{"ip":"167.86.118.220","total_events":149,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"36+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 36 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,705 bytes sent","bytes_sent":6705,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T17:10:33","last_seen":"2026-09-29T00:08:27","events_24h":0,"events_7d":149,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"m12820.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":11},{"port":43389,"proto":"tcp","label":"","count":5},{"port":33389,"proto":"tcp","label":"","count":4},{"port":3394,"proto":"tcp","label":"","count":4},{"port":3373,"proto":"tcp","label":"","count":4},{"port":3388,"proto":"tcp","label":"","count":4},{"port":3395,"proto":"tcp","label":"","count":4},{"port":3390,"proto":"tcp","label":"","count":4},{"port":3393,"proto":"tcp","label":"","count":4},{"port":3385,"proto":"tcp","label":"","count":4},{"port":3370,"proto":"tcp","label":"","count":4},{"port":3398,"proto":"tcp","label":"","count":4},{"port":3379,"proto":"tcp","label":"","count":4},{"port":3387,"proto":"tcp","label":"","count":4},{"port":3382,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":8},{"date":"2026-09-24","count":3},{"date":"2026-09-25","count":40},{"date":"2026-09-26","count":12},{"date":"2026-09-27","count":24},{"date":"2026-09-28","count":41},{"date":"2026-09-29","count":21}],"recent_events":[{"timestamp":"2026-09-29T00:08:27","port":63389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"b70ac358-f3fa-4a86-9c7c-840c0b5a19a5","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:08:25","port":53389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"a394b77c-6786-416f-8cbe-27e35adceb34","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:08:21","port":13389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"faf3f297-0aa4-44d1-81ed-3a87fc778e8b","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:07:55","port":33389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"3b4e80db-c8c0-4cc8-93ff-89ac0d5352d1","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:07:26","port":13389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"65a4bda2-00ab-4045-b6fb-3a6f2a6c924b","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:07:22","port":33389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"52e9c4fb-c39d-45c6-ad09-8e97a382b928","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:07:10","port":13389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"0ccc906c-0def-4c7e-bbd9-ddd97c06e2bb","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:06:21","port":63389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"fbd448ea-b07e-45a6-8e40-1797bebee425","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:05:59","port":43389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"b4ee7376-79b3-438b-aaa1-9d0dc52cfa04","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}},{"timestamp":"2026-09-29T00:05:50","port":53389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000-(�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nlascan\r\n\u0001\u0000\b\u0000\u000f\u0000\u0000\u0000","payload_hex":"0300002d28e00000000000436f6f6b69653a206d737473686173683d6e6c617363616e0d0a010008000f000000","method":"","user_agent":"","ja3":"","session":"59a165cc-69f1-4ff0-b591-532434778208","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":14,"enriched":{"digest":"662dc0909dda253b","label":"RDP (X.224)","strings":["Cookie: mstshash=nlascan"]}}],"http_methods":[],"distinct_ports_total":36,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T02:05:52.308860+00:00"}