{"ip":"77.239.124.135","data_as_of":"2026-10-27T00:35:27+00:00","observed":true,"total_events":32,"verdict":{"verdict":"scanning","label":"Login attempts observed","detail":"8 interactive session(s) tried logins, none got in","confidence":"high","network_type":null,"why":["8 interactive session(s) sent a username and password, and none of them got in.","No session reached a shell, so this is credential activity without a confirmed compromise.","The first-packet sensors recorded 32 event(s) from this address as well.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,772 bytes sent","bytes_sent":5772,"session_seconds":26,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T03:35:49","last_seen":"2026-10-25T13:57:34","events_24h":0,"events_7d":32,"interactive_sessions":27,"interactive_sessions_24h":0,"interactive_sessions_7d":27,"interactive_protocols":[{"protocol":"vnc","sessions":24},{"protocol":"http","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":27,"first_seen":"2026-10-21T03:35:49","last_seen":"2026-10-25T13:57:34","verdicts":[{"verdict":"scan","sessions":18},{"verdict":"credential","sessions":8},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"vnc@RealVNC Server 6.11.0","sessions":24},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":2}],"services":[{"protocol":"vnc","port":5900,"sessions":9},{"protocol":"vnc","port":5902,"sessions":9},{"protocol":"vnc","port":5901,"sessions":6},{"protocol":"http","port":20128,"sessions":2},{"protocol":"tcp","port":5975,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":18},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":8},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":8}]},"top_ports":[{"port":5000,"proto":"tcp","label":"Web-alt","count":23,"sessions":0},{"port":5900,"proto":"tcp","label":"VNC","count":0,"sessions":9},{"port":5902,"proto":"tcp","label":"VNC","count":0,"sessions":9},{"port":20128,"proto":"tcp","label":"","count":4,"sessions":2},{"port":5901,"proto":"tcp","label":"VNC","count":0,"sessions":6},{"port":4000,"proto":"tcp","label":"","count":3,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2,"sessions":0},{"port":5975,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i871000_c66346c74e42_ec21bdc2dd35","t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"160301066f0100066b03033d0ac249619eb1954783aeae4f80e093ab625d469bbfa4bb04cd30308a91bd2920e2f22d75d4220d1bd7adf5be3500045934d672229a112aa78b3c234ed67ef5a300ae130213031301c02cc03000a3009fcca9cca8ccaac0adc09fc05dc061c057c05300a7c02bc02f00a2009ec0acc09ec05cc060c056c05200a6c0afc0aec0a3c0a2c024c028006b006ac073c07700c400c3006d00c5c023c02700670040c072c07600be00bd006c00bfc00ac0140039003800880087c019003a0089c009c0130033003200450044c01800340046009dc09dc051009cc09cc050c0a1c0a0003d00c0003c00ba00350084002f004100ff01000574000b000403000102000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d003c003a09050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003304ea04e811ec04c087b2c2af51a82eb747ec80107e5481e256614b9b1b06dc2e2df0ca2fc8991aa288e069b3cb7b4222077ddda6ad5064719f4a2cbc43412217b4dda51c7c827758052b35fb5bced65cf3a17e52697aeb78b36cd3cbb85cc0c89c491849a40a8a77ba8c808ba951879578434399031530eb49474aa46bf3c54b8bd47efad4aca1f07b507b0f47680cb56588b8b453540293092073552b0f17b1a8af03872b7b6291a06b8be7921ad193a3fb38439c0a14b35f0931adf387a49fccb8900840130848157c30fabbc8aea02a0494cf32f78ab069056376a82fe49a06873a44ac5561c47f67235304710ea4379e1b1c116e5b149dda8d597053b8457b3086bc41773770a8587b9159d27ba008f77a8f843a06214414bb8383b9af52c8c631f7659a523ed791a4826096454c45a1a1b7a6c698088c4fdb4cc9d27766f8e1930411c955c671f4133503559f5fe17ca33b0158057d2175b0de4534137330b5d1256ce55c8386b35630b6d6b0ace15256a6b69916c95b9342ac4fb3616dcb7fd607a129b212cb73c82151626c793d5d75a18df996c4207b3157afae5bbcf64227141a4744a8b271192dcad3a83a1ba9b0533e1aea792c8821b821b5807bb645f497df1b49784914839743d7863cc6c075e99a066cb469dcc658a9451548f331bc152da8dbb3838574a0e06db6a86bb4104c5792048d837320ec91f4657e1c986449574f26047daf61bc67681cd6026d79668a0d9b8f697484e6349525a4608bc4409d4a83ae11655763b326b71af2154962f7cc33f7ba57268ceeca31664b01226bbd52a83b92260541b15485a32f1ee21b4ee414f1a21ecb614da43a7a23aca45213c9aff51b54a5c12adc8ea905cfe5dbc044e959c1d028c3dbcc2bf5aa4fd841814b5cc094059a2714eb23c774db3a4d02af786ab1be238c83c78f9290cea8e1234d9223059b087e119a01f32427a9590196b8196b1a02560b94aacdb5d6bee7c3aff42057528bcd56215e2ac64b271440ca0597ced75a5e056db9bb9d239747cf8868bd7611ccb289af8530aa95acf1c50ba5e9bca4018ec100262b134bbdac8af57040b838243ecb872f8183782ac882f7c530f6343890132eb51229eaaaefdbcc6505597ab5751768362ce23d6b6b736e467b9a70cce367026722c3b6e8570b8a4f84358614578d0ce8905fb66caf143422615fdfc0b6555c58ccec610d04bc419b142506d0d184639a4cc55c2118f14a5e5f06a13f1a921b379d953470b8b06f84515c8ec30a0c4c3e0838c360514ea2f829d6cb22c3bac756b54577eb51a5258acd6b00ec362e7b54b4c3ac9f32f8caa07377f0a141d02818486a78cea9007de7c946d4b9d435971506aef406c37e00bb42a934e33931eb3c5e217425d154b33ef8aee783c40d6a33453705d13c7c1cd5bc8b5a98b8a3b5e0641571890209c4102a2219218a22fbe563e041c846443cb0b2324517090ceb358f997ea2dc683347661994293eda0d45b02b58498443b299ef303862b6b0d7b57d3b1ac51918773a688c06a08ed8ac715ad9c41a19614b2808569a3d362b1eb33290d1e30188d9709d1960abe01318420a8aa78df8fc152263acbfe9283cc21fdc1535f4d436119ba7ed1ea417fcd868d7a1d0631983585092b8dc7656b5827e4979f88e24631c7788fa34a2f9d98b13e829be4db8d3eb004dc43043b356add55a21440410eaaaaa40001d00200d6124028f665db313572fbf8ab742aef7898ba358488ed1d416cbf0f57b0b63001b0005","tls_ja3":["6639916abfac56b9257ca216677085bc","9f5ce6b6eeafa663b2a8c933127e7f5f"],"http_akin":["b10cun030_00040011_c91eaf54","b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i871000_c66346c74e42_ec21bdc2dd35"],"tls_ja3":["9f5ce6b6eeafa663b2a8c933127e7f5f"]}},"fingerprint_peers":{"t13i871000_c66346c74e42_ec21bdc2dd35":2,"t13i130900_f57a46bbacb6_e7c285222651":2727,"b11cun040_00040013_608dab68":4347,"b10cun030_00040011_c91eaf54":31},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; vncjew-exposure/1.0)","9router/1.0"],"timeline":[{"date":"2026-10-21","count":0,"sessions":1},{"date":"2026-10-22","count":23,"sessions":3},{"date":"2026-10-23","count":2,"sessions":9},{"date":"2026-10-24","count":7,"sessions":11},{"date":"2026-10-25","count":0,"sessions":3}],"recent_events":[{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0001\u0000\u0000\u0000\u0000\u0007�\u00048","payload_hex":"03010000000007800438","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-14","seq":14,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0001\u0000\u0000\u0000\u0000\u0007�\u00048","payload_hex":"03010000000007800438","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0000\u0000\u0000\u0007�\u00048","payload_hex":"03000000000007800438","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-12","seq":12,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d22fd1f315edeaa0","label":"TPKT / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0002\u0000\u0000\u000e\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000���\u0001������\u0000\u0000������� ��\u0000\u0001��\u0000\u0002��\u0000\u0003��������","payload_hex":"0200000e00000007000000010000000500000000ffffff01ffffffe5fffe0000fffffeccffffff20fffe0001fffe0002fffe0003fffffecbfffffefe","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000 \u0018\u0000\u0001\u0000�\u0000�\u0000�\u0000\b\u0010\u0000\u0000\u0000","payload_hex":"000000002018000100ff00ff00ff000810000000","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-10","seq":10,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001","payload_hex":"01","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u001eb����<\nu\u0005de~�","payload_hex":"a5d81e62a799f0a03c0a750564657efb","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:34","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0002","payload_hex":"02","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:57:33","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"RFB 003.008\n","payload_hex":"524642203030332e3030380a","method":"","user_agent":"","ja3":"","session":"6a072f4e-8eb1-46a7-9b79-158cb7adcdf5-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"32076d57dc270404","label":"VNC (RFB)","strings":["RFB 003.008"]},"interactive":true},{"timestamp":"2026-10-25T13:57:33","port":5901,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"RFB 003.008\n","payload_hex":"524642203030332e3030380a","method":"","user_agent":"","ja3":"","session":"f24aa682-88cb-4df5-9759-5fcc425a9695-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"32076d57dc270404","label":"VNC (RFB)","strings":["RFB 003.008"]},"interactive":true}],"http_methods":[{"method":"GET","count":34}],"distinct_ports_total":8,"top_paths":[{"path":"/login","count":11,"ports":3},{"path":"/actuator/env","count":1,"ports":1},{"path":"/config.js","count":1,"ports":1},{"path":"/.env.staging","count":1,"ports":1},{"path":"/settings.py","count":1,"ports":1},{"path":"/config.json","count":1,"ports":1},{"path":"/server-status","count":1,"ports":1},{"path":"/.env.test","count":1,"ports":1},{"path":"/config.yml","count":1,"ports":1},{"path":"/.env.prod","count":1,"ports":1},{"path":"/.env.dev","count":1,"ports":1},{"path":"/.env.backup","count":1,"ports":1},{"path":"/.env","count":1,"ports":1},{"path":"/.env.bak","count":1,"ports":1},{"path":"/.env.old","count":1,"ports":1}],"distinct_paths_total":24,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":8}]}