{"ip":"77.239.124.110","total_events":281,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["281 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 12,926 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,926 bytes sent","bytes_sent":12926,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T12:25:33","last_seen":"2026-09-29T13:16:34","events_24h":0,"events_7d":281,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":281}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":281}],"recent_events":[{"timestamp":"2026-09-29T13:16:34","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"40ebf732-683c-4daa-9070-dfbcabfc7df9","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"b2eebd5a-b30b-4d12-99fa-89be457838d2","seq":1,"duration_ms":131,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"7086833c-6b2d-44f3-b96d-61332c449259","seq":1,"duration_ms":131,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"2b0e06c2-fbce-42d0-b9cf-380eda9bc5cb","seq":1,"duration_ms":132,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"9a0eea6d-ba20-4bd4-a2df-2832e044c05b","seq":1,"duration_ms":132,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"8f0b21bb-e30e-4fa1-9e91-71facf48b341","seq":1,"duration_ms":132,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"6ef37780-5b04-4d42-9910-ee01f1ced541","seq":1,"duration_ms":132,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"c37c6116-0f8c-4255-b23f-dc57c1b71b13","seq":1,"duration_ms":133,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"3dff4928-4173-4a79-94e1-e69c13ee3b3c","seq":1,"duration_ms":133,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}},{"timestamp":"2026-09-29T12:25:33","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=rdpbrute\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d72647062727574650d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"9d4b52c3-7caf-4093-a4ae-d5db02487a41","seq":1,"duration_ms":133,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"aa69bb7ba9ad3595","label":"RDP (X.224)","strings":["Cookie: mstshash=rdpbrute"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T17:58:49.466349+00:00"}