{"ip":"45.195.250.117","total_events":56,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["56 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,136 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,136 bytes sent","bytes_sent":4136,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-16T03:23:06","last_seen":"2026-09-27T01:24:54","events_24h":0,"events_7d":12,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":212552,"org":"BitCommand LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":56}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-12","count":16},{"date":"2026-09-13","count":16},{"date":"2026-09-26","count":8},{"date":"2026-09-27","count":4}],"recent_events":[{"timestamp":"2026-09-27T01:24:54","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000l\u0010\u0000��:9D�NN�٪\u0018L_�P+�A�%\u0018�O�x��}���\u0004\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000006c1000c4ee3a3944d44e4eb3d9aa184c5fe9502ba141ad2518e44f9278b1cf7dc1e3ac0400000001","method":"","user_agent":"","ja3":"","session":"9fa5764e-4e58-4fba-baae-4f81108f5142","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-27T01:24:44","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000l\u0010\u0000�#�$���A���sմ��+�A�%\u0018�O�x��}���\u0003\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000006c1000b623e72486faaf4199d0c273d5b4d6e32ba141ad2518e44f9278b1cf7dc1e3ac0300000001","method":"","user_agent":"","ja3":"","session":"b8da2b53-c8a4-47d6-844f-7e6d75932a03","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-27T01:24:38","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000l\u0010\u0000�\u0013���\twL�`\u0012�ԟ�5+�A�%\u0018�O�x��}���\u0002\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000006c1000c213f9edfa09774cbc6012add49fb7352ba141ad2518e44f9278b1cf7dc1e3ac0200000001","method":"","user_agent":"","ja3":"","session":"63144a4f-93ae-4f94-96f1-0da5f5baffa7","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-27T01:24:36","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000l\u0010\u0000O���Ɏ�B��[�I\f�<+�A�%\u0018�O�x��}���\u0001\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000006c10004fceec86c98eb442a3905be5490cb83c2ba141ad2518e44f9278b1cf7dc1e3ac0100000001","method":"","user_agent":"","ja3":"","session":"3784728c-039f-49af-97ce-5b5c6b7f8a39","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14},{"timestamp":"2026-09-26T11:29:20","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0018h\u0000�H\u001a$\u0005 �E�+N�\"X>\u0013\u000b�t�W5iH�+\u001a�����\u0004\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000001868009c481a240520e045a52b4e9c22583e130b81748c57356948992b1a8eb5e9b8d40400000001","method":"","user_agent":"","ja3":"","session":"5c93601f-8f36-484a-ac1f-58dd70f089fa","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"da6c39afc360bae0","strings":["W5iH"]}},{"timestamp":"2026-09-26T11:29:10","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0018h\u0000q\u0002S�B�wD�3薽N��\u000b�t�W5iH�+\u001a�����\u0003\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04081252000000000000186800710253f042ca7744b333e896bd4ed1cf0b81748c57356948992b1a8eb5e9b8d40300000001","method":"","user_agent":"","ja3":"","session":"7795a55c-0a08-4b11-a318-3eae50050ef8","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"a1e002b859c91fa0","strings":["W5iH"]}},{"timestamp":"2026-09-26T11:29:05","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0018h\u0000��/{[װK�ـ�~\u0011�.\u000b�t�W5iH�+\u001a�����\u0002\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff04081252000000000000186800dadd2f7b5bd7b04bb4d980ae7e11992e0b81748c57356948992b1a8eb5e9b8d40200000001","method":"","user_agent":"","ja3":"","session":"943e517a-4515-4dd7-b94f-d2fc7ed8f018","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"a69ea9b4a5c3a5fc","strings":["W5iH"]}},{"timestamp":"2026-09-26T11:29:02","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000\u0018h\u0000,R�`�'WM��;I�Ӗ�\u000b�t�W5iH�+\u001a�����\u0001\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000001868002c52db60cd27574d99f23b49d3d396960b81748c57356948992b1a8eb5e9b8d40100000001","method":"","user_agent":"","ja3":"","session":"b93c27bd-ce36-449d-a2ec-6bb745587221","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"e17236c42e3007be","strings":["W5iH"]}},{"timestamp":"2026-09-26T08:00:21","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000LT\u0000b\u00158��ѿF�W�\u0017�N�f�\u0005��>Z�M�W \u0003���<\u0004\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000004c5400621538bfebd1bf469557d017d14ed766f205f2e13e5a984db85720038da3d33c0400000001","method":"","user_agent":"","ja3":"","session":"748f3d46-ecf7-42ce-b7d5-30cafd38ff39","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"0077e45cdd6a2881","strings":["RLTb"]}},{"timestamp":"2026-09-26T08:00:10","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001�\u0004\b\u0012R\u0000\u0000\u0000\u0000\u0000\u0000LT\u0000/��X�0�F���B\\v���\u0005��>Z�M�W \u0003���<\u0003\u0000\u0000\u0000\u0001","payload_hex":"1201005e00000100000024000601002a000102002b000103002c0004040030000105003100240600550001ff040812520000000000004c54002f98d858c7309046a993a0425c7686b8f205f2e13e5a984db85720038da3d33c0300000001","method":"","user_agent":"","ja3":"","session":"b6903435-3ee2-4ceb-a7a7-b101b9daf7d6","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":14,"enriched":{"digest":"4fb23ffb10571a06","strings":["RLT/"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-01T20:18:04.770072+00:00"}