{"ip":"170.84.225.2","data_as_of":"2026-10-28T02:07:13+00:00","observed":true,"total_events":12,"verdict":{"verdict":"scanning","label":"Login attempts observed","detail":"2 interactive session(s) tried logins, none got in","confidence":"medium","network_type":"residential ISP","why":["2 interactive session(s) sent a username and password, and none of them got in.","No session reached a shell, so this is credential activity without a confirmed compromise.","The first-packet sensors recorded 12 event(s) from this address as well.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,405 bytes sent","bytes_sent":1405,"session_seconds":21,"persistent":false},"basis":"interactive"},"first_seen":"2026-07-15T23:46:11","last_seen":"2026-10-21T04:48:36","events_24h":0,"events_7d":2,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"smb","sessions":2}],"geo":{"country_code":"BR","country_name":"Brazil","region":"Bahia","city":"Jequié","lat":-13.923,"lon":-40.0837,"asn":52974,"org":"Henet Telecomunicacoes Ltda"},"source_domain":"170-084-225-002.henet.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as52974","label":"Henet Telecomunicacoes Ltda","category":"isp","url":"https://www.peeringdb.com/asn/52974"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-19T10:53:45","last_seen":"2026-10-19T10:53:45","verdicts":[{"verdict":"credential","sessions":2}],"personas":[{"persona":"smb@Windows Server 2019","sessions":2}],"services":[{"protocol":"smb","port":445,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":6,"sessions":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":6,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-03","count":3,"sessions":0},{"date":"2026-08-05","count":2,"sessions":0},{"date":"2026-08-12","count":2,"sessions":0},{"date":"2026-10-19","count":0,"sessions":2},{"date":"2026-10-21","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-21T04:48:36","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���5\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffffd43500000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"351cb4ff-c9de-4c9f-b680-fa0f51edf7ee","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9ff8a1654704c073","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-10-21T04:48:36","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���5\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffffd43500000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"ab66a9e9-c8b6-4f06-bec0-66662cebcb09","seq":1,"duration_ms":103,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9ff8a1654704c073","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000A�SMB%\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\bXC\u0000\b6J\u000f\u0000\u0000\u0000\u0000��\u0000\b\u0002\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000#\u0000\u0000\u0000","payload_hex":"00000041ff534d422500000000180148000000000000000000000000010858430008364a0f00000000ffff000802000000ffffffff00000000000000000000010023000000","method":"","user_agent":"","ja3":"","session":"d8b4775c-b305-4219-82d1-5a33d2dd5f80-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8fb169d0de5b91b4","strings":["SMB%"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000H�SMBu\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\b\u0000\u0000\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001d\u0000\u0000\\\\<HONEYPOT>\\IPC$\u0000?????\u0000","payload_hex":"00000048ff534d427500000000180148000000000000000000000000ffff58430008000004ff000000000001001d00005c5c3c484f4e4559504f543e5c49504324003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"d8b4775c-b305-4219-82d1-5a33d2dd5f80-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"da535ff9593c98d4","strings":["SMBu","\\\\<HONEYPOT>\\IPC$","\\\\<HONEYPOT>\\IPC$?????"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\b\u0000\u0000\f�\u0000\u0000\u0000\u0004\u0011\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000Y\u0000\u0000\u0000\u0000\u0000D�\u0000�d\u0000�W0U�S\u0004QNTLMSSP\u0000\u0003\u0000\u0000\u0000\u0001\u0000\u0001\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000A\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0010\u0000\u0010\u0000A\u0000\u0000\u0000\u0005\u0002��\u0000�.�\u0006�R\u000b\n�l/7`\u0001�\u0017Unix\u0000Samba\u0000","payload_hex":"0000009fff534d427300000000180148000000000000000000000000ffff5843000800000cff0000000411020001000000000059000000000044c000806400a1573055a25304514e544c4d5353500003000000010001004000000000000000410000000000000040000000000000004000000000000000400000001000100041000000050288a000892ebd06e8520b0ab36c2f376001ff17556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"c5dbe6a8-3756-4dc6-b3db-5665287cd783-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b82336b3932a2ec2","strings":["SMBs","QNTLMSSP","l/7`","Unix","Samba","@A@@@","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\b\u0000\u0000\f�\u0000\u0000\u0000\u0000�\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000Y\u0000\u0000\u0000\u0000\u0000D�\u0000�d\u0000�W0U�S\u0004QNTLMSSP\u0000\u0003\u0000\u0000\u0000\u0001\u0000\u0001\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000A\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0010\u0000\u0010\u0000A\u0000\u0000\u0000\u0005\u0002��\u0000�~�*�D-\u000e�c&\u0016\u001b,�\u0017Unix\u0000Samba\u0000","payload_hex":"0000009fff534d427300000000180148000000000000000000000000ffff5843000800000cff00000000f0020001000000000059000000000044c000806400a1573055a25304514e544c4d5353500003000000010001004000000000000000410000000000000040000000000000004000000000000000400000001000100041000000050288a0009c7efd2a9a442d0ee06326161b2ca317556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"d8b4775c-b305-4219-82d1-5a33d2dd5f80-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66eef3f16dd33f66","strings":["SMBs","QNTLMSSP","Unix","Samba","@A@@@","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\u0000\u0000\u0000\f�\u0000\u0000\u0000\u0004\u0011\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000B\u0000\u0000\u0000\u0000\u0000D�\u0000�M\u0000`@\u0006\u0006+\u0006\u0001\u0005\u0005\u0002�604�\u000e0\f\u0006\n+\u0006\u0001\u0004\u0001�7\u0002\u0002\n�\"\u0004 NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0005\u0002��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Unix\u0000Samba\u0000","payload_hex":"00000088ff534d427300000000180148000000000000000000000000ffff5843000000000cff0000000411020001000000000042000000000044c000804d00604006062b0601050502a0363034a00e300c060a2b06010401823702020aa22204204e544c4d5353500001000000050288a000000000000000000000000000000000556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"c5dbe6a8-3756-4dc6-b3db-5665287cd783-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"54fabdda0c53493a","strings":["SMBs","NTLMSSP","Unix","Samba","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\u0000\u0000\u0000\f�\u0000\u0000\u0000\u0000�\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000B\u0000\u0000\u0000\u0000\u0000D�\u0000�M\u0000`@\u0006\u0006+\u0006\u0001\u0005\u0005\u0002�604�\u000e0\f\u0006\n+\u0006\u0001\u0004\u0001�7\u0002\u0002\n�\"\u0004 NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0005\u0002��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Unix\u0000Samba\u0000","payload_hex":"00000088ff534d427300000000180148000000000000000000000000ffff5843000000000cff00000000f0020001000000000042000000000044c000804d00604006062b0601050502a0363034a00e300c060a2b06010401823702020aa22204204e544c4d5353500001000000050288a000000000000000000000000000000000556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"d8b4775c-b305-4219-82d1-5a33d2dd5f80-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2a1a8dfeff2b5001","strings":["SMBs","NTLMSSP","Unix","Samba","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff584300000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"c5dbe6a8-3756-4dc6-b3db-5665287cd783-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ca3f21f363767841","strings":["SMBr","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-19T10:53:24","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��XC\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff584300000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"d8b4775c-b305-4219-82d1-5a33d2dd5f80-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ca3f21f363767841","strings":["SMBr","NT LM 0.12"]},"interactive":true}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}