{"ip":"138.124.31.169","total_events":190,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"25+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 25 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,375 bytes sent","bytes_sent":2375,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-09T03:30:30","last_seen":"2026-09-11T08:42:07","events_24h":13,"events_7d":30,"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":41745,"org":"Baykov Ilya Sergeevich"},"source_domain":"mail.exemple.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":126},{"port":3390,"proto":"tcp","label":"","count":11},{"port":33389,"proto":"tcp","label":"","count":8},{"port":8081,"proto":"tcp","label":"","count":5},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4},{"port":3391,"proto":"tcp","label":"","count":4},{"port":4145,"proto":"tcp","label":"","count":3},{"port":82,"proto":"tcp","label":"","count":3},{"port":5678,"proto":"tcp","label":"","count":3},{"port":8181,"proto":"tcp","label":"","count":3},{"port":1081,"proto":"tcp","label":"","count":2},{"port":33391,"proto":"tcp","label":"","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":33891,"proto":"tcp","label":"","count":2},{"port":3392,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-20","count":2},{"date":"2026-06-23","count":3},{"date":"2026-06-30","count":2},{"date":"2026-07-03","count":2},{"date":"2026-07-09","count":2},{"date":"2026-07-10","count":2},{"date":"2026-07-15","count":1},{"date":"2026-07-18","count":2},{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":2},{"date":"2026-07-23","count":2},{"date":"2026-07-30","count":2},{"date":"2026-08-07","count":2},{"date":"2026-08-14","count":2},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":4},{"date":"2026-08-17","count":4},{"date":"2026-08-18","count":8},{"date":"2026-08-19","count":2},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":4},{"date":"2026-08-22","count":1},{"date":"2026-08-23","count":4},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":4},{"date":"2026-08-26","count":4},{"date":"2026-08-27","count":2},{"date":"2026-08-28","count":8},{"date":"2026-08-29","count":4},{"date":"2026-08-30","count":4},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":4},{"date":"2026-09-03","count":1},{"date":"2026-09-05","count":4},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":4},{"date":"2026-09-08","count":4},{"date":"2026-09-10","count":14},{"date":"2026-09-11","count":2}],"recent_events":[{"timestamp":"2026-09-11T08:42:07","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9f533741-ff23-4b4d-b17a-c8fcc3249488","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-11T08:03:16","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"a91584b8-7afc-48b9-86ec-3712d8960ab9","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T22:05:28","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"70d6e82d-680e-4dac-9ceb-83749d66739d","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T21:51:24","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"25c232c6-bf5e-4459-a969-b57cfa55e712","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T17:24:55","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"5809bfd9-0f6b-4a7d-8942-c988d46245a3","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T17:17:19","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"338346be-f667-4d1c-a642-e5ef3f2b6222","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T16:57:50","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"6d18c26c-7226-4fce-96a5-bdcd77b7c025","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T15:52:15","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"6e194906-de14-4e5f-81d3-eac706ea57b3","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T15:24:47","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"e4dde060-a0db-473f-80df-a2e119b6feaf","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T14:50:26","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"5797ab08-d7db-4fc4-9bac-927ca818b24b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}}],"http_methods":[],"distinct_ports_total":25,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T09:52:43.751692+00:00"}