{"ip":"64.224.17.124","total_events":43,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"41+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 41 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"817 bytes sent","bytes_sent":817,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-02T20:54:31","last_seen":"2026-08-04T03:49:38","events_24h":0,"events_7d":43,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":399486,"org":"12651980 CANADA INC."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as399486","label":"Virtuo.Host (AS399486)","category":"cdn","url":"https://www.peeringdb.com/asn/399486"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":3},{"port":3388,"proto":"tcp","label":"","count":1},{"port":3395,"proto":"tcp","label":"","count":1},{"port":3390,"proto":"tcp","label":"","count":1},{"port":3393,"proto":"tcp","label":"","count":1},{"port":3385,"proto":"tcp","label":"","count":1},{"port":3362,"proto":"tcp","label":"","count":1},{"port":3387,"proto":"tcp","label":"","count":1},{"port":3396,"proto":"tcp","label":"","count":1},{"port":3380,"proto":"tcp","label":"","count":1},{"port":3382,"proto":"tcp","label":"","count":1},{"port":3398,"proto":"tcp","label":"","count":1},{"port":3370,"proto":"tcp","label":"","count":1},{"port":3365,"proto":"tcp","label":"","count":1},{"port":3377,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-02","count":2},{"date":"2026-08-04","count":41}],"recent_events":[{"timestamp":"2026-08-04T03:49:38","port":3374,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"62e4626c-a9f7-4997-84d1-1a630f050024","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:46:56","port":3378,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"8075ed8b-13cb-4db6-96d5-260142117def","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:45:20","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"97621e8b-dae5-4707-8b03-bcc89b211c56","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:42:50","port":3367,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"1b72c042-71c1-4a25-9d83-0b77c107c6a2","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:42:16","port":3394,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"bece0bf3-f801-4efe-92f6-e1e776152396","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:36:55","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"0d6ae537-1929-47f0-9639-311f05ef1af2","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:31:29","port":3371,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3bfeefd9-9cd4-435f-b7f4-2e936d322fe1","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:30:47","port":3379,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"5599ffe5-ee42-454c-bda6-ae970164d75d","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:28:11","port":3368,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"0882a2eb-dbdb-49ff-8dbe-dfdc7ed8090f","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-04T03:27:45","port":3372,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"a1bfb9e2-3c13-4d95-869b-3fd85139ca35","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":41,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-08T06:10:13.135898+00:00"}