{"ip":"85.163.56.236","total_events":226,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"80+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 80 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,358 bytes sent","bytes_sent":2358,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-26T23:21:27","last_seen":"2026-09-21T00:01:54","events_24h":32,"events_7d":109,"geo":{"country_code":"CZ","country_name":"Czechia","region":"Vysocina","city":"Polná","lat":49.486,"lon":15.711,"asn":28725,"org":"CETIN a.s."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as28725","label":"CETIN","category":"isp","url":"https://www.peeringdb.com/asn/28725"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":10},{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":6109,"proto":"tcp","label":"","count":5},{"port":2096,"proto":"tcp","label":"","count":4},{"port":8011,"proto":"tcp","label":"","count":3},{"port":31265,"proto":"tcp","label":"","count":3},{"port":30009,"proto":"tcp","label":"","count":3},{"port":30033,"proto":"tcp","label":"","count":3},{"port":31074,"proto":"tcp","label":"","count":3},{"port":31004,"proto":"tcp","label":"","count":3},{"port":8181,"proto":"tcp","label":"","count":3},{"port":21116,"proto":"tcp","label":"","count":3},{"port":22022,"proto":"tcp","label":"","count":3},{"port":6081,"proto":"tcp","label":"","count":3},{"port":6016,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":22},{"date":"2026-07-28","count":27},{"date":"2026-07-29","count":10},{"date":"2026-09-08","count":11},{"date":"2026-09-09","count":28},{"date":"2026-09-13","count":12},{"date":"2026-09-14","count":8},{"date":"2026-09-15","count":3},{"date":"2026-09-16","count":3},{"date":"2026-09-17","count":15},{"date":"2026-09-18","count":18},{"date":"2026-09-19","count":15},{"date":"2026-09-20","count":49},{"date":"2026-09-21","count":3}],"recent_events":[{"timestamp":"2026-09-21T00:01:54","port":5077,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"536ffe2b-0e36-4b29-8c85-a4335e669e60","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-21T00:01:24","port":5077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"e4497727-a13b-4f00-8509-c08b6633190a","seq":2,"duration_ms":304,"bytes_in":8,"bytes_out":26,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-21T00:01:23","port":5077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"e4497727-a13b-4f00-8509-c08b6633190a","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-20T21:26:48","port":3340,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"03da610b-8db3-42d6-b485-a7f4a911a1e8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-20T21:26:18","port":3340,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"033cd664-72d8-42ec-81e1-a4a28f561dde","seq":2,"duration_ms":412,"bytes_in":8,"bytes_out":26,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-20T21:26:18","port":3340,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"033cd664-72d8-42ec-81e1-a4a28f561dde","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-20T21:15:50","port":31074,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"11fa8e8b-b2c8-4762-847c-472d90dfb8ca","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-20T21:15:20","port":31074,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"ce1ae80f-15a7-406f-b289-6cff1e59024f","seq":2,"duration_ms":209,"bytes_in":8,"bytes_out":26,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-20T21:15:20","port":31074,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"ce1ae80f-15a7-406f-b289-6cff1e59024f","seq":1,"duration_ms":102,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-20T20:32:42","port":5097,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"4aace9a0-2ef9-4970-ac5f-48e14b0bbe4f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":80,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T10:42:32.934812+00:00"}