{"ip":"80.94.92.13","total_events":1030,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"378+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 378 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"59,856 bytes sent","bytes_sent":59856,"session_seconds":7,"persistent":false}},"first_seen":"2026-08-17T15:22:36","last_seen":"2026-08-17T15:38:38","events_24h":0,"events_7d":1030,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":47890,"org":"Unmanaged Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":4782,"proto":"tcp","label":"","count":15},{"port":7002,"proto":"tcp","label":"","count":12},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":4443,"proto":"tcp","label":"","count":8},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":8},{"port":50050,"proto":"tcp","label":"","count":8},{"port":31337,"proto":"tcp","label":"","count":8},{"port":9200,"proto":"tcp","label":"Elastic","count":8},{"port":5672,"proto":"tcp","label":"","count":7},{"port":5984,"proto":"tcp","label":"CouchDB","count":6},{"port":9191,"proto":"tcp","label":"","count":6},{"port":445,"proto":"tcp","label":"SMB","count":6},{"port":7707,"proto":"tcp","label":"","count":6},{"port":6501,"proto":"tcp","label":"","count":6},{"port":40443,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":["9052c4ab4164c78256e71143dcfc7eac"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_7522b0acae40","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2120,"ge11nn0300_0db47b7d240d":5529,"po11nn0600_7522b0acae40":8,"ge11nn0400_88d30a62b7ad":4889,"9052c4ab4164c78256e71143dcfc7eac":88},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0","Mozilla/5.0 (X11; Linux i686; rv:144.0) Gecko/20100101 Firefox/144.0"],"timeline":[{"date":"2026-08-17","count":1030}],"recent_events":[{"timestamp":"2026-08-17T15:38:38","port":50101,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"63a8fcd1-2ba8-4352-b963-ca2e7ad238cf","seq":1,"duration_ms":148,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":3460,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"6e054e57-e445-48a6-b423-8e0a6bcf4605","seq":1,"duration_ms":141,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":50070,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"ae2adb4a-6ce5-4260-8017-dea1edffdd1a","seq":1,"duration_ms":141,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":50113,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"412c5232-b164-46b4-8aa7-3590fd6d52ed","seq":1,"duration_ms":139,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"7d2ae08d-ee09-4309-a498-ef686b0fb709","seq":1,"duration_ms":147,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":4150,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"5f71977f-0912-4392-895f-221dc3f70b61","seq":1,"duration_ms":147,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":50100,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"cbfbb306-017e-40ed-90e3-34692c3f7d64","seq":1,"duration_ms":143,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":4911,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"562d0a48-6532-48f9-a27a-6480b2ea90bd","seq":1,"duration_ms":177,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":5009,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"55abce18-5f04-480c-969e-c64dd0b8282b","seq":1,"duration_ms":144,"bytes_in":4,"bytes_out":11},{"timestamp":"2026-08-17T15:38:38","port":50101,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"  \n\n","payload_hex":"20200a0a","method":"","user_agent":"","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"2bc2787e-cc81-4754-be84-aa8310a5a637","seq":1,"duration_ms":221,"bytes_in":4,"bytes_out":11}],"http_methods":[{"method":"GET","count":167},{"method":"POST","count":1}],"distinct_ports_total":378,"top_paths":[{"path":"/","count":88,"ports":33},{"path":"/favicon.ico","count":78,"ports":31},{"path":"/_cluster/state","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8","count":5}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T17:34:30.982832+00:00"}