{"ip":"89.248.172.13","total_events":70014,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"3937+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 3937 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,080,616 bytes sent","bytes_sent":3080616,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-14T14:16:42","last_seen":"2026-08-14T20:17:39","events_24h":70014,"events_7d":70014,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Utrecht","city":"Utrecht","lat":52.0922,"lon":5.1268,"asn":202425,"org":"IP Volume inc"},"source_domain":"no-reverse-dns-configured.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":40566,"proto":"tcp","label":"","count":54},{"port":48529,"proto":"tcp","label":"","count":52},{"port":59764,"proto":"tcp","label":"","count":50},{"port":28952,"proto":"tcp","label":"","count":48},{"port":23884,"proto":"tcp","label":"","count":48},{"port":11578,"proto":"tcp","label":"","count":48},{"port":24344,"proto":"tcp","label":"","count":36},{"port":20597,"proto":"tcp","label":"","count":36},{"port":42926,"proto":"tcp","label":"","count":36},{"port":43559,"proto":"tcp","label":"","count":36},{"port":11912,"proto":"tcp","label":"","count":36},{"port":19323,"proto":"tcp","label":"","count":34},{"port":22263,"proto":"tcp","label":"","count":33},{"port":36456,"proto":"tcp","label":"","count":30},{"port":11691,"proto":"tcp","label":"","count":28}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-14","count":70014}],"recent_events":[{"timestamp":"2026-08-14T20:17:39","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"3121806f-e543-44c5-8710-ba82731cce9e","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:39","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"165bd993-67f2-4b67-afb6-67c4c6b39f86","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:36","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"89802c92-e29b-4194-a2d3-0517ccf092ab","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:32","port":41104,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"4341fb8a-9c3d-465a-8b3a-7a5f1520627f","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:32","port":41104,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"fccf30d4-fc7a-455b-b479-5d171102833b","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:32","port":41104,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"423370bf-3149-4ba2-8c55-81ac7f38a4f8","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:31","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"f4926007-33c3-4d2d-b884-e6490dce36a0","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:31","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"a5a1a84e-878e-4dd7-9966-4cb38b59e092","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:31","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"0f3e29bd-6675-4e2a-a699-095436603f1a","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}},{"timestamp":"2026-08-14T20:17:30","port":11456,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d446f6d61696e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"8a6d75b8-78c7-49ca-9399-97f97bddb5cc","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13,"enriched":{"digest":"f7f787b2deee5724","label":"RDP (X.224)","strings":["Cookie: mstshash=Domain"]}}],"http_methods":[],"distinct_ports_total":3937,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T20:20:12.873730+00:00"}