{"ip":"193.46.255.142","total_events":1053,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"617+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 617 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"76,465 bytes sent","bytes_sent":76465,"session_seconds":7,"persistent":false}},"first_seen":"2026-09-15T10:18:28","last_seen":"2026-09-15T19:56:10","events_24h":0,"events_7d":1053,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":47890,"org":"Unmanaged Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":8},{"port":4782,"proto":"tcp","label":"","count":8},{"port":4443,"proto":"tcp","label":"","count":7},{"port":1337,"proto":"tcp","label":"","count":5},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":5},{"port":7001,"proto":"tcp","label":"WebLogic","count":5},{"port":8222,"proto":"tcp","label":"","count":4},{"port":8123,"proto":"tcp","label":"","count":4},{"port":10000,"proto":"tcp","label":"Webmin","count":4},{"port":7443,"proto":"tcp","label":"","count":4},{"port":7547,"proto":"tcp","label":"TR-069","count":4},{"port":9000,"proto":"tcp","label":"Web-alt","count":4},{"port":8088,"proto":"tcp","label":"Hadoop","count":4},{"port":4449,"proto":"tcp","label":"","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":4}],"fingerprints":{"ssh_hassh":["9052c4ab4164c78256e71143dcfc7eac"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_7522b0acae40","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1373,"ge11nn0400_88d30a62b7ad":6390,"po11nn0600_7522b0acae40":4,"ge11nn0300_0db47b7d240d":4916,"9052c4ab4164c78256e71143dcfc7eac":73},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-15","count":1053}],"recent_events":[{"timestamp":"2026-09-15T19:56:10","port":7080,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"70ace855-342a-4436-ab2f-58a4ed57ec74","seq":1,"duration_ms":248,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:07","port":4321,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"5e3c79fb-2e57-47ef-867a-03e1b03e4189","seq":1,"duration_ms":4407,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:07","port":25006,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"2513e89d-f1e5-4fab-9749-51ef4e42be85","seq":1,"duration_ms":4685,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":4664,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"a3faf71b-ceb3-406e-91e4-22c9707065d5","seq":1,"duration_ms":4098,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":4502,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"10ff6e86-85fb-4677-9f09-2d291cef3441","seq":1,"duration_ms":4096,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":5130,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"b5781bec-bc4f-49c7-9cec-bedcb4c39268","seq":1,"duration_ms":4100,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":50070,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"ae21bf38-f6b4-4e72-ace4-672d740f0adb","seq":1,"duration_ms":4095,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":4567,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"58a15b90-9241-4a87-8db3-06f65d82ed4e","seq":1,"duration_ms":4095,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":4848,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"d8f2fe72-9e09-43bd-9aa5-23ecc177269e","seq":1,"duration_ms":4092,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-15T19:56:06","port":50100,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"01833fb1-fa32-4dd4-b62b-fcca0f692624","seq":1,"duration_ms":4091,"bytes_in":4,"bytes_out":14}],"http_methods":[{"method":"GET","count":216},{"method":"POST","count":2}],"distinct_ports_total":617,"top_paths":[{"path":"/","count":127,"ports":62},{"path":"/favicon.ico","count":89,"ports":57},{"path":"/_cluster/state","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8","count":6}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-20T03:05:13.991775+00:00"}