{"ip":"83.237.29.98","total_events":14,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"266 bytes sent","bytes_sent":266,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T11:18:08","last_seen":"2026-09-24T22:33:32","events_24h":0,"events_7d":14,"geo":{"country_code":"RU","country_name":"Russia","region":"Moscow","city":"Moscow","lat":55.7487,"lon":37.6187,"asn":8359,"org":"MTS PJSC"},"source_domain":"kristian-kutuz-internet.moscow.access.comstar.ru","known_scanners":[],"scanner_tag":{"key":"peeringdb:as8359","label":"Mobile TeleSystems PJSC","category":"isp","url":"https://www.peeringdb.com/asn/8359"},"cve_matches":[],"malware":[],"top_ports":[{"port":3383,"proto":"tcp","label":"","count":2},{"port":3388,"proto":"tcp","label":"","count":2},{"port":3385,"proto":"tcp","label":"","count":2},{"port":3387,"proto":"tcp","label":"","count":2},{"port":3381,"proto":"tcp","label":"","count":1},{"port":3386,"proto":"tcp","label":"","count":1},{"port":3384,"proto":"tcp","label":"","count":1},{"port":3390,"proto":"tcp","label":"","count":1},{"port":3380,"proto":"tcp","label":"","count":1},{"port":3382,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-24","count":14}],"recent_events":[{"timestamp":"2026-09-24T22:33:32","port":3383,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"d9f4cce2-d9f0-421c-b58e-0c4ae24803b2","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-24T22:32:13","port":3383,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"e32a8f68-90a9-4c2b-b4ae-5c086a0e5499","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-24T22:30:15","port":3385,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"40d89528-0256-438b-9f60-bfd79145fdca","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-24T22:29:37","port":3385,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3c475dac-25e9-4710-b0c7-6b1405cbc6fb","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-24T22:28:58","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c396e02e-82de-4c10-beb1-a2ea653c97b1","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-24T22:27:43","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c1b7d15e-53d6-44ec-9908-d10d83f05b43","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-24T22:25:03","port":3387,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"2453163e-aeaf-4010-868a-2de0512ddd6b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-24T22:10:29","port":3387,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"f9f8d683-5727-4c69-b9db-c984bf18373d","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-24T22:06:26","port":3382,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"d6e78a38-7e8e-4e9f-a12a-8969913e87ea","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-24T22:06:10","port":3384,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"5ba7e457-3cec-47e7-a4ed-aa5d5bf4864c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T21:33:38.023751+00:00"}