{"ip":"193.46.255.152","total_events":1219,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"740+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 740 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"97,119 bytes sent","bytes_sent":97119,"session_seconds":11,"persistent":false}},"first_seen":"2026-08-09T12:50:28","last_seen":"2026-08-09T16:13:50","events_24h":0,"events_7d":1219,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":47890,"org":"Unmanaged Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":4443,"proto":"tcp","label":"","count":10},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":9},{"port":6379,"proto":"tcp","label":"Redis","count":8},{"port":7443,"proto":"tcp","label":"","count":8},{"port":9200,"proto":"tcp","label":"Elastic","count":7},{"port":7001,"proto":"tcp","label":"WebLogic","count":7},{"port":3389,"proto":"tcp","label":"RDP","count":6},{"port":50000,"proto":"tcp","label":"SAP","count":5},{"port":8808,"proto":"tcp","label":"","count":5},{"port":5984,"proto":"tcp","label":"CouchDB","count":5},{"port":8222,"proto":"tcp","label":"","count":5},{"port":8123,"proto":"tcp","label":"","count":5},{"port":8333,"proto":"tcp","label":"Bitcoin","count":5},{"port":31337,"proto":"tcp","label":"","count":5},{"port":80,"proto":"tcp","label":"HTTP","count":5}],"fingerprints":{"ssh_hassh":["9052c4ab4164c78256e71143dcfc7eac"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_7522b0acae40","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2152,"ge11nn0300_0db47b7d240d":5550,"po11nn0600_7522b0acae40":7,"ge11nn0400_88d30a62b7ad":4815,"9052c4ab4164c78256e71143dcfc7eac":85},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0"],"timeline":[{"date":"2026-08-09","count":1219}],"recent_events":[{"timestamp":"2026-08-09T16:13:50","port":30005,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"f9d24a72-fa79-4fa8-85cf-14915737cb3e","seq":1,"duration_ms":10601,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":18080,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"f00ba766-b92d-4e92-8bab-91fb16f81ed6","seq":1,"duration_ms":10602,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":18443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"17f08082-a49c-4a04-94f4-33bf6a9cb6ee","seq":1,"duration_ms":10599,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":14901,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"285f7c22-99d2-40ad-8460-d8b7196b3e26","seq":1,"duration_ms":10598,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":30001,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"3c98d872-ffea-41f9-9842-0882be5e16fe","seq":1,"duration_ms":9096,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":179,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"3ca72df2-e54f-4c0a-94fb-fec50289fc0f","seq":1,"duration_ms":9903,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":18264,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"54863094-620a-42ac-a9a8-754559c0bca2","seq":1,"duration_ms":9799,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":2345,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"559ba0ff-9107-488a-acf3-03484650583b","seq":1,"duration_ms":6106,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":27015,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"219dbb10-ba2d-4dee-b15e-7d7015f8f59d","seq":1,"duration_ms":6103,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-09T16:13:50","port":24442,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"494a9b70-1bde-4474-af58-d0d20b652e46","seq":1,"duration_ms":6106,"bytes_in":4,"bytes_out":14}],"http_methods":[{"method":"GET","count":250},{"method":"POST","count":2}],"distinct_ports_total":740,"top_paths":[{"path":"/","count":132,"ports":62},{"path":"/favicon.ico","count":118,"ports":54},{"path":"/_cluster/state","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8","count":6}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T06:55:05.104064+00:00"}