{"ip":"213.152.187.249","total_events":175,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"175+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 175 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,225 bytes sent","bytes_sent":8225,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-20T10:40:58","last_seen":"2026-08-20T10:41:04","events_24h":175,"events_7d":175,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":49453,"org":"Global Layer B.V."},"source_domain":"connected-by.global-layer.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49453","label":"Global Layer BV","category":"cdn","url":"https://www.peeringdb.com/asn/49453"},"cve_matches":[],"malware":[],"top_ports":[{"port":23500,"proto":"tcp","label":"","count":1},{"port":33500,"proto":"tcp","label":"","count":1},{"port":20100,"proto":"tcp","label":"","count":1},{"port":39700,"proto":"tcp","label":"","count":1},{"port":23400,"proto":"tcp","label":"","count":1},{"port":36600,"proto":"tcp","label":"","count":1},{"port":29000,"proto":"tcp","label":"","count":1},{"port":21600,"proto":"tcp","label":"","count":1},{"port":25600,"proto":"tcp","label":"","count":1},{"port":32200,"proto":"tcp","label":"","count":1},{"port":39500,"proto":"tcp","label":"","count":1},{"port":24400,"proto":"tcp","label":"","count":1},{"port":26800,"proto":"tcp","label":"","count":1},{"port":34700,"proto":"tcp","label":"","count":1},{"port":33400,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-20","count":175}],"recent_events":[{"timestamp":"2026-08-20T10:41:04","port":20400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"9cca575c-261f-44bc-aaa8-ff63878d1e3e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":21400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"b188c284-4bac-4d92-9d23-3d143890d6d3","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":21000,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"6b50e0bb-ce71-4bc8-968e-4d535d17f152","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":21600,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"2514d97c-6a00-403f-976e-0e8be3c72ab6","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":23000,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e2c5b987-c5b9-4f5f-8c24-61e82a185165","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":37400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"5a25cc00-e763-4dda-a51d-ed5990696750","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":35300,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e9f8a150-bb95-4c6e-a4d2-3d939811a0b3","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":37100,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"071fd635-c14b-4b30-ad88-9e842c36fbc3","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":36300,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"128615f5-df6a-4621-9c1c-2e74188770d7","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-08-20T10:41:02","port":37900,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"9821d00a-1c9b-42f7-a69f-74ec20b56555","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}}],"http_methods":[],"distinct_ports_total":175,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T19:09:13.964081+00:00"}