{"ip":"185.193.176.75","observed":true,"total_events":3902,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,902 events across 3 port(s)","confidence":"medium","network_type":"nsp","why":["3,902 requests against only 3 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"365,577 bytes sent","bytes_sent":365577,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-15T00:32:02","last_seen":"2026-10-15T00:56:41","events_24h":0,"events_7d":3902,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"JO","country_name":"Jordan","region":"Amman Governorate","city":"Amman","lat":31.9555,"lon":35.9435,"asn":50670,"org":"Vtel Holdings Limited/jordan Co."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as50670","label":"VTEL JORDAN","category":"isp","url":"https://www.peeringdb.com/asn/50670"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":3845},{"port":445,"proto":"tcp","label":"SMB","count":43},{"port":139,"proto":"tcp","label":"SMB","count":14}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":3902}],"recent_events":[{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00003t\u0000��\u0007�\u000f9TA��kT����\u0006^��a!\u0017D���$[xK�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04081252000001000000337400c4c207d50f395441b6846b54e9e7f3a6065eb09c6121174491c9de245b7f784b9500000001","method":"","user_agent":"","ja3":"","session":"9da06657-d891-4d98-9f92-856b0492dfd8","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0010p\u0000Ӈ�H�k.J�Ӕ�\u001b}�\u000f��:Oc�zG��y\u0018��(��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04081252000001000000107000d3878248c06b2e4aa9d394ca1b7de30f91e83a4f639c7a47b6c3791891ff28f9aa00000001","method":"","user_agent":"","ja3":"","session":"5b9d4071-83b4-4a2d-b8c9-c7e9d603154a","seq":1,"duration_ms":102,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000S�\u0000��`��WE��Ǐ\nJ,��\u0012�?�t�N�0pčr�,�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000010000005380007fb7ce60b7b55745b8c8c78f0a4a2ca4b512aa3ff874b84e963070c48d72aa2cb000000001","method":"","user_agent":"","ja3":"","session":"a08cf9a0-3ee3-4529-89c6-231028977e27","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\\\u0000\t\u0002��B�OB�&꦳���_�e&�L>E���\u0001���'�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04081252000001000000025c000902eea442804f428d26eaa6b3b7a8b05faa6526b64c3e45a49b9801bc8dab278f00000001","method":"","user_agent":"","ja3":"","session":"7bcaa08d-a86e-45b4-a3dc-3fb0fa21d0d6","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000/\u0004\u0000�_\u0010�w��I�H\u0012�\u001e���p.\\�m�1M�\u0013�i�̨��\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000010000002f0400835f109177efa3499f4812d41ed7f8d1702e5ceb6db1314d8313b469d7cca8f1a300000001","method":"","user_agent":"","ja3":"","session":"7b81ca80-0a53-4632-bae5-3f4e89899244","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000:h\u0000��q��3�O��C���սC�\u001b����K�#|\u001eqA\u0012�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000010000003a6800cecc71a0bb33e64f8cdf43eb9dcad5bd43951bf6b092ee4bbc237c1e7f7141129b00000001","method":"","user_agent":"","ja3":"","session":"2bf5f621-b753-4588-89cb-e7bcb13948b9","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:37","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000+�\u0000�\f�p=�\u0019L�7�l�9Rv�U\"�\u0013�wD�9\u001e l;\u001c�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000010000002bc400930c8e703df7194cbb37fb6cfe395276d055228513ae7744897f391e206c3b1c9900000001","method":"","user_agent":"","ja3":"","session":"c3ccd5ca-66f1-4387-ae07-a32122791c17","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:35","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001bp\u0000�����n�H�#RLH!�w��]�~��B�wk!~��G�\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000010000001b7000ab8b80ded06e9348ac23524c48218a77f2ed5dd47ef0f44289776b217e91a247a300000001","method":"","user_agent":"","ja3":"","session":"a734869e-4f48-42e6-9546-f044f23fd18a","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"f9924e9f9c51bc41","strings":["#RLH!","wk!~"]}},{"timestamp":"2026-10-15T00:56:33","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00005�\u0000��c�2e�E��q�I�|�)\u0000�?\u0015��K�5c�%c���\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0408125200000100000035c400fab963923265824581e0718049b27ca92900c03f1583f54b803563aa256392f19200000001","method":"","user_agent":"","ja3":"","session":"b8dcb79f-c004-4349-8e19-5bb2304ed62a","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-10-15T00:56:33","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0017�\u0000��y�c\u0006�L�\u000f@H �1w��r)B� O�L\u0016\u0018�����\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff0408125200000100000017f40097f379e36306da4cab0f404820b83177a7e8722942bc204fb94c1618ecffa8bea700000001","method":"","user_agent":"","ja3":"","session":"d9d7ebed-3833-422f-a81c-2ad1e1ca6078","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-16T17:02:41.900575+00:00"}