{"ip":"45.227.253.156","total_events":5,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["5 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"337 bytes sent","bytes_sent":337,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T07:39:23","last_seen":"2026-09-23T08:50:23","events_24h":5,"events_7d":5,"geo":{"country_code":"PA","country_name":"Panama","region":"","city":"","lat":9.0,"lon":-80.0,"asn":209272,"org":"Alviva Holding Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":444,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":5443,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_c7ab7a5df584"],"tls_client_hello":"16030100ea010000e6030301038af8ab876b0257841aba19ee1d74a9cd80db78e667e9b593811e9931cfb7206242d6e45457521a9b8bcf5ae8371afdebd1e79d53363220a9df183e8f613f850014130213011303c02cc02bcca9c030c02fcca800ff01000089003300260024001d00209633a222f0aebf8f35ecb9d068f93a65a3ff5391124171f96dc62f217c17154d0010000b000908687474702f312e31000d001a001804010501060102010403050306030203080408050806080700050005010000000000170000002d00020101000b00020100002b00050403040303000a00080006001d0017001800230000","tls_ja3":["d2fc1fed86146ff3024a1d55cd3ff6f0","b5c88f73554c94c3ccd159e7d6ec9609","35d326c2fe29fcb244b0b3eef3956d73","3b1216dfbc36245362b8045d02458ad0","e765637e3c4e9ee4054ef0b501141f95"],"http_akin":["a11cun020_0000000a_78f1f19c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_c7ab7a5df584":5,"a11cun020_0000000a_78f1f19c":4},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":5}],"recent_events":[{"timestamp":"2026-09-23T08:50:23","port":4444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:4444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a343434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"3b1216dfbc36245362b8045d02458ad0","session":"845548bf-474c-4316-87dd-e5bb0151f89c","seq":1,"duration_ms":219,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-09-23T08:50:23","port":4444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:4444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a343434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"e765637e3c4e9ee4054ef0b501141f95","session":"679f7799-4897-493c-b3e7-14c155636164","seq":1,"duration_ms":217,"bytes_in":75,"bytes_out":79},{"timestamp":"2026-09-23T07:54:44","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a3434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"35d326c2fe29fcb244b0b3eef3956d73","session":"37a1df0c-7c1a-434f-a8c1-269d826cd6a3","seq":1,"duration_ms":215,"bytes_in":74,"bytes_out":79},{"timestamp":"2026-09-23T07:54:43","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a3434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b5c88f73554c94c3ccd159e7d6ec9609","session":"f136035c-7491-419e-9309-d75a401dead3","seq":1,"duration_ms":221,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-09-23T07:39:23","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:5443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a353434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"d2fc1fed86146ff3024a1d55cd3ff6f0","session":"16b804cd-a818-43f2-b445-857139992ac5","seq":1,"duration_ms":215,"bytes_in":63,"bytes_out":79}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/remote/login","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":5}],"top_alpns":[{"value":"http/1.1","count":5}],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"192.3.118.146:4444","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-23T16:01:27.443072+00:00"}