{"ip":"75.119.157.247","total_events":39,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"20+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 20 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,677 bytes sent","bytes_sent":1677,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-15T03:21:53","last_seen":"2026-07-15T03:22:10","events_24h":0,"events_7d":0,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi1799298.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3382,"proto":"tcp","label":"","count":2},{"port":3380,"proto":"tcp","label":"","count":2},{"port":3396,"proto":"tcp","label":"","count":2},{"port":3387,"proto":"tcp","label":"","count":2},{"port":3398,"proto":"tcp","label":"","count":2},{"port":3383,"proto":"tcp","label":"","count":2},{"port":3393,"proto":"tcp","label":"","count":2},{"port":3390,"proto":"tcp","label":"","count":2},{"port":3395,"proto":"tcp","label":"","count":2},{"port":3388,"proto":"tcp","label":"","count":2},{"port":3385,"proto":"tcp","label":"","count":2},{"port":3394,"proto":"tcp","label":"","count":2},{"port":3397,"proto":"tcp","label":"","count":2},{"port":3386,"proto":"tcp","label":"","count":2},{"port":3381,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-15","count":39}],"recent_events":[{"timestamp":"2026-07-15T03:22:10","port":3400,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"e68e388e-7186-4ea8-b179-c91b028208b8","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:05","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"f90c8b90-e7fb-47bf-a74f-ff955bfe26c5","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:05","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"d2bce1cf-777b-421b-ae8f-3f5aa10e6740","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:05","port":3398,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"c9c25ed3-8d72-4944-9a35-d44746ad66c1","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:05","port":3398,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"262761b9-4f7e-4d5e-aba6-5d72a9a84d2b","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:04","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"7029c77b-0e3b-45ed-aa06-97831e1a5bc2","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:04","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"87c06f55-22c3-4a3c-b823-ae146665cc60","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:04","port":3396,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"ba1d70f2-88d6-4dac-aa66-1c27a4fc962d","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:04","port":3396,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"11309e38-a8cc-494a-802c-53e7ec825afb","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}},{"timestamp":"2026-07-15T03:22:04","port":3395,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Almaz\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d416c6d617a0d0a0100080002000000","method":"","user_agent":"","ja3":"","session":"7412f1a0-0ae1-477b-8a64-2e440e024514","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"e2a4759afc7bd701","label":"RDP (X.224)","strings":["Cookie: mstshash=Almaz"]}}],"http_methods":[],"distinct_ports_total":20,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-25T17:20:38.419731+00:00"}