{"ip":"91.202.233.79","total_events":4861,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"4753+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 4753 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-02-25T21:56:21","last_seen":"2026-07-14T03:56:23","events_24h":0,"events_7d":0,"geo":{"country_code":"TM","country_name":"Turkmenistan","region":"Ashgabat","city":"Ashgabat","lat":37.95,"lon":58.3833,"asn":200593,"org":"Prospero Ooo"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":3392,"proto":"tcp","label":"","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":64792,"proto":"tcp","label":"","count":3},{"port":63389,"proto":"tcp","label":"","count":3},{"port":16627,"proto":"tcp","label":"","count":3},{"port":59980,"proto":"tcp","label":"","count":2},{"port":12345,"proto":"tcp","label":"","count":2},{"port":3398,"proto":"tcp","label":"","count":2},{"port":3395,"proto":"tcp","label":"","count":2},{"port":26074,"proto":"tcp","label":"","count":2},{"port":10000,"proto":"tcp","label":"Webmin","count":2},{"port":19168,"proto":"tcp","label":"","count":2},{"port":10399,"proto":"tcp","label":"","count":2},{"port":12063,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3112h2_e8f1e7e78f70_ce5650b735ce"],"tls_ja3":[],"ja4h":["ge11nn0200_79258615d613"]},"fingerprint_peers":{"t13i3112h2_e8f1e7e78f70_ce5650b735ce":37,"ge11nn0200_79258615d613":5419},"user_agents":[],"timeline":[{"date":"2026-07-10","count":3890},{"date":"2026-07-13","count":47},{"date":"2026-07-14","count":921}],"recent_events":[{"timestamp":"2026-07-14T03:56:23","port":3424,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:k4/YHTYZRCcg7XiYYLLSX1Uqdog=","ja3":"","session":"360eefa0-bee9-43e4-b5e0-f67bca05dd0e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:22","port":3593,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:TVWy9ljmi+diOBBHxRAxzF+2Nec=","ja3":"","session":"adfad5e8-b2e2-4c39-a5e9-d8614c2cb61f","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:22","port":3579,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:xRGsZ1TwfILfSANiCY8TYufgM8I=","ja3":"","session":"cfbbeab8-e5b7-484c-8cc5-5a47504d5c48","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:21","port":3496,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:SHoL0Io3n47aXGSoJdmOlowYGgY=","ja3":"","session":"50f1dd96-92b3-4b66-959a-152e09aa618d","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:19","port":3672,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:CLru/e/SPLQ/L67q1MYRIOwEJ1I=","ja3":"","session":"94ac1110-6d08-47e0-9625-031d1a9bb671","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:13","port":3611,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:bZaz2aC+bWffarVGwOxytROsXFU=","ja3":"","session":"e71129c3-61d4-4b4b-8848-4bb133aa290e","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:11","port":3518,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:x+MI8dXnQUzGhxhTPSVTD9D90Is=","ja3":"","session":"f16995dd-4434-478e-8385-a92bb7a40021","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:56:04","port":3443,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:iN3NqSXCGJbYy07E/7K62Kw0HnM=","ja3":"","session":"61639b61-51e4-4873-a78f-2fe4778b10dd","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:55:58","port":3507,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:LR+4Ljvc3OQU3Gq08aUvF9GBE/A=","ja3":"","session":"0a669b84-a2dd-4827-84b4-a1d19e706fa6","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}},{"timestamp":"2026-07-14T03:55:57","port":3668,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000/*�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002f2ae00000000000436f6f6b69653a206d737473686173683d41646d696e697374720d0a0100080003000000","method":"","user_agent":"","community_id":"1:WsgprRPXuRHf4hIALpAb/T4g+w8=","ja3":"","session":"e1883917-6819-4c77-90cb-2562ca856294","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13,"enriched":{"digest":"b6d67a37a50bfeec","label":"RDP (X.224)","strings":["Cookie: mstshash=Administr"]}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":4753,"top_paths":[{"path":"/.git/config","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-22T13:05:12.065342+00:00"}