{"ip":"95.0.226.197","total_events":1182,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"288+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 288 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"55,554 bytes sent","bytes_sent":55554,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T17:11:22","last_seen":"2026-08-16T16:56:36","events_24h":0,"events_7d":1182,"geo":{"country_code":"TR","country_name":"Türkiye","region":"Istanbul","city":"Istanbul","lat":41.0108,"lon":28.9482,"asn":9121,"org":"Turk Telekom"},"source_domain":"95.0.226.197.static.ttnet.com.tr","known_scanners":[],"scanner_tag":{"key":"peeringdb:as9121","label":"Turk Telekom","category":"isp","url":"https://www.peeringdb.com/asn/9121"},"cve_matches":[],"malware":[],"top_ports":[{"port":2091,"proto":"tcp","label":"","count":16},{"port":11362,"proto":"tcp","label":"","count":15},{"port":50700,"proto":"tcp","label":"","count":12},{"port":21083,"proto":"tcp","label":"","count":12},{"port":25499,"proto":"tcp","label":"","count":12},{"port":61343,"proto":"tcp","label":"","count":12},{"port":37406,"proto":"tcp","label":"","count":12},{"port":61198,"proto":"tcp","label":"","count":12},{"port":56985,"proto":"tcp","label":"","count":12},{"port":32396,"proto":"tcp","label":"","count":12},{"port":26631,"proto":"tcp","label":"","count":12},{"port":27867,"proto":"tcp","label":"","count":10},{"port":41136,"proto":"tcp","label":"","count":10},{"port":17421,"proto":"tcp","label":"","count":10},{"port":11328,"proto":"tcp","label":"","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":377},{"date":"2026-08-16","count":805}],"recent_events":[{"timestamp":"2026-08-16T16:56:36","port":58947,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"f7d9d32a-5d47-46b4-ac54-61d6d62e977e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:54:44","port":20524,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"38e1ffd0-2e53-4382-b708-aff6d1ee31f6","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:47:53","port":34361,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"800ae9b3-6790-4391-91c2-e2724d68dada","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:38:58","port":23071,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"f55ce858-6601-47c7-88c7-ba943ab46b69","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:37:37","port":10987,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"a7ae8429-86cc-4ac1-a0d5-b88ae27f282f","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:37:37","port":10987,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6bbfd6d9-728e-43b6-83f4-820c9c916437","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:36:04","port":59102,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"3edd30c3-0259-4a97-bedc-3c6ae2b3759f","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:24:25","port":25499,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"39dd8213-c02a-4875-9921-b73a3237469d","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:24:25","port":25499,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"bfcffb18-ba04-422f-ba89-00fa879cc2c5","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-08-16T16:24:05","port":22083,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"94a15bd2-59df-41d1-a315-8742db351505","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12}],"http_methods":[],"distinct_ports_total":288,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T01:29:11.661439+00:00"}