{"ip":"194.180.49.102","total_events":79684,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19317+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 19317 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,513,996 bytes sent","bytes_sent":1513996,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-03T17:16:16","last_seen":"2026-08-12T02:22:43","events_24h":0,"events_7d":39925,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":201814,"org":"MEVSPACE sp. z o.o."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as201814","label":"Mevspace","category":"cdn","url":"https://www.peeringdb.com/asn/201814"},"cve_matches":[],"malware":[],"top_ports":[{"port":23943,"proto":"tcp","label":"","count":18},{"port":25430,"proto":"tcp","label":"","count":18},{"port":20994,"proto":"tcp","label":"","count":18},{"port":21955,"proto":"tcp","label":"","count":15},{"port":23788,"proto":"tcp","label":"","count":15},{"port":26070,"proto":"tcp","label":"","count":15},{"port":26065,"proto":"tcp","label":"","count":15},{"port":23673,"proto":"tcp","label":"","count":15},{"port":29041,"proto":"tcp","label":"","count":15},{"port":23924,"proto":"tcp","label":"","count":15},{"port":29621,"proto":"tcp","label":"","count":15},{"port":25653,"proto":"tcp","label":"","count":13},{"port":21821,"proto":"tcp","label":"","count":13},{"port":21352,"proto":"tcp","label":"","count":12},{"port":25066,"proto":"tcp","label":"","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-03","count":19345},{"date":"2026-08-04","count":20414},{"date":"2026-08-11","count":31017},{"date":"2026-08-12","count":8908}],"recent_events":[{"timestamp":"2026-08-12T02:22:43","port":21028,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"1ad2daba-be88-492b-ae86-59813c586bda","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:42","port":21028,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c7f05a1e-6d55-4d76-aadd-2b6813cabff7","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:42","port":21028,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"2e6090b0-e987-4992-8239-e949f5ce6464","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:42","port":21028,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"4030c71b-4234-4f46-8513-d13328c001e2","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":25304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"f0d30051-6850-4022-ab7f-aceb299ec30b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":21046,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"04009c2a-9d3a-411b-9590-f0570a98e7bb","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":25304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"2ebbeda2-e969-46f1-ad16-eb1f39dcac7c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":28432,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"45e643c0-481c-49c7-9055-86dcdfed4607","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":25304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"300c8473-8ed6-4d02-bc07-3b3d45dd9f26","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-12T02:22:33","port":25304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"090b17be-da8a-4368-b54c-62cf5142cc31","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":19317,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T07:45:08.009235+00:00"}