{"ip":"83.171.227.54","total_events":1141,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,141 events across 2 port(s)","confidence":"medium","network_type":null,"why":["1,141 requests against only 2 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"903,281 bytes sent","bytes_sent":903281,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-07T16:45:30","last_seen":"2026-08-12T06:28:22","events_24h":0,"events_7d":66,"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":41745,"org":"Baykov Ilya Sergeevich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":636},{"port":22,"proto":"tcp","label":"SSH","count":505}],"fingerprints":{"ssh_hassh":["eeca2460550b9ded084ecf2f70a75356"],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{"eeca2460550b9ded084ecf2f70a75356":2},"user_agents":[],"timeline":[{"date":"2026-08-07","count":828},{"date":"2026-08-08","count":247},{"date":"2026-08-12","count":66}],"recent_events":[{"timestamp":"2026-08-12T06:28:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$6\r\nBGSAVE\r\n","payload_hex":"2a310d0a24360d0a4247534156450d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":6,"duration_ms":653,"bytes_in":286,"bytes_out":32,"enriched":{"digest":"0cf919cc954c44cc","label":"Redis (RESP)","strings":["BGSAVE"]}},{"timestamp":"2026-08-12T06:28:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$1\r\nk\r\n$88\r\n\n\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyNe/Z73WAjJGIquLvTPIRuqJ6MuBBYAt8TlGHmHssr pen\n\n\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24310d0a6b0d0a2438380d0a0a0a7373682d65643235353139204141414143334e7a6143316c5a4449314e54453541414141494e794e652f5a373357416a4a474971754c765450495275714a364d75424259417438546c47486d487373722070656e0a0a0d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":5,"duration_ms":543,"bytes_in":270,"bytes_out":27,"enriched":{"digest":"d44c2fd3cbc2b205","label":"Redis (RESP)","strings":["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyNe/Z73WAjJGIquLvTPIRuqJ6MuBBYAt8TlGHmHssr…"]}},{"timestamp":"2026-08-12T06:28:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$15\r\nauthorized_keys\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a2431350d0a617574686f72697a65645f6b6579730d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":4,"duration_ms":432,"bytes_in":155,"bytes_out":22,"enriched":{"digest":"1a8c1f4d7826b19c","label":"Redis (RESP)","strings":["CONFIG","dbfilename","authorized_keys"]}},{"timestamp":"2026-08-12T06:28:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$10\r\n/root/.ssh\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431300d0a2f726f6f742f2e7373680d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":3,"duration_ms":322,"bytes_in":91,"bytes_out":17,"enriched":{"digest":"1b6638fc2acbcadc","label":"Redis (RESP)","strings":["CONFIG","/root/.ssh"],"iocs":{"paths":["/root/.ssh"]}}},{"timestamp":"2026-08-12T06:28:21","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nINFO\r\n$6\r\nserver\r\n","payload_hex":"2a320d0a24340d0a494e464f0d0a24360d0a7365727665720d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":2,"duration_ms":211,"bytes_in":40,"bytes_out":12,"enriched":{"digest":"346e2eade9e409cc","label":"Redis (RESP)","strings":["INFO","server"]}},{"timestamp":"2026-08-12T06:28:21","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"3499ecc7-560e-4a1a-8984-9e6f970512a6","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":7,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-08-12T06:25:41","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$6\r\nBGSAVE\r\n","payload_hex":"2a310d0a24360d0a4247534156450d0a","method":"","user_agent":"","ja3":"","session":"09fc1242-d50e-441b-81fe-350d6080738e","seq":6,"duration_ms":662,"bytes_in":286,"bytes_out":32,"enriched":{"digest":"0cf919cc954c44cc","label":"Redis (RESP)","strings":["BGSAVE"]}},{"timestamp":"2026-08-12T06:25:41","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$1\r\nk\r\n$88\r\n\n\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyNe/Z73WAjJGIquLvTPIRuqJ6MuBBYAt8TlGHmHssr pen\n\n\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24310d0a6b0d0a2438380d0a0a0a7373682d65643235353139204141414143334e7a6143316c5a4449314e54453541414141494e794e652f5a373357416a4a474971754c765450495275714a364d75424259417438546c47486d487373722070656e0a0a0d0a","method":"","user_agent":"","ja3":"","session":"09fc1242-d50e-441b-81fe-350d6080738e","seq":5,"duration_ms":550,"bytes_in":270,"bytes_out":27,"enriched":{"digest":"d44c2fd3cbc2b205","label":"Redis (RESP)","strings":["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyNe/Z73WAjJGIquLvTPIRuqJ6MuBBYAt8TlGHmHssr…"]}},{"timestamp":"2026-08-12T06:25:41","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$15\r\nauthorized_keys\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a2431350d0a617574686f72697a65645f6b6579730d0a","method":"","user_agent":"","ja3":"","session":"09fc1242-d50e-441b-81fe-350d6080738e","seq":4,"duration_ms":438,"bytes_in":155,"bytes_out":22,"enriched":{"digest":"1a8c1f4d7826b19c","label":"Redis (RESP)","strings":["CONFIG","dbfilename","authorized_keys"]}},{"timestamp":"2026-08-12T06:25:41","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$10\r\n/root/.ssh\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431300d0a2f726f6f742f2e7373680d0a","method":"","user_agent":"","ja3":"","session":"09fc1242-d50e-441b-81fe-350d6080738e","seq":3,"duration_ms":325,"bytes_in":91,"bytes_out":17,"enriched":{"digest":"1b6638fc2acbcadc","label":"Redis (RESP)","strings":["CONFIG","/root/.ssh"],"iocs":{"paths":["/root/.ssh"]}}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4","count":505}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T23:43:35.187673+00:00"}