{"ip":"194.165.16.9","total_events":19662,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"9973+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 9973 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-06-23T02:49:43","last_seen":"2026-07-11T14:29:01","events_24h":410,"events_7d":7066,"geo":{"country_code":"MC","country_name":"Monaco","region":"","city":"Monaco","lat":43.7304,"lon":7.4191,"asn":48721,"org":"Flyservers S.A."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":61652,"proto":"tcp","label":"","count":4},{"port":61600,"proto":"tcp","label":"","count":4},{"port":61358,"proto":"tcp","label":"","count":4},{"port":15762,"proto":"tcp","label":"","count":3},{"port":61828,"proto":"tcp","label":"","count":3},{"port":46572,"proto":"tcp","label":"","count":3},{"port":61646,"proto":"tcp","label":"","count":3},{"port":61535,"proto":"tcp","label":"","count":3},{"port":45007,"proto":"tcp","label":"","count":3},{"port":61383,"proto":"tcp","label":"","count":3},{"port":61386,"proto":"tcp","label":"","count":3},{"port":45366,"proto":"tcp","label":"","count":3},{"port":61412,"proto":"tcp","label":"","count":3},{"port":61318,"proto":"tcp","label":"","count":3},{"port":61244,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-23","count":1166},{"date":"2026-06-24","count":820},{"date":"2026-06-25","count":1210},{"date":"2026-06-26","count":615},{"date":"2026-06-27","count":1061},{"date":"2026-06-28","count":901},{"date":"2026-06-29","count":950},{"date":"2026-06-30","count":1024},{"date":"2026-07-01","count":1386},{"date":"2026-07-02","count":1336},{"date":"2026-07-03","count":1233},{"date":"2026-07-04","count":450},{"date":"2026-07-05","count":1328},{"date":"2026-07-06","count":1351},{"date":"2026-07-07","count":823},{"date":"2026-07-08","count":1075},{"date":"2026-07-09","count":903},{"date":"2026-07-10","count":1090},{"date":"2026-07-11","count":940}],"recent_events":[{"timestamp":"2026-07-11T14:29:01","port":61358,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:SeTb7O93/yqovb4z82OPTQGJH7c=","ja3":"","session":"0285d05c-adf2-4a65-9433-06c6016f3efe","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:25:44","port":61175,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:cigMxHDTEQXV3P6r78mWKR/j3Mo=","ja3":"","session":"15604e32-b0ce-4a47-b1d5-07b14b10a21d","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:25:06","port":61146,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:caLrjDFw1BYPepOeW3q76ySAG14=","ja3":"","session":"2165e7fe-929a-4e2d-a45f-7302e68529f8","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:23:50","port":61060,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:df2M+BcCRCBDo4oknpjr/J13qcQ=","ja3":"","session":"0cf29b64-15af-441d-90a8-c5086abc8edb","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:23:21","port":61286,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:tM7xDOySuqFxj0SdBnTXukykU5g=","ja3":"","session":"7403aad4-c81c-484a-b7c6-3ca31e559439","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:22:01","port":61318,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:L7x4VMVJbViNmWTXIK9lC7qeZ1Q=","ja3":"","session":"b25e5c24-6eca-41a5-96d4-1010fc90352f","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:20:28","port":61638,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:piGGuMpXH3plLM9AA2nn6CofvHw=","ja3":"","session":"66955a52-8302-4f4f-9f1d-2a0d96451911","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:20:15","port":61241,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:IYS1U0P9JXykMTUpcrvcYEAZxxE=","ja3":"","session":"92225c33-df22-46c4-bee2-f748be6d2f02","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:20:15","port":61885,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:DOkFKHL3k6q8oS/NSjWnHWikdAw=","ja3":"","session":"d690d993-c4a5-4533-b982-6e3946e1959e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T14:19:07","port":61379,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:cboRQ1/iqzj89sFb33PBlGWTG30=","ja3":"","session":"33f266d3-8c6d-4b1c-a2e4-2ff545f7aabd","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}}],"http_methods":[],"distinct_ports_total":9973,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-12T08:12:37.126409+00:00"}