{"ip":"31.22.104.117","total_events":1165,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,165 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,165 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"43,471 bytes sent","bytes_sent":43471,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T05:26:29","last_seen":"2026-09-30T05:26:48","events_24h":1165,"events_7d":1165,"geo":{"country_code":"FI","country_name":"Finland","region":"Uusimaa","city":"Helsinki","lat":60.1719,"lon":24.9347,"asn":198020,"org":"Verda Cloud Oy"},"source_domain":"31-22-104-117.nodes.verda.host","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5434,"proto":"tcp","label":"","count":1165}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-30","count":1165}],"recent_events":[{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000$\u0000\u0003\u0000\u0000user\u0000app\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002400030000757365720061707000646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"f8fc59de-237a-4e05-81a4-efb6fdb62201","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":13,"enriched":{"digest":"a0cee097613dde7a","strings":["user","database","postgres","userappdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000$\u0000\u0003\u0000\u0000user\u0000web\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002400030000757365720077656200646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"f3c3eae8-c31e-4458-a4d9-1303f7f95624","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":13,"enriched":{"digest":"a520967e28a33187","strings":["user","database","postgres","userwebdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000$\u0000\u0003\u0000\u0000user\u0000www\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002400030000757365720077777700646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"1cdb33d5-5a69-402c-b747-a73ebc1ff978","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":13,"enriched":{"digest":"b45c7387f7b9900c","strings":["user","database","postgres","userwwwdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000user\u0000pg\u0000database\u0000postgres\u0000\u0000","payload_hex":"00000023000300007573657200706700646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"d2056d3a-7758-48b2-b0dc-bc83231e77f4","seq":1,"duration_ms":100,"bytes_in":35,"bytes_out":13,"enriched":{"digest":"076ad8326de2b47e","strings":["user","database","postgres","userpgdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000$\u0000\u0003\u0000\u0000user\u0000dba\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002400030000757365720064626100646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"6360cc4b-9d8c-400e-9e53-5ad27bec64c5","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":13,"enriched":{"digest":"bd4917d4a5f59f83","strings":["user","database","postgres","userdbadatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000(\u0000\u0003\u0000\u0000user\u0000doadmin\u0000database\u0000postgres\u0000\u0000","payload_hex":"00000028000300007573657200646f61646d696e00646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"fa4b3339-6aa1-48f7-b87a-4ff3795c3c40","seq":1,"duration_ms":100,"bytes_in":40,"bytes_out":13,"enriched":{"digest":"a981b19e427e558d","strings":["user","doadmin","database","postgres","userdoadmindatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000)\u0000\u0003\u0000\u0000user\u0000avnadmin\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002900030000757365720061766e61646d696e00646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"3c2104d0-e963-4365-9eec-62d376c66f66","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":13,"enriched":{"digest":"5d9a08ced9142a48","strings":["user","avnadmin","database","postgres","useravnadmindatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000)\u0000\u0003\u0000\u0000user\u0000postgres\u0000database\u0000postgres\u0000\u0000","payload_hex":"00000029000300007573657200706f73746772657300646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"b22a9488-4ce6-4f56-90e6-1b8d65c5582d","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":13,"enriched":{"digest":"048e7dc19b9dd120","strings":["user","postgres","database","userpostgresdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000%\u0000\u0003\u0000\u0000user\u0000user\u0000database\u0000postgres\u0000\u0000","payload_hex":"000000250003000075736572007573657200646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"36c46fc3-145f-41ad-b44d-1ba1333e97d7","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":13,"enriched":{"digest":"b1b839f8ee22062e","strings":["user","database","postgres","useruserdatabasepostgres"]}},{"timestamp":"2026-09-30T05:26:48","port":5434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000&\u0000\u0003\u0000\u0000user\u0000admin\u0000database\u0000postgres\u0000\u0000","payload_hex":"0000002600030000757365720061646d696e00646174616261736500706f7374677265730000","method":"","user_agent":"","ja3":"","session":"237cb692-5af2-4852-a99c-a5da62396661","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":13,"enriched":{"digest":"e0449c04967780ac","strings":["user","admin","database","postgres","useradmindatabasepostgres"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T09:59:40.989804+00:00"}