{"ip":"176.120.22.192","data_as_of":"2026-10-24T07:54:58+00:00","observed":true,"total_events":113,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"37+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 37 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,783 bytes sent","bytes_sent":2783,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-03-27T13:51:22","last_seen":"2026-10-01T13:02:40","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":198953,"org":"Proton66 OOO"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":37},{"port":344,"proto":"tcp","label":"","count":6},{"port":296,"proto":"tcp","label":"","count":6},{"port":1612,"proto":"tcp","label":"","count":5},{"port":120,"proto":"tcp","label":"","count":5},{"port":1898,"proto":"tcp","label":"","count":5},{"port":14332,"proto":"tcp","label":"","count":3},{"port":14334,"proto":"tcp","label":"","count":3},{"port":14339,"proto":"tcp","label":"","count":3},{"port":14337,"proto":"tcp","label":"","count":3},{"port":14333,"proto":"tcp","label":"","count":3},{"port":14331,"proto":"tcp","label":"","count":3},{"port":14338,"proto":"tcp","label":"","count":3},{"port":14330,"proto":"tcp","label":"","count":3},{"port":14335,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-01","count":7}],"recent_events":[{"timestamp":"2026-10-01T13:02:40","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"a94b9e39-042b-46a1-9031-117f496e1172","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T12:58:17","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"fdaa1d87-214f-453b-b493-4b851ed0b4b6","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T12:56:06","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"f475224c-a40b-4968-aee9-5928860d4f03","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T12:46:13","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"74fada9f-c5a8-4848-89fe-bfb0b4001409","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T12:19:52","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"b8505a9f-7586-49a6-b528-a85a647cfdc5","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T12:18:58","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"c5184f18-fd2c-4b4a-afd7-895678bad0d1","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-10-01T11:57:03","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000ɷ\u0000\u0000","payload_hex":"1201003400000100000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200c9b70000","method":"","user_agent":"","ja3":"","session":"393bb614-d452-4a92-a758-8e4e42fc455e","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"6e574657928ea733","strings":["MSSQLServer","UMSSQLServer"]}},{"timestamp":"2026-07-18T08:48:53","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\t\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff090000000000020000000000","method":"","user_agent":"","ja3":"","session":"2eb1ed75-bd9c-42c3-8aec-cd11dba4d5c5","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14},{"timestamp":"2026-07-18T08:48:44","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\t\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff090000000000020000000000","method":"","user_agent":"","ja3":"","session":"b640bb6f-23bc-4367-a8da-717998b4aeb9","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14},{"timestamp":"2026-07-18T08:47:39","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\t\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff090000000000020000000000","method":"","user_agent":"","ja3":"","session":"d8ce3c69-d2ab-4b5e-8a50-4e0f8f4a4ac4","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14}],"http_methods":[],"distinct_ports_total":37,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}