{"ip":"167.172.146.212","total_events":133,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["133 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 6,114 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,114 bytes sent","bytes_sent":6114,"session_seconds":6,"persistent":false}},"first_seen":"2026-06-20T09:58:33","last_seen":"2026-08-11T19:18:51","events_24h":0,"events_7d":92,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":15672,"proto":"tcp","label":"RabbitMQ","count":40},{"port":9200,"proto":"tcp","label":"Elastic","count":38},{"port":2181,"proto":"tcp","label":"","count":21},{"port":1434,"proto":"tcp","label":"MSSQL","count":20},{"port":29092,"proto":"tcp","label":"","count":14}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i751000_479067518aa3_d41ae481755e"],"tls_ja3":["327efd8a5e8ed9fa2b145f126b748661"],"ja4h":["ge10nn0000_000000000000","op10nn0000_000000000000"]},"fingerprint_peers":{"t13i751000_479067518aa3_d41ae481755e":662,"ge10nn0000_000000000000":2585,"op10nn0000_000000000000":1670},"user_agents":[],"timeline":[{"date":"2026-06-20","count":41},{"date":"2026-08-10","count":58},{"date":"2026-08-11","count":34}],"recent_events":[{"timestamp":"2026-08-11T19:18:51","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"8efd734c-be30-4955-9419-ebeb0ec3327b","seq":1,"duration_ms":189,"bytes_in":6,"bytes_out":15,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-08-11T19:18:46","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"10605da7-b24b-45d0-bf52-94e0e04d784f","seq":1,"duration_ms":191,"bytes_in":32,"bytes_out":15,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-08-11T19:18:41","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"4f423e96-9d5c-45d0-8296-063a5753c1f1","seq":1,"duration_ms":189,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-08-11T19:18:36","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"72e59dc9-1583-4152-921c-b03cf2f24f76","seq":1,"duration_ms":193,"bytes_in":22,"bytes_out":80,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-08-11T19:18:30","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e300d0a0d0a","method":"OPTIONS","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"f67fc345-4d3c-4b4b-a073-1d2f408dc719","seq":1,"duration_ms":192,"bytes_in":22,"bytes_out":80},{"timestamp":"2026-08-11T19:18:25","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"b33c4ded-c4a1-4b7a-8c1a-483569ca07de","seq":1,"duration_ms":191,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-08-11T19:18:20","port":29092,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"bcc3c89d-65cf-4ffe-bcce-590617807897","seq":1,"duration_ms":6104,"bytes_in":4,"bytes_out":15},{"timestamp":"2026-08-11T19:18:06","port":29092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"e9859b06-7e16-4895-aa89-8e8968f30662","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":15,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-08-11T19:18:01","port":29092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"159e2611-edbd-4b42-9ce1-5b1c7371118d","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":15,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-08-11T19:17:56","port":29092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"9cc3808c-9e35-4b33-9367-3e09100867c2","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15}],"http_methods":[{"method":"GET","count":13},{"method":"OPTIONS","count":12}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":24,"ports":5},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T10:36:08.424764+00:00"}