{"ip":"104.152.52.135","total_events":635,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"internettl","confidence":"high","network_type":"non-profit"},"first_seen":"2026-02-22T03:31:16","last_seen":"2026-06-14T07:01:59","events_24h":0,"events_7d":76,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":14987,"org":"Rethem Hosting LLC"},"source_domain":"internettl.org","known_scanners":["internettl","Internettl Org"],"scanner_tag":{"key":"auto:internettl_org","label":"Internettl Org","category":"commercial","url":""},"cve_matches":[],"top_ports":[{"port":330,"proto":"tcp","label":"","count":9},{"port":3731,"proto":"tcp","label":"","count":6},{"port":2462,"proto":"tcp","label":"","count":6},{"port":3248,"proto":"tcp","label":"","count":6},{"port":6937,"proto":"tcp","label":"","count":6},{"port":352,"proto":"tcp","label":"","count":6},{"port":2300,"proto":"tcp","label":"","count":6},{"port":9199,"proto":"tcp","label":"","count":6},{"port":8205,"proto":"tcp","label":"","count":6},{"port":6196,"proto":"tcp","label":"","count":5},{"port":23,"proto":"tcp","label":"Telnet","count":5},{"port":6423,"proto":"tcp","label":"","count":4},{"port":6168,"proto":"tcp","label":"","count":4},{"port":226,"proto":"tcp","label":"","count":4},{"port":906,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["po11nn0600_157369115bf8","ge11nn0400_17292dadbc7b","po11nn0400_52aeb37e206a"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":168,"po11nn0400_52aeb37e206a":108,"po11nn0600_157369115bf8":107,"ge11nn0400_17292dadbc7b":230},"user_agents":["Microsoft WinRM Client","curl/7.61.1"],"timeline":[{"date":"2026-03-22","count":11},{"date":"2026-03-29","count":71},{"date":"2026-04-05","count":82},{"date":"2026-04-12","count":32},{"date":"2026-04-19","count":66},{"date":"2026-04-26","count":26},{"date":"2026-05-02","count":1},{"date":"2026-05-03","count":20},{"date":"2026-05-24","count":18},{"date":"2026-05-31","count":34},{"date":"2026-06-06","count":10},{"date":"2026-06-07","count":3},{"date":"2026-06-11","count":20},{"date":"2026-06-12","count":23},{"date":"2026-06-13","count":6},{"date":"2026-06-14","count":27}],"recent_events":[{"timestamp":"2026-06-14T07:01:59","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0000�\u0000�","payload_hex":"0000000800ff00ff","method":"","user_agent":"","community_id":"1:2/El7Mr2A9ESSf65MM8qRSaE5As=","ja3":"","session":"80c9d94d-de53-42d3-be78-0d118aafedf7","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":7},{"timestamp":"2026-06-14T07:01:57","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","community_id":"1:Tt7KqFK4WezPcLU6b2cb2FFd+C8=","ja3":"","session":"eb1954ff-9183-4fa1-b70e-bd55c6f467c1","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":12},{"timestamp":"2026-06-14T00:23:47","port":2,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:w7Xd3DBzxuZgT9sVwCXF4Aur9cE=","ja3":"","session":"9857483b-7600-4307-9e09-e325d2726870","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"78b192a6e74c8d8a","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-06-14T00:23:39","port":2988,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000$0Ο@�\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000��-j\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\t\u0007>\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000b�\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u001e�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0014\u0017�AF�J�\u0001\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e0000000000560000002430ce9f409c000001000000000000008bf42d6a0000000001000000000000000509073e0000000000000000000000000bac0100000000000000c0a81ec1000000000000000000000000ebb11417c44146bb4ae3010000000000","method":"","user_agent":"","community_id":"1:FYdEErk1XXZUB29cpG4Tm2ihpLQ=","ja3":"","session":"f1007fde-c3fd-4342-b228-6a8950adb3d2","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":14,"enriched":{"digest":"2ad25ff63c75ab3c","strings":["version","versionV$0"]}},{"timestamp":"2026-06-14T00:23:39","port":2883,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\u001d\u0002\u0001\u0002w\u0018�\u00161.3.6.1.4.1.1466.20037","payload_hex":"301d02010277188016312e332e362e312e342e312e313436362e3230303337","method":"","user_agent":"","community_id":"1:yzl0ExPgxRx3bY9SQQRfXejHNfg=","ja3":"","session":"c51455a3-68d2-4b34-98f5-2cc03e3cefc7","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"8c13a818a7042c2f","strings":["1.3.6.1.4.1.1466.20037"]}},{"timestamp":"2026-06-14T00:23:38","port":2593,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000j�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0002\u0010\u0002\u0000\u0003","payload_hex":"0000006afe534d42400001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240003000100000000000000000000000000000000000000000000000000000000000000020210020003","method":"","user_agent":"","community_id":"1:uwbsLVV49EhEV2x9tI0pktMICbM=","ja3":"","session":"957530fd-c3ae-4b11-8c44-b50f96e4249a","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":14,"enriched":{"digest":"aa51c319bd64ddfa","strings":["SMB@"]}},{"timestamp":"2026-06-14T00:23:38","port":2883,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","community_id":"1:JYwLrX9cJJJsfm3VPDRCYXPKa7s=","ja3":"","session":"306158c5-7634-4319-a506-3dedcda26612","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-06-14T00:23:36","port":728,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a0000000000000000000000000000000034e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:s7C6nIi/8iosb/mD9lyPFNHhzvc=","ja3":"","session":"47e2fb54-1ebd-4b72-b123-21900f51312e","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"78b192a6e74c8d8a","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-06-14T00:23:34","port":2026,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","community_id":"1:oV5RqR2lyowa3088v3Cn4OjAjTI=","ja3":"","session":"f38c85f9-12e9-4936-b791-706b5f980c4c","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-06-14T00:23:30","port":2883,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0000�\u0000�","payload_hex":"0000000800ff00ff","method":"","user_agent":"","community_id":"1:yZFHbESx7X7TLE3zeOKYMy1ItPY=","ja3":"","session":"2dbdffe5-27be-4576-a34c-027894139fe2","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":14}],"http_methods":[{"method":"GET","count":22},{"method":"POST","count":6}],"distinct_ports_total":307,"top_paths":[{"path":"/","count":20,"ports":20},{"path":"/wsman","count":6,"ports":3},{"path":"/get_info","count":2,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"localhost","count":3}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-06-15T15:42:31.306475+00:00"}