{"ip":"104.152.52.130","total_events":707,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"internettl","confidence":"high","network_type":"non-profit"},"first_seen":"2026-02-22T03:31:16","last_seen":"2026-06-14T00:23:44","events_24h":0,"events_7d":65,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":14987,"org":"Rethem Hosting LLC"},"source_domain":"internettl.org","known_scanners":["internettl","Internettl Org"],"scanner_tag":{"key":"auto:internettl_org","label":"Internettl Org","category":"commercial","url":""},"cve_matches":[],"top_ports":[{"port":2695,"proto":"tcp","label":"","count":8},{"port":2774,"proto":"tcp","label":"","count":8},{"port":460,"proto":"tcp","label":"","count":8},{"port":8829,"proto":"tcp","label":"","count":8},{"port":3731,"proto":"tcp","label":"","count":7},{"port":6118,"proto":"tcp","label":"","count":6},{"port":133,"proto":"tcp","label":"","count":6},{"port":2248,"proto":"tcp","label":"","count":6},{"port":3308,"proto":"tcp","label":"","count":6},{"port":9222,"proto":"tcp","label":"","count":6},{"port":903,"proto":"tcp","label":"","count":6},{"port":2705,"proto":"tcp","label":"","count":6},{"port":2862,"proto":"tcp","label":"","count":6},{"port":6965,"proto":"tcp","label":"","count":6},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["po11nn0600_157369115bf8","ge11nn0400_17292dadbc7b","po11nn0400_52aeb37e206a"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":168,"po11nn0400_52aeb37e206a":108,"po11nn0600_157369115bf8":107,"ge11nn0400_17292dadbc7b":230},"user_agents":["Microsoft WinRM Client","curl/7.61.1"],"timeline":[{"date":"2026-03-22","count":38},{"date":"2026-03-29","count":80},{"date":"2026-04-05","count":65},{"date":"2026-04-07","count":1},{"date":"2026-04-12","count":38},{"date":"2026-04-19","count":96},{"date":"2026-04-26","count":42},{"date":"2026-05-03","count":17},{"date":"2026-05-24","count":19},{"date":"2026-05-31","count":32},{"date":"2026-06-06","count":10},{"date":"2026-06-10","count":1},{"date":"2026-06-11","count":12},{"date":"2026-06-12","count":31},{"date":"2026-06-13","count":6},{"date":"2026-06-14","count":15}],"recent_events":[{"timestamp":"2026-06-14T00:23:44","port":2990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:6ljaWhCU2tboPCQkLhkLhi0Zdxk=","ja3":"","session":"1fb47a9f-6676-45cf-a132-22e7c0a5b21f","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"78b192a6e74c8d8a","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-06-14T00:23:44","port":2653,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"AMQP\u0000\u0000\t\u0001","payload_hex":"414d515000000901","method":"","user_agent":"","community_id":"1:/I2eaS9b6UtPnjgCCjTes+O8SCo=","ja3":"","session":"eb35b3da-0e0b-406e-8d3d-5b9aaf2ef995","seq":1,"duration_ms":101,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"198c66d273332395","strings":["AMQP"]}},{"timestamp":"2026-06-14T00:23:43","port":2653,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:qN9bcc538OwTafO1G2OQMv/pdbs=","ja3":"","session":"ea62b6bf-b10f-47e7-85b6-1952b751468e","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"78b192a6e74c8d8a","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-06-14T00:23:35","port":662,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","community_id":"1:1w39O1cQ6QPpj0/maQqWlMLtAH0=","ja3":"","session":"3b4eafa6-2a94-48e2-b5e9-1a1977bc934d","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-06-14T00:23:35","port":848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:ibRD6LbOzof41IsduaURLOUHGAU=","ja3":"","session":"f058f75d-198e-43c6-9a18-c2f2bac91b02","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"78b192a6e74c8d8a","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-06-14T00:23:34","port":2883,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","community_id":"1:vxUhT5PwooZv5T1TEpH6PQH77jE=","ja3":"","session":"f86cc1f1-3df1-47cf-8cf6-af6b4e7b2a8c","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":14,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-06-14T00:23:31","port":2990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8\u001a#9�CXw-\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e381a2339984358772d0000000000","method":"","user_agent":"","community_id":"1:ZQHYQ3QdT72dW2EAyuEChgG+7KY=","ja3":"","session":"caf1616b-804a-4530-bb9f-1297b8a846ed","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"3e8f2a4e80ba98b3","strings":["CXw-"]}},{"timestamp":"2026-06-14T00:23:31","port":996,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\u001d\u0002\u0001\u0002w\u0018�\u00161.3.6.1.4.1.1466.20037","payload_hex":"301d02010277188016312e332e362e312e342e312e313436362e3230303337","method":"","user_agent":"","community_id":"1:vsTBu95y54s/NDw7Ta+ktm7tLqY=","ja3":"","session":"b3e585b2-5aa9-4668-a913-f7180daecee1","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"8c13a818a7042c2f","strings":["1.3.6.1.4.1.1466.20037"]}},{"timestamp":"2026-06-14T00:23:29","port":996,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","community_id":"1:yC92kjiZvt0fJSW/fJL7DBvJ1pI=","ja3":"","session":"b9f28d5b-1f4c-47bb-8ba0-2546aa7e6f91","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-06-14T00:23:21","port":2209,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","community_id":"1:NbE5x3HiR9BjO+OJjEllY6u5o7s=","ja3":"","session":"1b951359-6b2e-4975-999f-6d4669fa5742","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":14,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}}],"http_methods":[{"method":"GET","count":24},{"method":"POST","count":13}],"distinct_ports_total":327,"top_paths":[{"path":"/","count":19,"ports":19},{"path":"/wsman","count":13,"ports":7},{"path":"/get_info","count":5,"ports":5}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"localhost","count":7}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-06-15T15:41:59.351796+00:00"}