{"ip":"23.88.4.105","total_events":15,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["15 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"285 bytes sent","bytes_sent":285,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-21T21:14:09","last_seen":"2026-09-23T21:06:21","events_24h":0,"events_7d":3,"geo":{"country_code":"DE","country_name":"Germany","region":"Saxony","city":"Falkenstein","lat":50.4777,"lon":12.3649,"asn":24940,"org":"Hetzner Online GmbH"},"source_domain":"static.105.4.88.23.clients.your-server.de","known_scanners":[],"scanner_tag":{"key":"hetzner","label":"Hetzner","category":"hosting_provider","url":"https://www.hetzner.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-21","count":12},{"date":"2026-09-23","count":3}],"recent_events":[{"timestamp":"2026-09-23T21:06:21","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"4aed8d0a-478d-480c-b2f8-f45f6a2344ed","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-23T21:06:11","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"81f570cb-4559-4e7f-a56f-e5cc36777552","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-23T21:06:01","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9a30a82b-179e-49bc-b23c-dac69bb29b91","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:57","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3ddfe5b7-4523-48be-abcf-119f3afc7c93","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:56","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9137da83-3b05-4ffa-ad0f-efb1beaf6e13","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:45","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"dc986982-790b-44d3-a106-b39e29b93b4f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:45","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3e02bb9c-5d83-45a1-b6d0-9f110ac11aea","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:32","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"2441676e-5600-4146-99fd-ec5025cef85f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:21:30","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"a9aacd5d-fe0a-4833-a4af-9f9802d371e8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-21T21:14:30","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3e9a4cc1-da5b-40b3-b5f3-6ebad8014f1b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T12:53:43.456908+00:00"}