{"ip":"103.9.204.206","data_as_of":"2026-10-24T22:57:47+00:00","observed":true,"total_events":142,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["142 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"258 bytes sent","bytes_sent":258,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-02-24T05:27:14","last_seen":"2026-10-20T10:07:32","events_24h":0,"events_7d":2,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"VN","country_name":"Vietnam","region":"","city":"","lat":16.1667,"lon":107.8333,"asn":135905,"org":"VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":12345,"proto":"tcp","label":"","count":24},{"port":15063,"proto":"tcp","label":"","count":24},{"port":8047,"proto":"tcp","label":"","count":22},{"port":20054,"proto":"tcp","label":"","count":22},{"port":20098,"proto":"tcp","label":"","count":22},{"port":8044,"proto":"tcp","label":"","count":22},{"port":3389,"proto":"tcp","label":"RDP","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-13","count":2},{"date":"2026-10-17","count":2},{"date":"2026-10-20","count":2}],"recent_events":[{"timestamp":"2026-10-20T10:07:32","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"466909dc-4cb7-419b-ae45-943754806a52","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-10-20T09:57:52","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"cd57d1ea-ac95-4847-bb25-fa34e8ea27e3","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-10-17T20:34:17","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"30c78336-b3d8-427e-9e49-fe008ab55175","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-10-17T20:08:28","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"24f55e12-0c3d-4b07-98c2-c81aa8e67d18","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-10-13T17:59:57","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"57848ab1-1bba-44dd-8dfe-8f28cdbac4fb","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-10-13T17:21:36","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"bb5efdcb-0d18-4098-a153-4dd63ad20cf8","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":13,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-03-12T22:37:25","port":15063,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT api4.my-ip.io:443 HTTP/1.1\r\nProxy-Authorization: Basic c3VwcG9ydDgyOnBSQkNHQXF0\r\n\r\n","payload_hex":"434f4e4e45435420617069342e6d792d69702e696f3a34343320485454502f312e310d0a50726f78792d417574686f72697a6174696f6e3a204261736963206333567763473979644467794f6e4253516b4e48515846300d0a0d0a","method":"","user_agent":"","ja3":"","session":"8ca97438-1aa6-4145-801f-261c194576f9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3f542467205bc338","strings":["ONNECT api4.my-ip.io:443 HTTP/1.1","Proxy-Authorization: Basic c3VwcG9ydDgyOnBSQkNHQXF0"],"iocs":{"domains":["api4.my-ip.io"]}}},{"timestamp":"2026-03-12T22:37:19","port":15063,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET http://v4.ipv6-test.com/json/widgetdata.php?callback=? HTTP/1.1\r\n","payload_hex":"455420687474703a2f2f76342e697076362d746573742e636f6d2f6a736f6e2f776964676574646174612e7068703f63616c6c6261636b3d3f20485454502f312e310d0a","method":"","user_agent":"","ja3":"","session":"9cd1b1dc-e09f-4814-9f0d-cb071c334e05","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3882d1c0bbe85b95","strings":["ET http://v4.ipv6-test.com/json/widgetdata.php?callback=? HTTP/1.1"],"iocs":{"urls":["http://v4.ipv6-test.com/json/widgetdata.php?callback=?"],"domains":["v4.ipv6-test.com"],"paths":["/v4.ipv6-test.com/json/widgetdata.php"]}}},{"timestamp":"2026-03-12T22:37:19","port":15063,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: v4.ipv6-test.com\r\nProxy-Connection: keep-alive\r\nProxy-Authorization: Basic c3VwcG9ydDgyOnBSQkNHQXF0\r\nAccept-Encoding: gzip,deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36\r\n\r\n","payload_hex":"486f73743a2076342e697076362d746573742e636f6d0d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206333567763473979644467794f6e4253516b4e48515846300d0a4163636570742d456e636f64696e673a20677a69702c6465666c6174650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232362e30205361666172692f3533372e33360d0a0d0a","method":"","user_agent":"","ja3":"","session":"9cd1b1dc-e09f-4814-9f0d-cb071c334e05","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aedea1de0415ef1d","strings":["Host: v4.ipv6-test.com","Proxy-Connection: keep-alive","Proxy-Authorization: Basic c3VwcG9ydDgyOnBSQkNHQXF0","Accept-Encoding: gzip,deflate","User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) …"],"iocs":{"domains":["v4.ipv6-test.com"]}}},{"timestamp":"2026-03-12T22:37:19","port":15063,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"9cd1b1dc-e09f-4814-9f0d-cb071c334e05","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[],"distinct_ports_total":7,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}