{"ip":"46.167.204.188","total_events":40,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"18+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 18 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-04-23T21:35:36","last_seen":"2026-07-04T04:38:15","events_24h":0,"events_7d":0,"geo":{"country_code":"CZ","country_name":"Czechia","region":"Carlsbad Region","city":"Mariánské Lázně","lat":49.9608,"lon":12.7015,"asn":16019,"org":"Vodafone Czech Republic a.s."},"source_domain":"cust.tanet.cz","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3390,"proto":"tcp","label":"","count":6},{"port":3382,"proto":"tcp","label":"","count":2},{"port":3380,"proto":"tcp","label":"","count":2},{"port":3396,"proto":"tcp","label":"","count":2},{"port":3383,"proto":"tcp","label":"","count":2},{"port":3398,"proto":"tcp","label":"","count":2},{"port":3385,"proto":"tcp","label":"","count":2},{"port":3393,"proto":"tcp","label":"","count":2},{"port":3395,"proto":"tcp","label":"","count":2},{"port":3387,"proto":"tcp","label":"","count":2},{"port":3394,"proto":"tcp","label":"","count":2},{"port":3400,"proto":"tcp","label":"","count":2},{"port":3381,"proto":"tcp","label":"","count":2},{"port":3391,"proto":"tcp","label":"","count":2},{"port":3397,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-04","count":36}],"recent_events":[{"timestamp":"2026-07-04T04:38:15","port":3400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:Rdgc//APecs8I2HDzAzjMIjdezQ=","ja3":"","session":"f423c68b-55c3-4bc0-831d-44e576d5e9c3","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:15","port":3400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:UN6tBm3qOpCcc2KV8KBYJvLkJRk=","ja3":"","session":"d868f806-b88e-4140-9898-ba3d0df1bb52","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:15","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:j6AxFDrRpDLWZ2LqzT0VJnq4luc=","ja3":"","session":"4c2aa3b7-f733-4983-bf76-c2c49384dbd6","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:14","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:ao1iUwNISSdBalctEQcmDg3uEXc=","ja3":"","session":"2b1096f2-f806-4a82-8a4d-5e21d3c68ed2","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:14","port":3398,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:xcwwgg7QJN4coqm3kjYFBi3PMzc=","ja3":"","session":"4b134d87-d323-4dd3-9233-4bebccb835af","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:14","port":3398,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:MxRkh1ekt42ObKLHuqzMTiIhtcY=","ja3":"","session":"b8c936fa-90c7-435e-b6d3-68ab2620e8f3","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:14","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:VFqoMI0pykffjkqW1NRyd6XMVgc=","ja3":"","session":"2a54ff2c-abd1-4470-afdc-59a51c3716a2","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:14","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:RMzpy6MNSbJj6Fo8jUGeO3lhfxU=","ja3":"","session":"c065d975-c7bb-4c6b-aed6-295633d720fe","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:13","port":3396,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:WzSUk3H4D/ZCbR0mDzX9Spp6stc=","ja3":"","session":"9081fb55-792c-4fd0-aaf3-fc565f14583b","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-04T04:38:13","port":3396,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","community_id":"1:thldxl3Sy/cQxIsSVlFKb56Fw0c=","ja3":"","session":"eba3a48d-c651-4d68-97d2-357f13e26eb6","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}}],"http_methods":[],"distinct_ports_total":18,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-26T12:42:58.417620+00:00"}