{"ip":"160.119.76.123","total_events":1042,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,042 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,042 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"162,552 bytes sent","bytes_sent":162552,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T15:42:05","last_seen":"2026-09-29T10:36:11","events_24h":1039,"events_7d":1042,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":"160-119-76-123.ptr.as49870.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"top_ports":[{"port":1723,"proto":"tcp","label":"PPTP","count":1042}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-28","count":3},{"date":"2026-09-29","count":1039}],"recent_events":[{"timestamp":"2026-09-29T10:36:11","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+