{"ip":"196.188.47.105","data_as_of":"2026-10-26T12:34:42+00:00","observed":true,"total_events":33,"verdict":{"verdict":"scanning","label":"Login attempts observed","detail":"2 interactive session(s) tried logins, none got in","confidence":"medium","network_type":"residential ISP","why":["2 interactive session(s) sent a username and password, and none of them got in.","No session reached a shell, so this is credential activity without a confirmed compromise.","The first-packet sensors recorded 33 event(s) from this address as well.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,265 bytes sent","bytes_sent":2265,"session_seconds":21,"persistent":false},"basis":"interactive"},"first_seen":"2026-08-18T06:14:54","last_seen":"2026-10-21T07:45:00","events_24h":0,"events_7d":2,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"smb","sessions":2}],"geo":{"country_code":"ET","country_name":"Ethiopia","region":"Addis Ababa","city":"Addis Ababa","lat":9.0245,"lon":38.7485,"asn":24757,"org":"Ethio Telecom"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as24757","label":"Ethio Telecom","category":"isp","url":"https://www.peeringdb.com/asn/24757"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-21T07:45:00","last_seen":"2026-10-21T07:45:00","verdicts":[{"verdict":"credential","sessions":2}],"personas":[{"persona":"smb@Windows Server 2016","sessions":2}],"services":[{"protocol":"smb","port":445,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":27,"sessions":0},{"port":445,"proto":"tcp","label":"SMB","count":6,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":3,"sessions":0},{"date":"2026-08-25","count":3,"sessions":0},{"date":"2026-08-27","count":3,"sessions":0},{"date":"2026-08-29","count":3,"sessions":0},{"date":"2026-09-12","count":3,"sessions":0},{"date":"2026-09-14","count":3,"sessions":0},{"date":"2026-09-18","count":3,"sessions":0},{"date":"2026-09-24","count":3,"sessions":0},{"date":"2026-09-27","count":2,"sessions":0},{"date":"2026-09-29","count":3,"sessions":0},{"date":"2026-10-16","count":2,"sessions":0},{"date":"2026-10-20","count":2,"sessions":0},{"date":"2026-10-21","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-21T07:44:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000A�SMB%\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b@'\u0000\b6*\u000f\u0000\u0000\u0000\u0000��\u0000\b\u0002\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000#\u0000\u0000\u0000","payload_hex":"00000041ff534d422500000000180148000000000000000000000000010840270008362a0f00000000ffff000802000000ffffffff00000000000000000000010023000000","method":"","user_agent":"","ja3":"","session":"6ca31c9f-b3a5-4b32-ac44-c76ca9a395ac-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0413d2c154cb49ed","strings":["SMB%"]},"interactive":true},{"timestamp":"2026-10-21T07:44:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000G�SMBu\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\b\u0000\u0000\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\<HONEYPOT>\\IPC$\u0000?????\u0000","payload_hex":"00000047ff534d427500000000180148000000000000000000000000ffff40270008000004ff000000000001001c00005c5c3c484f4e4559504f543e5c49504324003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"6ca31c9f-b3a5-4b32-ac44-c76ca9a395ac-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e44be974a427043d","strings":["SMBu","\\\\<HONEYPOT>\\IPC$","\\\\<HONEYPOT>\\IPC$?????"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\b\u0000\u0000\f�\u0000\u0000\u0000\u0004\u0011\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000Y\u0000\u0000\u0000\u0000\u0000D�\u0000�d\u0000�W0U�S\u0004QNTLMSSP\u0000\u0003\u0000\u0000\u0000\u0001\u0000\u0001\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000A\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0010\u0000\u0010\u0000A\u0000\u0000\u0000\u0005\u0002��\u0000�w�\n�d\u001fW�t\u00176\u001d�\u0003Unix\u0000Samba\u0000","payload_hex":"0000009fff534d427300000000180148000000000000000000000000ffff4027000800000cff0000000411020001000000000059000000000044c000806400a1573055a25304514e544c4d5353500003000000010001004000000000000000410000000000000040000000000000004000000000000000400000001000100041000000050288a000b577df0af5641f57ee747f17361da403556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"c6ad82b8-9326-4eb6-96e7-f94043931676-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"614c8787fade75f0","strings":["SMBs","QNTLMSSP","Unix","Samba","@A@@@","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\b\u0000\u0000\f�\u0000\u0000\u0000\u0000�\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000Y\u0000\u0000\u0000\u0000\u0000D�\u0000�d\u0000�W0U�S\u0004QNTLMSSP\u0000\u0003\u0000\u0000\u0000\u0001\u0000\u0001\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000A\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0010\u0000\u0010\u0000A\u0000\u0000\u0000\u0005\u0002��\u0000�P�\u0004�\\-m�A_\u00016\\�\u001dUnix\u0000Samba\u0000","payload_hex":"0000009fff534d427300000000180148000000000000000000000000ffff4027000800000cff00000000f0020001000000000059000000000044c000806400a1573055a25304514e544c4d5353500003000000010001004000000000000000410000000000000040000000000000004000000000000000400000001000100041000000050288a000b850ee04c15c2d6dc2415f01365cfb1d556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"6ca31c9f-b3a5-4b32-ac44-c76ca9a395ac-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f7da586f16ee71d2","strings":["SMBs","QNTLMSSP","Unix","Samba","@A@@@","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\u0000\u0000\u0000\f�\u0000\u0000\u0000\u0004\u0011\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000B\u0000\u0000\u0000\u0000\u0000D�\u0000�M\u0000`@\u0006\u0006+\u0006\u0001\u0005\u0005\u0002�604�\u000e0\f\u0006\n+\u0006\u0001\u0004\u0001�7\u0002\u0002\n�\"\u0004 NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0005\u0002��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Unix\u0000Samba\u0000","payload_hex":"00000088ff534d427300000000180148000000000000000000000000ffff4027000000000cff0000000411020001000000000042000000000044c000804d00604006062b0601050502a0363034a00e300c060a2b06010401823702020aa22204204e544c4d5353500001000000050288a000000000000000000000000000000000556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"c6ad82b8-9326-4eb6-96e7-f94043931676-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fabca00993155b11","strings":["SMBs","NTLMSSP","Unix","Samba","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\u0000\u0000\u0000\f�\u0000\u0000\u0000\u0000�\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000B\u0000\u0000\u0000\u0000\u0000D�\u0000�M\u0000`@\u0006\u0006+\u0006\u0001\u0005\u0005\u0002�604�\u000e0\f\u0006\n+\u0006\u0001\u0004\u0001�7\u0002\u0002\n�\"\u0004 NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0005\u0002��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Unix\u0000Samba\u0000","payload_hex":"00000088ff534d427300000000180148000000000000000000000000ffff4027000000000cff00000000f0020001000000000042000000000044c000804d00604006062b0601050502a0363034a00e300c060a2b06010401823702020aa22204204e544c4d5353500001000000050288a000000000000000000000000000000000556e69780053616d626100","method":"","user_agent":"","ja3":"","session":"6ca31c9f-b3a5-4b32-ac44-c76ca9a395ac-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ac9674d41c1cc85a","strings":["SMBs","NTLMSSP","Unix","Samba","UnixSamba"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff402700000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"c6ad82b8-9326-4eb6-96e7-f94043931676-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9c7579e69686ff9b","strings":["SMBr","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-21T07:44:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��@'\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff402700000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"6ca31c9f-b3a5-4b32-ac44-c76ca9a395ac-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9c7579e69686ff9b","strings":["SMBr","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-20T12:52:07","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��H#\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff482300000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"61fd8b69-0d45-4017-b610-4d7ba4ef7475","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"cbd878d2cedfaa4f","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-10-20T12:52:07","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��H#\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d427200000000180148000000000000000000000000ffff482300000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"af437a9a-aee2-4607-9e90-4ed6e7b988d2","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"cbd878d2cedfaa4f","strings":["SMBr","NT LM 0.12"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}