{"ip":"85.95.238.132","total_events":5202,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"5202+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 5202 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"98,838 bytes sent","bytes_sent":98838,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T19:49:11","last_seen":"2026-09-04T20:57:08","events_24h":216,"events_7d":4115,"geo":{"country_code":"TR","country_name":"Türkiye","region":"","city":"","lat":41.0214,"lon":28.9948,"asn":206991,"org":"Iksir Internet Hizmetleri A.S."},"source_domain":"132-238-95-85-datacenter-services.ixirtelekom.com.tr","known_scanners":[],"scanner_tag":{"key":"peeringdb:as206991","label":"IXIR","category":"enterprise","url":"https://www.peeringdb.com/asn/206991"},"cve_matches":[],"malware":[],"top_ports":[{"port":8496,"proto":"tcp","label":"","count":1},{"port":9356,"proto":"tcp","label":"","count":1},{"port":9904,"proto":"tcp","label":"","count":1},{"port":8972,"proto":"tcp","label":"","count":1},{"port":16004,"proto":"tcp","label":"","count":1},{"port":6087,"proto":"tcp","label":"","count":1},{"port":5554,"proto":"tcp","label":"","count":1},{"port":6403,"proto":"tcp","label":"","count":1},{"port":6975,"proto":"tcp","label":"","count":1},{"port":7811,"proto":"tcp","label":"","count":1},{"port":5627,"proto":"tcp","label":"","count":1},{"port":7359,"proto":"tcp","label":"","count":1},{"port":6474,"proto":"tcp","label":"","count":1},{"port":7414,"proto":"tcp","label":"","count":1},{"port":9175,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":215},{"date":"2026-08-28","count":980},{"date":"2026-08-29","count":727},{"date":"2026-08-30","count":673},{"date":"2026-08-31","count":608},{"date":"2026-09-01","count":649},{"date":"2026-09-02","count":654},{"date":"2026-09-03","count":480},{"date":"2026-09-04","count":216}],"recent_events":[{"timestamp":"2026-09-04T20:57:08","port":18839,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"cad00f8b-2499-4211-adcd-06c2125a1c49","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:56:26","port":16443,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"ab06bf31-403d-4f98-8329-0327ed4bbb93","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:54:10","port":19645,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"57743320-ee52-455a-b90b-bb512c951b38","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:52:12","port":15503,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"27d841a1-0f3c-4f83-94f7-aab7999dbc95","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:32:46","port":19100,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c081ce21-c315-4f25-a212-024ac978afa3","seq":1,"duration_ms":110,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:32:19","port":16976,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"a8b45188-0050-46df-88b3-25c5dfb6efdf","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:31:24","port":17167,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"3dffbaf1-fc63-4727-8b1f-393e6f6c33ef","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:21:37","port":18951,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"fecc07d7-405a-4541-9088-e44cf64f7620","seq":1,"duration_ms":108,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:06:35","port":19880,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"b901b04f-1e8b-4c9d-9374-1969f8c39e71","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-04T20:05:21","port":15394,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"1718b739-461e-4908-9ff3-5a7bae05b0b6","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":5202,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-04T20:59:16.617762+00:00"}