{"ip":"110.240.65.119","total_events":210,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["210 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 540,084 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look.","Held a session open for 263s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"540,084 bytes sent, longest session 263s","bytes_sent":540084,"session_seconds":263,"persistent":true}},"first_seen":"2026-08-08T16:56:11","last_seen":"2026-08-08T17:00:33","events_24h":0,"events_7d":210,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":210}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-08","count":210}],"recent_events":[{"timestamp":"2026-08-08T17:00:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001f\u0011.�8u\u0018�3","payload_hex":"1f112efa387518af33","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":210,"duration_ms":262717,"bytes_in":4906,"bytes_out":2940},{"timestamp":"2026-08-08T17:00:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000f���RI","payload_hex":"0fa8e9a85249","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":209,"duration_ms":262117,"bytes_in":4897,"bytes_out":2926},{"timestamp":"2026-08-08T17:00:32","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���\u0002�0=\u0004�9�9�","payload_hex":"84a0a802d9303d04d139cf39ff","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":208,"duration_ms":261553,"bytes_in":4891,"bytes_out":2912},{"timestamp":"2026-08-08T17:00:31","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000eS\u0003\u0010<�%","payload_hex":"0e5303103cc125","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":207,"duration_ms":260876,"bytes_in":4878,"bytes_out":2898},{"timestamp":"2026-08-08T17:00:31","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L1ӻʕUu�\u000e��W$~�-��","payload_hex":"4c31d3bbca955575970e98a057247ec22d9ab0","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":206,"duration_ms":260185,"bytes_in":4871,"bytes_out":2884},{"timestamp":"2026-08-08T17:00:30","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�$�B��^:u��P\u0015O","payload_hex":"b024d842959f5e3a75a7e750154f","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":205,"duration_ms":259647,"bytes_in":4852,"bytes_out":2870},{"timestamp":"2026-08-08T17:00:29","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�[J�KW��\u001b���`\f�\u0013�G�","payload_hex":"ea5b4aa04b57a1ea1b8c88e7600cdb13c77f47d9","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":204,"duration_ms":258809,"bytes_in":4838,"bytes_out":2856},{"timestamp":"2026-08-08T17:00:29","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��LZ+��\u0007_��F�(\u0017S&;p]���Z","payload_hex":"848c4c5a2baafc075f96d346f5281753263b705dfcb6ae5a","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":203,"duration_ms":258234,"bytes_in":4818,"bytes_out":2842,"enriched":{"digest":"e75375f050b748e3","strings":["S&;p]"]}},{"timestamp":"2026-08-08T17:00:28","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��@�>�K`M\u0000��}�\\\u0015\u001e","payload_hex":"d5ee40a03ee34b604d00e68c7dc15c151e","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":202,"duration_ms":257455,"bytes_in":4794,"bytes_out":2828},{"timestamp":"2026-08-08T17:00:27","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"m\u0007�Q�I�J","payload_hex":"6d07f4518949ff4a","method":"","user_agent":"","ja3":"","session":"6db4ec82-c4e2-46d5-9294-93529c94fd50","seq":201,"duration_ms":256672,"bytes_in":4777,"bytes_out":2814}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T16:54:27.784117+00:00"}