{"ip":"92.40.185.19","data_as_of":"2026-10-20T14:21:49+00:00","observed":true,"total_events":74,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["75 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 81,658 bytes to few ports with no known exploit path, which is focused interaction with one service.","Held a session open for 61s, against a median of well under a second.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"81,658 bytes sent, longest session 61s","bytes_sent":81658,"session_seconds":61,"persistent":true},"basis":"combined"},"first_seen":"2026-10-19T02:29:29","last_seen":"2026-10-19T06:00:38","events_24h":0,"events_7d":74,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Northampton","lat":52.25,"lon":-0.8833,"asn":206067,"org":"Three"},"source_domain":"92.40.185.19.threembb.co.uk","known_scanners":[],"scanner_tag":{"key":"peeringdb:as206067","label":"Three UK AS206067","category":"isp","url":"https://www.peeringdb.com/asn/206067"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-19T03:08:43","last_seen":"2026-10-19T03:08:43","verdicts":[{"verdict":"unknown","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":1,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":4,"proto":"tcp","label":"","count":34,"sessions":0},{"port":7,"proto":"tcp","label":"","count":17,"sessions":0},{"port":5,"proto":"tcp","label":"","count":6,"sessions":0},{"port":9,"proto":"tcp","label":"","count":5,"sessions":0},{"port":1,"proto":"tcp","label":"","count":4,"sessions":1},{"port":2,"proto":"tcp","label":"","count":3,"sessions":0},{"port":6,"proto":"tcp","label":"","count":3,"sessions":0},{"port":8,"proto":"tcp","label":"","count":1,"sessions":0},{"port":10,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":447},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-19","count":74,"sessions":1}],"recent_events":[{"timestamp":"2026-10-19T06:00:38","port":5,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�\u0012\u0016�2���;;