{"ip":"85.239.151.14","total_events":3284,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"1481+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 1481 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"130,128 bytes sent","bytes_sent":130128,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-27T17:04:02","last_seen":"2026-08-18T23:57:33","events_24h":0,"events_7d":865,"geo":{"country_code":"ER","country_name":"Eritrea","region":"Maekel Region","city":"Asmara","lat":15.3301,"lon":38.9325,"asn":19318,"org":"Interserver, Inc"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as19318","label":"InterServer","category":"cdn","url":"https://www.peeringdb.com/asn/19318"},"cve_matches":[],"malware":[],"top_ports":[{"port":56565,"proto":"tcp","label":"","count":7},{"port":7460,"proto":"tcp","label":"","count":7},{"port":3958,"proto":"tcp","label":"","count":7},{"port":13410,"proto":"tcp","label":"","count":7},{"port":11087,"proto":"tcp","label":"","count":7},{"port":17990,"proto":"tcp","label":"","count":7},{"port":63245,"proto":"tcp","label":"","count":6},{"port":61326,"proto":"tcp","label":"","count":6},{"port":35609,"proto":"tcp","label":"","count":6},{"port":21517,"proto":"tcp","label":"","count":6},{"port":8774,"proto":"tcp","label":"","count":6},{"port":53735,"proto":"tcp","label":"","count":6},{"port":32374,"proto":"tcp","label":"","count":6},{"port":28448,"proto":"tcp","label":"","count":6},{"port":39048,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-27","count":363},{"date":"2026-07-29","count":2056},{"date":"2026-08-18","count":865}],"recent_events":[{"timestamp":"2026-08-18T23:57:33","port":16395,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"06b2de84-8448-4df0-9f71-e2b3db052f2c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:26","port":7772,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"324fc085-ec2c-4454-8793-cf8e240aaa3b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:19","port":16135,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"edda5964-3ed9-4af2-9769-3a4893e93401","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:17","port":17710,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"f3d9b4e4-45bd-46ae-a9e4-2e64d77d94bc","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:16","port":20872,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"6cae0e83-f39b-4a55-8193-7e69457f6d73","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:13","port":16695,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"61e3bdc8-c0c9-45ac-a54c-6f1f7184c8d3","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:12","port":14196,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"466fc8b3-318a-4016-a65b-2e57df80789b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:03","port":8312,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"df36d3ca-3238-4ccd-9f05-5139a54cea11","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:57:00","port":3765,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"0dd6e1ce-2173-45bc-a370-92d2bbc47b79","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-18T23:56:59","port":13481,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"82a5fe24-adad-423e-9b3d-e1b0a6bff13d","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":1481,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T19:08:31.732210+00:00"}