{"ip":"155.103.69.111","observed":true,"total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"790 bytes sent","bytes_sent":790,"session_seconds":2,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-10T02:38:55","last_seen":"2026-10-10T02:39:12","events_24h":0,"events_7d":2,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"TR","country_name":"Türkiye","region":"Istanbul","city":"Istanbul","lat":41.0146,"lon":28.9532,"asn":44382,"org":"Fiba Cloud Operation Company, LLC"},"source_domain":"zi15.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as44382","label":"FibaCloud","category":"isp","url":"https://www.peeringdb.com/asn/44382"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":2}],"fingerprints":{"ssh_hassh":["a7a87fbe86774c2e40cc4a7ea2ab1b3c"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"a7a87fbe86774c2e40cc4a7ea2ab1b3c":4},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-10","count":2}],"recent_events":[{"timestamp":"2026-10-10T02:39:12","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"b5a11165-635f-42bb-8846-fb4e5922889d","seq":1,"duration_ms":2101,"bytes_in":23,"bytes_out":14,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-10T02:38:55","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n\u0000\u0000\u0002�\n\u0014N,e:���l\u001d�O��?��\u0000\u0000\u0000~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0000\u000fssh-rsa,ssh-dss\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000N�/���\u0016���","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a000002e40a144e2c653a98b9b16c1de64fc6fe3faac60000007e6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000000f7373682d7273612c7373682d647373000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d636263000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d63626300000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d00000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d000000046e6f6e65000000046e6f6e65000000000000000000000000004e8d2ff9fba716f785cd","method":"","user_agent":"","ja3":"","session":"93b7e5a5-350b-4100-b13c-7382882877ba","seq":1,"duration_ms":1122,"bytes_in":767,"bytes_out":14,"enriched":{"digest":"bdfc15c6140313cf","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0","N,e:","~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-…","ssh-rsa,ssh-dss","aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-c…","qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ri…","none","noneN"],"iocs":{"domains":["lysator.liu.se"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.8.0","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T19:05:23.430916+00:00"}