{"ip":"31.164.245.127","total_events":28761,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"28,761 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["28,761 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 4222s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"12,944,697,271 bytes sent, longest session 4222s","bytes_sent":12944697271,"session_seconds":4222,"persistent":true}},"first_seen":"2026-08-25T12:02:57","last_seen":"2026-08-25T13:13:19","events_24h":0,"events_7d":28761,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Geneva","city":"Geneva","lat":46.2253,"lon":6.1516,"asn":6730,"org":"Sunrise GmbH"},"source_domain":"xdsl-31-164-245-127.adslplus.ch","known_scanners":[],"scanner_tag":{"key":"peeringdb:as6730","label":"Sunrise GmbH","category":"isp","url":"https://www.peeringdb.com/asn/6730"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":28761}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-25","count":28761}],"recent_events":[{"timestamp":"2026-08-25T13:13:19","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"J^X�����\u000ff�D�i��*P�L","payload_hex":"4a5e588f9596f7db0f66dd448869b39c2a50e14c","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28761,"duration_ms":4221800,"bytes_in":891171,"bytes_out":402573},{"timestamp":"2026-08-25T13:13:19","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"mʓ�*�Hb)M��\u000f+�8�\u0012m\"O�\u0016n��^�\u0003��1A\u000f{\u001c","payload_hex":"6dca93852ad64862294df29c0f2bf138fd126d224fdf166e97e35e9603d6d931410f7b1c","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28760,"duration_ms":4221670,"bytes_in":891151,"bytes_out":402559,"enriched":{"digest":"a1ed7f9b46f05a43","strings":["Hb)M"]}},{"timestamp":"2026-08-25T13:13:19","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0007\u000f\u001a~��\u0016\u0017��rO(\u0006��","payload_hex":"070f1a7ef7d31617aee1724f2806ecd6","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28759,"duration_ms":4221569,"bytes_in":891115,"bytes_out":402545},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ʋl� \u001f4��\u001d��XBD���w","payload_hex":"ca8b6cc3201f34efe01d8982584244a4e6c877","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28758,"duration_ms":4221462,"bytes_in":891099,"bytes_out":402531},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001a\"��qc\u0006(2��3�","payload_hex":"1a228997716306283290af33ee","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28757,"duration_ms":4221334,"bytes_in":891080,"bytes_out":402517},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�9�u��","payload_hex":"9239c075a8d6","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28756,"duration_ms":4221189,"bytes_in":891067,"bytes_out":402503},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001d#-��W","payload_hex":"df1d232dfbff57","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28755,"duration_ms":4221007,"bytes_in":891061,"bytes_out":402489},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"#Ep��j\u000f\u0005ڲQ�y�#oh7�","payload_hex":"234570fcdd6a0f05dab2519b79fd236f6837b0","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28754,"duration_ms":4220757,"bytes_in":891054,"bytes_out":402475,"enriched":{"digest":"6c329fccc1f634e5","strings":["#oh7"]}},{"timestamp":"2026-08-25T13:13:18","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0004W���==Qb�\n.��\u0012������@����\u0002!\u000f\b؇\u001c\u0018#�","payload_hex":"e90457a7a5b33d3d5162e60a2ef29912fc98a0bea9cc40b1a8aaab02210f08d8871c1823cb","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28753,"duration_ms":4220648,"bytes_in":891035,"bytes_out":402461,"enriched":{"digest":"7704486d8eac9bb1","strings":["==Qb"]}},{"timestamp":"2026-08-25T13:13:17","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��!d�\u0010\u001c_<���\u0018\u001bb\r\f�w����i��\u001er","payload_hex":"dee72164b0101c5f3c94d8fa181b620d0c9377fdacbdc169b6c21e72","method":"","user_agent":"","ja3":"","session":"ba45a513-d434-40e2-bba5-c7a1d9f330fa","seq":28752,"duration_ms":4220544,"bytes_in":890998,"bytes_out":402447}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-27T10:54:48.371978+00:00"}