22:27:10","port":60495,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>�O\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>ec4f010100","method":"","user_agent":"","ja3":"","session":"2195828f-e99c-47c6-b8b2-be4ecd357428","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8a189e9eab14c233","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-14T21:58:35","port":63455,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"0a9ec9c0-08f6-4d7d-9b00-6a9ccfd6572c","seq":2,"duration_ms":226,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T21:58:35","port":63455,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>f7df010100","method":"","user_agent":"","ja3":"","session":"0a9ec9c0-08f6-4d7d-9b00-6a9ccfd6572c","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}},{"timestamp":"2026-08-14T21:35:08","port":47807,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001�\u0000\u000b\u0000M\u0000C\u0000|\u0000P\u0000i\u0000n\u0000g\u0000H\u0000o\u0000s\u0000t\u0007J\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"fe01fa000b004d0043007c00500069006e00670048006f00730074074a000000000000","method":"","user_agent":"","ja3":"","session":"fc84a329-a33f-4b96-8a38-9cdaa777af56","seq":2,"duration_ms":225,"bytes_in":62,"bytes_out":26,"enriched":{"digest":"c7a70cbf16cd2d3a","strings":["MC|PingHost"]}},{"timestamp":"2026-08-14T21:35:07","port":47807,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>��\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>babf010100","method":"","user_agent":"","ja3":"","session":"fc84a329-a33f-4b96-8a38-9cdaa777af56","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8ce60f21774fbcbf","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":140,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T00:32:41.454556+00:00"}