{"ip":"77.91.122.16","data_as_of":"2026-10-24T08:46:19+00:00","observed":true,"total_events":219,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"73 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["73 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 219 event(s) from this address as well.","Not in any known-scanner range.","Sent 1,737,592 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,737,592 bytes sent","bytes_sent":1737592,"session_seconds":7,"persistent":false},"basis":"interactive"},"first_seen":"2026-09-26T11:13:14","last_seen":"2026-10-22T09:27:35","events_24h":0,"events_7d":213,"interactive_sessions":3140,"interactive_sessions_24h":0,"interactive_sessions_7d":3140,"interactive_protocols":[{"protocol":"rdp","sessions":3140}],"geo":{"country_code":"GE","country_name":"Georgia","region":"","city":"","lat":42.0,"lon":43.4999,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3140,"first_seen":"2026-10-21T14:32:13","last_seen":"2026-10-22T09:27:35","verdicts":[{"verdict":"credential","sessions":2867},{"verdict":"scan","sessions":228},{"verdict":"unknown","sessions":45}],"personas":[{"persona":"rdp@Windows Server 2016","sessions":3140}],"services":[{"protocol":"rdp","port":3381,"sessions":1444},{"protocol":"rdp","port":3389,"sessions":877},{"protocol":"rdp","port":3388,"sessions":787},{"protocol":"rdp","port":3397,"sessions":1},{"protocol":"rdp","port":33897,"sessions":1},{"protocol":"rdp","port":3395,"sessions":1},{"protocol":"rdp","port":53389,"sessions":1},{"protocol":"rdp","port":33899,"sessions":1},{"protocol":"rdp","port":3382,"sessions":1},{"protocol":"rdp","port":3394,"sessions":1},{"protocol":"rdp","port":3387,"sessions":1},{"protocol":"rdp","port":33894,"sessions":1}],"logins":[{"username":"jkelly","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":10,"last_seen":"2026-10-22T09:27:20"},{"username":"bsmith","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":9,"last_seen":"2026-10-22T09:27:27"},{"username":"receptionist","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":9,"last_seen":"2026-10-22T09:27:20"},{"username":"donotreply","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:29"},{"username":"careers","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:23"},{"username":"javiera","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:23"},{"username":"it","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:22"},{"username":"tv","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:19"},{"username":"intel","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:12"},{"username":"cornerstone","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:27:02"},{"username":"student1","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":8,"last_seen":"2026-10-22T09:26:52"},{"username":"jtaylor","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:32"},{"username":"pda1","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:31"},{"username":"vera","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:31"},{"username":"hvac","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:30"},{"username":"wssadmin","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:30"},{"username":"user09","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:29"},{"username":"student03","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:27"},{"username":"desk2","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:27"},{"username":"newsletter","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:27"},{"username":"carlos","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:25"},{"username":"siteadmin","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:24"},{"username":"exam13","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:18"},{"username":"patrol","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:17"},{"username":"teacher","password":null,"password_sent":false,"service":"rdp-credssp","outcome":"failure","tries":7,"last_seen":"2026-10-22T09:27:16"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":228},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":73},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2867}]},"top_ports":[{"port":3381,"proto":"tcp","label":"RDP","count":0,"sessions":1444},{"port":3389,"proto":"tcp","label":"RDP","count":8,"sessions":877},{"port":3388,"proto":"tcp","label":"","count":2,"sessions":787},{"port":3398,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3385,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3393,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3390,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3395,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3394,"proto":"tcp","label":"","count":2,"sessions":1},{"port":33897,"proto":"tcp","label":"","count":2,"sessions":1},{"port":444,"proto":"tcp","label":"","count":2,"sessions":0},{"port":69,"proto":"tcp","label":"","count":2,"sessions":0},{"port":71,"proto":"tcp","label":"","count":2,"sessions":0},{"port":56,"proto":"tcp","label":"","count":2,"sessions":0},{"port":62,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i160700_8cdfa2d4673b_da1760d18e18"],"tls_client_hello":"","tls_ja3":["1ded1585cb6c61b529e75ada28fb83a4"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":["t12i160700_8cdfa2d4673b_da1760d18e18"],"tls_ja3":["1ded1585cb6c61b529e75ada28fb83a4"]}},"fingerprint_peers":{"t12i160700_8cdfa2d4673b_da1760d18e18":2},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":2,"sessions":0},{"date":"2026-10-07","count":2,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-18","count":70,"sessions":0},{"date":"2026-10-19","count":73,"sessions":0},{"date":"2026-10-21","count":48,"sessions":25},{"date":"2026-10-22","count":22,"sessions":3115}],"recent_events":[{"timestamp":"2026-10-22T09:27:35","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"","summary":"0[�\u0003\u0002\u0001\u0006�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000��\b�\u0006\u0000r\u0017\u0000\u0000\u0000\u000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\"\u0004 hn8uTN7mzGUD9CRChuZHfFFr4vPczaVa","payload_hex":"305ba003020106a130302e302ca02a04284e544c4d5353500001000000978208e2060072170000000f00000000000000000000000000000000a5220420686e3875544e376d7a4755443943524368755a4866464672347650637a615661","method":"","user_agent":"","ja3":"1ded1585cb6c61b529e75ada28fb83a4","session":"9abd7c72-c313-4bf8-b589-f50cb14ab11f-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c09e669cb60b2e36","strings":["00.0,","(NTLMSSP","hn8uTN7mzGUD9CRChuZHfFFr4vPczaVa"]},"interactive":true},{"timestamp":"2026-10-22T09:27:35","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000*%�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=test\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002a25e00000000000436f6f6b69653a206d737473686173683d746573740d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"306aae36-4b50-4988-ac7e-b5e51d349209-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a8ec912920085746","label":"RDP (X.224)","strings":["Cookie: mstshash=test"]},"interactive":true},{"timestamp":"2026-10-22T09:27:35","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"","summary":"0�\u0001��\u0003\u0002\u0001\u0006��\u0001R0�\u0001N0�\u0001J��\u0001F\u0004�\u0001BNTLMSSP\u0000\u0003\u0000\u0000\u0000\u0018\u0000\u0018\u0000X\u0000\u0000\u0000�\u0000�\u0000p\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0001\u0000\u0000\u0010\u0000\u0010\u0000\"\u0001\u0000\u0000\u0000\u0000\u0000\u00002\u0001\u0000\u0000\u0010\u0000\u0010\u00002\u0001\u0000\u0000\u0015���\u0006\u0000r\u0017\u0000\u0000\u0000\u000f�?�~MmX �N�F��KP){u3X�|,+����\f�)5TkJVWhLG~���z\u0003���Xw\u000bw\u000e�\u0001\u0001\u0000\u0000\u0000\u0000\u0000\u0000��\u001e�\u0007b�\u00015TkJVWhL\u0000\u0000\u0000\u0000\u0002\u0000\b\u0000C\u0000O\u0000R\u0000P\u0000\u0001\u0000\f\u0000W\u0000E\u0000B\u0000-\u00000\u00002\u0000\u0004\u0000\u0014\u0000c\u0000o\u0000r\u0000p\u0000.\u0000l\u0000o\u0000c\u0000a\u0000l\u0000\u0003\u0000\"\u0000w\u0000e\u0000b\u0000-\u00000\u00002\u0000.\u0000c\u0000o\u0000r\u0000p\u0000.\u0000l\u0000o\u0000c\u0000a\u0000l\u0000\u0005\u0000\u0014\u0000c\u0000o\u0000r\u0000p\u0000.\u0000l\u0000o\u0000c\u0000a\u0000l\u0000\u0007\u0000\b\u0000��\u001e�\u0007b�\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0000o\u0000r\u0000t\u0000a\u0000b\u0000l\u0000e\u0000\u0019�zA� �\rB8Rv\nQ���2\u00040\u0001\u0000\u0000\u0000��<�T��\u0010\u0000\u0000\u0000\u0000�/���4.���O\u001c`�s*�\u00006\u0006\u000f1Ԗ\u000bڠ��