{"ip":"99.78.90.172","total_events":17,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["17 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,270 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,270 bytes sent","bytes_sent":5270,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-13T15:58:50","last_seen":"2026-08-14T00:30:02","events_24h":0,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Texas City","lat":29.397,"lon":-94.9203,"asn":7018,"org":"AT&T Enterprises, LLC"},"source_domain":"99-78-90-172.lightspeed.hstntx.sbcglobal.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7018","label":"AT&T US - 7018","category":"isp","url":"https://www.peeringdb.com/asn/7018"},"cve_matches":[],"malware":[],"top_ports":[{"port":5555,"proto":"tcp","label":"","count":17}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-13","count":16},{"date":"2026-08-14","count":1}],"recent_events":[{"timestamp":"2026-08-14T00:30:02","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"667b08ec-45b8-485f-acce-8ed4352a75a2","seq":1,"duration_ms":101,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T23:26:22","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"224eea07-ea8c-4d15-9d1d-c122274d16d9","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T22:37:23","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"99d4e894-9e0a-48c5-9224-343e9c8029f6","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T21:50:34","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"c1992d1f-7ae2-48e8-bffb-bf4c4df7eba7","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T21:10:19","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"4a1eceb9-f882-4b5c-b0cc-57058c5f2735","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T20:33:41","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"08e61ee5-3e2d-46ae-92ca-07c45a7bc420","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T19:58:11","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"3fcb8ba2-3766-4c36-884d-e5335ca0a5c5","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T19:22:05","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"1755b2f7-93c2-4389-8632-ac272c352aa0","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T18:51:10","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"2cd49db3-d56f-4ea2-a46d-66425b3c0925","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}},{"timestamp":"2026-08-13T18:51:10","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000\u001e\u0001\u0000\u0000\u001dp\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,devicetracker_proto_format,devraw,app_info,server_status,track_mdns","payload_hex":"434e584e01000001000010001e0100001d700000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c646576696365747261636b65725f70726f746f5f666f726d61742c6465767261772c6170705f696e666f2c7365727665725f7374617475732c747261636b5f6d646e73","method":"","user_agent":"","ja3":"","session":"2cd49db3-d56f-4ea2-a46d-66425b3c0925","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":12,"enriched":{"digest":"44ade21a2d385f68","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:22:17.369197+00:00"}