{"ip":"80.94.95.109","data_as_of":"2026-10-22T19:52:54+00:00","observed":true,"total_events":1060,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"298+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 298 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 84 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,641 bytes sent","bytes_sent":21641,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-09-30T07:29:44","last_seen":"2026-10-20T15:50:43","events_24h":0,"events_7d":109,"interactive_sessions":84,"interactive_sessions_24h":0,"interactive_sessions_7d":84,"interactive_protocols":[{"protocol":"rdp","sessions":70},{"protocol":"stratum","sessions":7},{"protocol":"ssh","sessions":2},{"protocol":"adb","sessions":1},{"protocol":"sccp","sessions":1},{"protocol":"http","sessions":1}],"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":204428,"org":"SS-Net"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":84,"first_seen":"2026-10-20T14:25:57","last_seen":"2026-10-20T15:46:10","verdicts":[{"verdict":"scan","sessions":79},{"verdict":"unknown","sessions":5}],"personas":[{"persona":"rdp@Windows Server 2016","sessions":36},{"persona":"rdp@Windows Server 2019","sessions":34},{"persona":"miner@cgminer 4.11.1","sessions":5},{"persona":"miner@bfgminer 5.5.0","sessions":2},{"persona":"linux-ubuntu@20.04","sessions":2},{"persona":"adb@Android 7.1 TV box","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1","sessions":1},{"persona":"sccp@CUCM 11.5","sessions":1}],"services":[{"protocol":"stratum","port":3334,"sessions":3},{"protocol":"stratum","port":3333,"sessions":3},{"protocol":"rdp","port":3380,"sessions":2},{"protocol":"rdp","port":23389,"sessions":2},{"protocol":"rdp","port":3365,"sessions":2},{"protocol":"rdp","port":3318,"sessions":2},{"protocol":"rdp","port":13389,"sessions":2},{"protocol":"rdp","port":13394,"sessions":2},{"protocol":"rdp","port":3392,"sessions":2},{"protocol":"rdp","port":1111,"sessions":2},{"protocol":"ssh","port":2222,"sessions":2},{"protocol":"rdp","port":43395,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":79}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":12,"sessions":0},{"port":3392,"proto":"tcp","label":"","count":6,"sessions":2},{"port":13395,"proto":"tcp","label":"","count":6,"sessions":1},{"port":3323,"proto":"tcp","label":"","count":6,"sessions":1},{"port":3308,"proto":"tcp","label":"","count":6,"sessions":1},{"port":3351,"proto":"tcp","label":"","count":6,"sessions":0},{"port":3338,"proto":"tcp","label":"","count":6,"sessions":0},{"port":3358,"proto":"tcp","label":"","count":6,"sessions":0},{"port":3306,"proto":"tcp","label":"MySQL","count":6,"sessions":0},{"port":3360,"proto":"tcp","label":"","count":6,"sessions":0},{"port":3315,"proto":"tcp","label":"","count":6,"sessions":0},{"port":3348,"proto":"tcp","label":"","count":6,"sessions":0},{"port":4444,"proto":"tcp","label":"","count":5,"sessions":1},{"port":3320,"proto":"tcp","label":"","count":5,"sessions":1},{"port":33396,"proto":"tcp","label":"","count":5,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-30","count":3,"sessions":0},{"date":"2026-10-03","count":9,"sessions":0},{"date":"2026-10-11","count":939,"sessions":0},{"date":"2026-10-20","count":109,"sessions":84}],"recent_events":[{"timestamp":"2026-10-20T15:50:43","port":33395,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"754ec822-43e0-40f5-8fba-a8f20a30849f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:49:53","port":13395,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"1b37abc6-4527-4746-b09b-e4ad4fd9dd71","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:47:22","port":3348,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9e24ca0f-632a-4c8a-a5d8-a27f5f1cfe01","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:46:52","port":23389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c690841d-452b-4e19-97c9-aa75dc7e9cc9","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-20T15:46:42","port":3308,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"0324cf39-514f-4840-b2c5-8e5137cbcda7","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:46:10","port":3334,"proto":"tcp","app_proto":"stratum","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c5a6bd21-4c18-43ae-85b8-8b8e22df4f4c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-20T15:45:00","port":2000,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"51bde371-c25f-4e15-86ab-f879a113eb55","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:44:27","port":3348,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"f6a8eb36-f388-4e72-9d4a-294b59f850f8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:44:09","port":3324,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"d8f5a8cb-5d54-4ca4-8db7-67bf2c2c3924","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-10-20T15:43:30","port":2026,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3a1e0dfb-24df-44b0-b59d-b65b67d1e2ff","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":298,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}