{"ip":"62.164.177.54","total_events":20302,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"5390+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 5390 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-02T03:28:38","last_seen":"2026-07-11T16:12:28","events_24h":2126,"events_7d":14242,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":215929,"org":"Data Campus Limited"},"source_domain":"62-164-177-54.adsl.surfdsl.net","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":21974,"proto":"tcp","label":"","count":14},{"port":45591,"proto":"tcp","label":"","count":12},{"port":30656,"proto":"tcp","label":"","count":12},{"port":12688,"proto":"tcp","label":"","count":12},{"port":21916,"proto":"tcp","label":"","count":12},{"port":19451,"proto":"tcp","label":"","count":12},{"port":3859,"proto":"tcp","label":"","count":12},{"port":49891,"proto":"tcp","label":"","count":12},{"port":47801,"proto":"tcp","label":"","count":12},{"port":30177,"proto":"tcp","label":"","count":12},{"port":36072,"proto":"tcp","label":"","count":12},{"port":35425,"proto":"tcp","label":"","count":12},{"port":2776,"proto":"tcp","label":"","count":12},{"port":14334,"proto":"tcp","label":"","count":12},{"port":19321,"proto":"tcp","label":"","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-02","count":2076},{"date":"2026-07-03","count":1974},{"date":"2026-07-04","count":2010},{"date":"2026-07-05","count":1922},{"date":"2026-07-06","count":2058},{"date":"2026-07-07","count":2007},{"date":"2026-07-08","count":1899},{"date":"2026-07-09","count":2096},{"date":"2026-07-10","count":2134},{"date":"2026-07-11","count":2126}],"recent_events":[{"timestamp":"2026-07-11T16:12:28","port":43676,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:6mK/T3FrWIwjds8dunLvn7cqS5E=","ja3":"","session":"c664652f-ae0c-4138-a421-a5411d37ca36","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:12:24","port":45387,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:5ksQtOXxncbkKACNSdlMxN4FvpY=","ja3":"","session":"cc4a7244-8837-4275-8058-3857e92a8c64","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:57","port":45477,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:dU4LfahXKKaUzzEF230vC091Y8Q=","ja3":"","session":"1b31d13c-6583-4873-97ca-37acbcd361b5","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:43","port":44321,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:8H1OOE6MIbE7cRCkh98CAIK7Ulg=","ja3":"","session":"47b4f5ab-6648-4fbe-b927-c27aec792979","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:37","port":40685,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:ReTDWMQA5Iq+Nurb9iu32sqlIng=","ja3":"","session":"ec9cf8b4-cd1b-4c77-b227-de4dda96c80c","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:27","port":39760,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:24DykZq6Z039Wnm/QQG7YZdPQfY=","ja3":"","session":"bbe0a148-2340-435a-a1d2-d315a517b3d3","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:26","port":41284,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:BGIH8FLXaKgLyxP3zzGzB50SFGs=","ja3":"","session":"37a0f6a0-5256-42f2-ba97-0c043f8679c3","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:11:10","port":40890,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:AIvQSdKPBMP5r4ZCOkZg1t9raxc=","ja3":"","session":"49a01d36-4b25-495d-ba1c-96c48d9cf624","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:10:53","port":44382,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:UEeU2ccGWD7jPZjP1/uDHYrVgGM=","ja3":"","session":"5a216627-b749-4f3a-98fe-96f573dce621","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-11T16:10:08","port":43227,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:YEkkByS6rS37IbW9YKguQXUrMaI=","ja3":"","session":"0d4b3d8b-3a9c-4a25-ae41-a41dd3913a92","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}}],"http_methods":[],"distinct_ports_total":5390,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-11T20:17:07.314661+00:00"}