{"ip":"92.98.7.87","total_events":81,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"756 bytes sent","bytes_sent":756,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-25T10:28:56","last_seen":"2026-09-28T19:40:48","events_24h":36,"events_7d":81,"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"Dubai","city":"Dubai","lat":25.0734,"lon":55.2979,"asn":5384,"org":"Emirates Telecommunications Group Company (etisalat Group) Pjsc"},"source_domain":"bba-92-98-7-87.alshamil.net.ae","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":8899,"proto":"tcp","label":"","count":3},{"port":49159,"proto":"tcp","label":"","count":3},{"port":8085,"proto":"tcp","label":"","count":3},{"port":801,"proto":"tcp","label":"","count":3},{"port":8891,"proto":"tcp","label":"","count":3},{"port":2345,"proto":"tcp","label":"","count":3},{"port":3306,"proto":"tcp","label":"MySQL","count":3},{"port":16322,"proto":"tcp","label":"","count":3},{"port":30003,"proto":"tcp","label":"","count":3},{"port":8881,"proto":"tcp","label":"","count":3},{"port":31055,"proto":"tcp","label":"","count":3},{"port":26379,"proto":"tcp","label":"","count":3},{"port":916,"proto":"tcp","label":"","count":3},{"port":6240,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":15},{"date":"2026-09-26","count":24},{"date":"2026-09-27","count":6},{"date":"2026-09-28","count":36}],"recent_events":[{"timestamp":"2026-09-28T19:40:48","port":8085,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"eb134e5c-b0c6-4ca7-ac9c-d052ebef2e87","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":10,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T19:40:18","port":8085,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"8cb2a490-532f-424e-9b4a-55fe6fd57f33","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-09-28T19:40:18","port":8085,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"8cb2a490-532f-424e-9b4a-55fe6fd57f33","seq":2,"duration_ms":455,"bytes_in":8,"bytes_out":20,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-28T18:11:25","port":6240,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"3d0e1915-e737-49a5-b4b2-1ce13b2d8206","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":10,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T18:10:55","port":6240,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"a12e382f-10ef-424a-b54f-cab44e4d7956","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-09-28T18:10:55","port":6240,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"a12e382f-10ef-424a-b54f-cab44e4d7956","seq":2,"duration_ms":453,"bytes_in":8,"bytes_out":20,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-28T15:45:05","port":2096,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"074e0bd8-83e7-45eb-917d-d99ec8b11b9c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":10,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T15:44:35","port":2096,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006","payload_hex":"06","method":"","user_agent":"","ja3":"","session":"29f8fa3b-5ed9-4640-b24a-a46721fe890d","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-09-28T15:44:35","port":2096,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/login\u0000","payload_hex":"2f6c6f67696e00","method":"","user_agent":"","ja3":"","session":"29f8fa3b-5ed9-4640-b24a-a46721fe890d","seq":2,"duration_ms":379,"bytes_in":8,"bytes_out":20,"enriched":{"digest":"660c274422d45f1e","strings":["/login"]}},{"timestamp":"2026-09-28T14:53:30","port":19076,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"f8c760ad-20ea-42c9-bc99-e0337bbf1080","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":10,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":26,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T20:47:11.906111+00:00"}