{"ip":"158.220.105.179","total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 11,490 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,490 bytes sent","bytes_sent":11490,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-19T22:59:26","last_seen":"2026-09-27T20:42:16","events_24h":0,"events_7d":18,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmd140609.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":6380,"proto":"tcp","label":"","count":18},{"port":3000,"proto":"tcp","label":"Web-alt","count":4},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":3},{"port":5678,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc030311e75279dc80c65ae9c94b646a9e89f8ed9338de2edde15bfc4d419b811599ba2059e9a8bd3ef1b3e249b38f81529916f54bd86de924332010d82a2d7dde9e148d003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020759ab4863ca8b4899cea579ea3bd8fcde3c334e9cbcad8d47248ed809016844c001500e60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["004556e859f3c26c5d19746b3a957c74"],"http_akin":[]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":801},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-19","count":6},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":4},{"date":"2026-09-27","count":18}],"recent_events":[{"timestamp":"2026-09-27T20:42:16","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$7\r\nSLAVEOF\r\n$2\r\nNO\r\n$3\r\nONE\r\n","payload_hex":"2a330d0a24370d0a534c4156454f460d0a24320d0a4e4f0d0a24330d0a4f4e450d0a","method":"","user_agent":"","ja3":"","session":"60216f37-60c3-42c9-987b-89d20bcb618a","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":5,"enriched":{"digest":"19890463135c2f6f","label":"Redis (RESP)","strings":["SLAVEOF"]}},{"timestamp":"2026-09-27T20:42:04","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$7\r\nSLAVEOF\r\n$15\r\n158.220.105.179\r\n$5\r\n16379\r\n","payload_hex":"2a330d0a24370d0a534c4156454f460d0a2431350d0a3135382e3232302e3130352e3137390d0a24350d0a31363337390d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":8,"duration_ms":1609,"bytes_in":303,"bytes_out":42,"enriched":{"digest":"215ddf81a7c529b8","label":"Redis (RESP)","strings":["SLAVEOF","158.220.105.179","16379"],"iocs":{"ips":["158.220.105.179"]}}},{"timestamp":"2026-09-27T20:42:03","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":3,"duration_ms":586,"bytes_in":60,"bytes_out":17,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-27T20:42:03","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$3\r\ndir\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a24330d0a6469720d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":4,"duration_ms":790,"bytes_in":94,"bytes_out":22,"enriched":{"digest":"6e396dc600a391e2","label":"Redis (RESP)","strings":["CONFIG"]}},{"timestamp":"2026-09-27T20:42:03","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$10\r\ndbfilename\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a2431300d0a646266696c656e616d650d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":5,"duration_ms":995,"bytes_in":136,"bytes_out":27,"enriched":{"digest":"ae7a954eba732d9f","label":"Redis (RESP)","strings":["CONFIG","dbfilename"]}},{"timestamp":"2026-09-27T20:42:03","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$11\r\n/etc/cron.d\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431310d0a2f6574632f63726f6e2e640d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":6,"duration_ms":1200,"bytes_in":188,"bytes_out":32,"enriched":{"digest":"cb43bf20522aa121","label":"Redis (RESP)","strings":["CONFIG","/etc/cron.d"],"iocs":{"paths":["/etc/cron.d"]}}},{"timestamp":"2026-09-27T20:42:03","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$16\r\n.rprobe-3516ebcb\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a2431360d0a2e7270726f62652d33353136656263620d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":7,"duration_ms":1405,"bytes_in":253,"bytes_out":37,"enriched":{"digest":"c20f1dee41ab7c5a","label":"Redis (RESP)","strings":["CONFIG","dbfilename",".rprobe-3516ebcb"]}},{"timestamp":"2026-09-27T20:42:02","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":7,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-27T20:42:02","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nINFO\r\n$11\r\nreplication\r\n","payload_hex":"2a320d0a24340d0a494e464f0d0a2431310d0a7265706c69636174696f6e0d0a","method":"","user_agent":"","ja3":"","session":"6a1527df-00e7-4fd0-852a-234ecdee5537","seq":2,"duration_ms":318,"bytes_in":46,"bytes_out":12,"enriched":{"digest":"cabecdd2aaccea82","label":"Redis (RESP)","strings":["INFO","replication"]}},{"timestamp":"2026-09-27T04:23:18","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$7\r\nSLAVEOF\r\n$2\r\nNO\r\n$3\r\nONE\r\n","payload_hex":"2a330d0a24370d0a534c4156454f460d0a24320d0a4e4f0d0a24330d0a4f4e450d0a","method":"","user_agent":"","ja3":"","session":"2169480e-3fe8-465c-8b60-7751144ad0ee","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":5,"enriched":{"digest":"19890463135c2f6f","label":"Redis (RESP)","strings":["SLAVEOF"]}}],"http_methods":[{"method":"POST","count":11}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":11,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T03:03:48.745552+00:00"}