{"ip":"130.12.180.101","total_events":5575,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"263,631 bytes sent","bytes_sent":263631,"session_seconds":1,"persistent":false}},"first_seen":"2026-07-18T06:22:14","last_seen":"2026-09-10T22:15:30","events_24h":584,"events_7d":3409,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":57},{"port":3390,"proto":"tcp","label":"","count":57},{"port":3391,"proto":"tcp","label":"","count":48},{"port":3392,"proto":"tcp","label":"","count":47},{"port":3689,"proto":"tcp","label":"","count":13},{"port":3789,"proto":"tcp","label":"","count":13},{"port":2022,"proto":"tcp","label":"","count":11},{"port":2021,"proto":"tcp","label":"","count":10},{"port":1994,"proto":"tcp","label":"","count":10},{"port":2025,"proto":"tcp","label":"","count":10},{"port":2001,"proto":"tcp","label":"","count":9},{"port":3589,"proto":"tcp","label":"","count":9},{"port":3489,"proto":"tcp","label":"","count":9},{"port":443,"proto":"tcp","label":"HTTPS","count":9},{"port":1989,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"ja4h":["ge11nn0500_9af7e0472034"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":86,"ge11nn0500_9af7e0472034":719},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/91.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0","Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299","Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/604.1"],"timeline":[{"date":"2026-07-18","count":3},{"date":"2026-07-21","count":3},{"date":"2026-07-22","count":3},{"date":"2026-08-30","count":141},{"date":"2026-08-31","count":445},{"date":"2026-09-01","count":611},{"date":"2026-09-02","count":549},{"date":"2026-09-03","count":467},{"date":"2026-09-04","count":627},{"date":"2026-09-05","count":523},{"date":"2026-09-06","count":432},{"date":"2026-09-07","count":350},{"date":"2026-09-08","count":175},{"date":"2026-09-09","count":716},{"date":"2026-09-10","count":530}],"recent_events":[{"timestamp":"2026-09-10T22:15:30","port":8318,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e5e20096-e193-44ee-a17a-5d2d18921b8c","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:15:05","port":189,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"28c0a609-bf76-4331-aa57-c710260ebb99","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:14:34","port":46005,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"c3c7179f-edb2-46c6-916a-d41ff7002655","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:14:31","port":8079,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e05041b8-32ad-4d23-9690-738f903c806a","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:13:36","port":3015,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"b4cf0132-8ba8-44c8-891b-c3c61ce04d58","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:12:40","port":7489,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"38af6a10-b89f-4730-a3ec-7fd9c5b0297e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:09:15","port":53262,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"d3394898-9407-4e81-8af6-12ea76472ade","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:08:30","port":12,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"fadce8ae-23a7-4a41-8e2c-1bd34e863d7c","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:05:21","port":42496,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"5b49eaa9-3da3-4bca-a5b4-0415b862a95f","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-09-10T22:01:47","port":52035,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"75b0c324-ec87-45a0-bdca-db3fe4d0da35","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}}],"http_methods":[{"method":"GET","count":9}],"distinct_ports_total":1451,"top_paths":[{"path":"/.env","count":9,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T22:16:10.349473+00:00"}