{"ip":"193.46.255.157","total_events":805,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"411+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 411 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"46,544 bytes sent","bytes_sent":46544,"session_seconds":8,"persistent":false}},"first_seen":"2026-04-20T11:30:15","last_seen":"2026-08-31T18:50:01","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":47890,"org":"Unmanaged Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":12},{"port":8088,"proto":"tcp","label":"Hadoop","count":8},{"port":8222,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":6},{"port":41337,"proto":"tcp","label":"","count":6},{"port":22,"proto":"tcp","label":"SSH","count":6},{"port":9998,"proto":"tcp","label":"","count":6},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":6},{"port":1883,"proto":"tcp","label":"MQTT","count":6},{"port":8500,"proto":"tcp","label":"","count":6},{"port":14406,"proto":"tcp","label":"","count":5},{"port":5984,"proto":"tcp","label":"CouchDB","count":5},{"port":44305,"proto":"tcp","label":"","count":4},{"port":2222,"proto":"tcp","label":"SSH-alt","count":4},{"port":10380,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_7522b0acae40","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1346,"ge11nn0400_88d30a62b7ad":6409,"po11nn0600_7522b0acae40":4,"ge11nn0300_0db47b7d240d":4915},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"timeline":[{"date":"2026-08-31","count":793}],"recent_events":[{"timestamp":"2026-08-31T18:50:01","port":50011,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"75186141-8f93-4498-a01a-e171d81ba6d9","seq":1,"duration_ms":582,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"85dc59b2-93c9-43ec-a1c4-4c1a4f24e1f7","seq":1,"duration_ms":376,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":44818,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"12d32760-425b-4383-8d24-0ab8f9b039dc","seq":1,"duration_ms":371,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":3001,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"84ef68c1-a1a2-4ba8-8a7f-e650c5e1568f","seq":1,"duration_ms":364,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":4911,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"fc46f8ad-9efb-4aae-9f3f-a6974369131c","seq":1,"duration_ms":575,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":33060,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"ab09407b-4c35-482d-b635-667e80db4d5e","seq":1,"duration_ms":575,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":4664,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"b1aaa287-4de2-4471-bb74-77760ebfe9ba","seq":1,"duration_ms":576,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":4502,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"0440fcfc-e8a2-43cf-8942-30eaac8ea190","seq":1,"duration_ms":576,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":29842,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"9e52cd92-5ea0-4db6-b1a0-aacb795c3bc7","seq":1,"duration_ms":548,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-08-31T18:50:01","port":4010,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"49fed3ea-52ee-4008-bf15-e812698c9353","seq":1,"duration_ms":396,"bytes_in":4,"bytes_out":14}],"http_methods":[{"method":"GET","count":100},{"method":"POST","count":2}],"distinct_ports_total":411,"top_paths":[{"path":"/","count":66,"ports":30},{"path":"/favicon.ico","count":35,"ports":18},{"path":"/_cluster/state","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8","count":6}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-20T13:43:30.449933+00:00"}