{"ip":"77.91.122.11","total_events":93,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["93 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 9,831 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,831 bytes sent","bytes_sent":9831,"session_seconds":7,"persistent":false}},"first_seen":"2026-09-23T15:17:39","last_seen":"2026-09-23T18:06:54","events_24h":0,"events_7d":93,"geo":{"country_code":"GE","country_name":"Georgia","region":"","city":"","lat":42.0,"lon":43.4999,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":93}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303fb587583a235905c5f22ba244b62895f5f2024c026c5055d560d68a1b0ca2c6120740e06fea976627ee0574714f7e792db4e12ce836582f81db6b57b08155d9dc90026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00203531b6003521710578cc8f4b1c74927ec9a38b9b94d15ce48712056c","tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"http_akin":[]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3139},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":93}],"recent_events":[{"timestamp":"2026-09-23T18:06:54","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0007\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000701000002000000000000","method":"","user_agent":"","ja3":"","session":"9a7679ba-3615-4b5c-a9d7-092c31fbaf0e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-09-23T18:06:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0007\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000701000002000000000000","method":"","user_agent":"","ja3":"","session":"82cec6b0-75a1-42e4-8d39-4cc8659aeb97","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-09-23T18:06:12","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0007\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000701000002000000000000","method":"","user_agent":"","ja3":"","session":"8acbc5d4-3e2b-4954-ae1e-2b12520b09e1","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-09-23T18:05:29","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0001\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0007\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000010000001a00060100200001020021000103002200040400260001ff00000701000002000000000000","method":"","user_agent":"","ja3":"","session":"a09364bb-9aa1-49c4-bd49-1ce35ba83b8b","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":12},{"timestamp":"2026-09-23T18:04:29","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0001\u0000�\u0000\u0000\u0001\u0000�\u0000\u0000\u0000\u0004\u0000\u0000t\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u000790\u0000\u0000\u0000\u0000\u0000\u0000�\u0002\u0000\u0000\u0000\u0000\u0000\u0000\t\u0004\u0000\u0000^\u0000\r\u0000x\u0000\u0005\u0000�\u0000\u0005\u0000�\u0000\r\u0000�\u0000\r\u0000\u0000\u0000\u0000\u0000�\u0000\n\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u00001\u00009\u00002\u0000.\u00003\u0000.\u00001\u00001\u00008\u0000.\u00001\u00004\u00006\u0000a\u0000d\u0000m\u0000i\u0000n\u0000����s�3�C�m\u0000s\u0000s\u0000q\u0000l\u0000_\u0000c\u0000h\u0000e\u0000c\u0000k\u0000e\u0000r\u00001\u00009\u00002\u0000.\u00003\u0000.\u00001\u00001\u00008\u0000.\u00001\u00004\u00006\u0000g\u0000o\u0000-\u0000m\u0000s\u0000s\u0000q\u0000l\u0000d\u0000b\u0000","payload_hex":"100100dc00000100d40000000400007400100000000000073930000000000000a002000000000000090400005e000d0078000500820005008c000d00a6000d0000000000c0000a00d4000000d4000000000000000000d4000000d4000000d4000000000000003100390032002e0033002e003100310038002e00310034003600610064006d0069006e00b3a5e3a573a533a543a56d007300730071006c005f0063006800650063006b00650072003100390032002e0033002e003100310038002e0031003400360067006f002d006d007300730071006c0064006200","method":"","user_agent":"","ja3":"19e29534fd49dd27d09234e639c4057e","session":"ca2d23ba-2c87-4aa6-b154-e175ba2993e7","seq":2,"duration_ms":5100,"bytes_in":261,"bytes_out":24,"enriched":{"digest":"b3c22b0e0159a692","strings":["192.3.118.146admin","mssql_checker192.3.118.146go-mssqldb"],"iocs":{"ips":["192.3.118.146"]}}},{"timestamp":"2026-09-23T18:04:24","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\u000f\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff0f0000000000020000000000","method":"","user_agent":"","ja3":"19e29534fd49dd27d09234e639c4057e","session":"ca2d23ba-2c87-4aa6-b154-e175ba2993e7","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-09-23T18:04:19","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\u000f\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff0f0000000000020000000000","method":"","user_agent":"","ja3":"","session":"0d1a907f-d83f-4372-8b6d-d48efb4768ad","seq":1,"duration_ms":101,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-09-23T18:04:14","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0001\u0000�\u0000\u0000\u0001\u0000�\u0000\u0000\u0000\u0004\u0000\u0000t\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u000790\u0000\u0000\u0000\u0000\u0000\u0000�\u0002\u0000\u0000\u0000\u0000\u0000\u0000\t\u0004\u0000\u0000^\u0000\r\u0000x\u0000\u0005\u0000�\u0000\u0005\u0000�\u0000\r\u0000�\u0000\r\u0000\u0000\u0000\u0000\u0000�\u0000\n\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u00001\u00009\u00002\u0000.\u00003\u0000.\u00001\u00001\u00008\u0000.\u00001\u00004\u00006\u0000a\u0000d\u0000m\u0000i\u0000n\u0000����s�3�C�m\u0000s\u0000s\u0000q\u0000l\u0000_\u0000c\u0000h\u0000e\u0000c\u0000k\u0000e\u0000r\u00001\u00009\u00002\u0000.\u00003\u0000.\u00001\u00001\u00008\u0000.\u00001\u00004\u00006\u0000g\u0000o\u0000-\u0000m\u0000s\u0000s\u0000q\u0000l\u0000d\u0000b\u0000","payload_hex":"100100dc00000100d40000000400007400100000000000073930000000000000a002000000000000090400005e000d0078000500820005008c000d00a6000d0000000000c0000a00d4000000d4000000000000000000d4000000d4000000d4000000000000003100390032002e0033002e003100310038002e00310034003600610064006d0069006e00b3a5e3a573a533a543a56d007300730071006c005f0063006800650063006b00650072003100390032002e0033002e003100310038002e0031003400360067006f002d006d007300730071006c0064006200","method":"","user_agent":"","ja3":"19e29534fd49dd27d09234e639c4057e","session":"68dc4efc-901e-4213-99c0-bd7ea0c73c65","seq":2,"duration_ms":5100,"bytes_in":261,"bytes_out":24,"enriched":{"digest":"b3c22b0e0159a692","strings":["192.3.118.146admin","mssql_checker192.3.118.146go-mssqldb"],"iocs":{"ips":["192.3.118.146"]}}},{"timestamp":"2026-09-23T18:04:09","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\u000f\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff0f0000000000020000000000","method":"","user_agent":"","ja3":"19e29534fd49dd27d09234e639c4057e","session":"68dc4efc-901e-4213-99c0-bd7ea0c73c65","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12},{"timestamp":"2026-09-23T18:04:04","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000)\u0000\u0000\u0001\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004�\u000f\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002900000100000015000601001b000102001c000103001d0004ff0f0000000000020000000000","method":"","user_agent":"","ja3":"","session":"c63b803a-d053-4f79-8929-0b9a20f83b7c","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":12}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T08:37:17.401340+00:00"}