{"ip":"144.64.58.185","total_events":7897,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"7,897 events across 1 port(s)","confidence":"high","network_type":null,"why":["7,897 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 1567s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"476,528,335 bytes sent, longest session 1567s","bytes_sent":476528335,"session_seconds":1567,"persistent":true}},"first_seen":"2026-08-17T05:16:00","last_seen":"2026-08-17T05:42:07","events_24h":0,"events_7d":7897,"geo":{"country_code":"PT","country_name":"Portugal","region":"Santarém","city":"Abrantes","lat":39.4671,"lon":-8.1948,"asn":3243,"org":"Servicos De Comunicacoes E Multimedia S.A."},"source_domain":"bl23-58-185.dsl.telepac.pt","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":7897}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-17","count":7897}],"recent_events":[{"timestamp":"2026-08-17T05:42:07","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"g�pg��","payload_hex":"67907067baa1","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7785,"duration_ms":1566625,"bytes_in":121004,"bytes_out":101189},{"timestamp":"2026-08-17T05:42:07","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006,�\u001bn8v\u001f����","payload_hex":"062c8f1b6e38761fb1daf78e","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7784,"duration_ms":1566431,"bytes_in":120998,"bytes_out":101176},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�BT-\u0000�\u0016�!\n �/\u001a","payload_hex":"ac42542d00b516e9210a20ca2f1a","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7783,"duration_ms":1566300,"bytes_in":120986,"bytes_out":101163},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�<���","payload_hex":"a13caad1ea","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7782,"duration_ms":1566067,"bytes_in":120972,"bytes_out":101150},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012M�:��s�#���","payload_hex":"124df93a9ab673b323a6b1ce","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7781,"duration_ms":1565847,"bytes_in":120967,"bytes_out":101137},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018zܵ���2ۄ\u0003\u0003!:_!�","payload_hex":"187adcb58fe68632db847f0303213a5f21c7","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7780,"duration_ms":1565745,"bytes_in":120955,"bytes_out":101124},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Ǽ�\u0018�c�\u0001�۞D�","payload_hex":"f8c7bcfa18bd63b101eedb9e4497","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7779,"duration_ms":1565641,"bytes_in":120937,"bytes_out":101111},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001bۤ'=�ȳ�ZGu��N\b","payload_hex":"1bdba4273da2c8b3c55a4775d7c54e08","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7778,"duration_ms":1565493,"bytes_in":120923,"bytes_out":101098},{"timestamp":"2026-08-17T05:42:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0015�\u000e��XkϽ","payload_hex":"ed8a158e0e98fe586bcfbd","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7777,"duration_ms":1565390,"bytes_in":120907,"bytes_out":101085},{"timestamp":"2026-08-17T05:42:05","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"i��uq�o","payload_hex":"69fc957571d86f","method":"","user_agent":"","ja3":"","session":"7c73a702-399a-452a-8ffb-0e4bccf22a5b","seq":7776,"duration_ms":1565146,"bytes_in":120896,"bytes_out":101072}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T00:32:27.069013+00:00"}