{"ip":"95.213.194.75","data_as_of":"2026-10-27T01:37:38+00:00","observed":true,"total_events":67,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"49+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 49 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Held a session open for 60s, against a median of well under a second.","Counts include 48 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"1,188 bytes sent, longest session 60s","bytes_sent":1188,"session_seconds":60,"persistent":true},"basis":"combined"},"first_seen":"2026-10-16T07:28:32","last_seen":"2026-10-21T15:02:22","events_24h":0,"events_7d":24,"interactive_sessions":48,"interactive_sessions_24h":0,"interactive_sessions_7d":20,"interactive_protocols":[{"protocol":"ssh","sessions":40},{"protocol":"telnet","sessions":1},{"protocol":"dns","sessions":1},{"protocol":"ftp","sessions":1}],"geo":{"country_code":"RU","country_name":"Russia","region":"St.-Petersburg","city":"St Petersburg","lat":59.9417,"lon":30.3096,"asn":49505,"org":"JSC Selectel"},"source_domain":"nemesis.liri.me","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49505","label":"Selectel Ltd.","category":"cdn","url":"https://www.peeringdb.com/asn/49505"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":48,"first_seen":"2026-10-16T07:51:32","last_seen":"2026-10-21T14:02:23","verdicts":[{"verdict":"unknown","sessions":45},{"verdict":"scan","sessions":3}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":41},{"persona":"ftp@3.0.3","sessions":1},{"persona":"dns@dnsmasq 2.80","sessions":1}],"services":[{"protocol":"ssh","port":24,"sessions":1},{"protocol":"ftp","port":21,"sessions":1},{"protocol":"ssh","port":6,"sessions":1},{"protocol":"tcp","port":17,"sessions":1},{"protocol":"ssh","port":30,"sessions":1},{"protocol":"dns","port":53,"sessions":1},{"protocol":"ssh","port":51,"sessions":1},{"protocol":"ssh","port":45,"sessions":1},{"protocol":"ssh","port":13,"sessions":1},{"protocol":"tcp","port":26,"sessions":1},{"protocol":"ssh","port":50,"sessions":1},{"protocol":"ssh","port":18,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":3}]},"top_ports":[{"port":27,"proto":"tcp","label":"","count":3,"sessions":1},{"port":58,"proto":"tcp","label":"","count":2,"sessions":1},{"port":56,"proto":"tcp","label":"","count":2,"sessions":1},{"port":53,"proto":"tcp","label":"DNS","count":2,"sessions":1},{"port":50,"proto":"tcp","label":"","count":2,"sessions":1},{"port":59,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3,"proto":"tcp","label":"","count":2,"sessions":1},{"port":60,"proto":"tcp","label":"","count":2,"sessions":1},{"port":48,"proto":"tcp","label":"","count":2,"sessions":1},{"port":13,"proto":"tcp","label":"","count":2,"sessions":1},{"port":21,"proto":"tcp","label":"FTP","count":2,"sessions":1},{"port":43,"proto":"tcp","label":"","count":2,"sessions":1},{"port":28,"proto":"tcp","label":"","count":2,"sessions":1},{"port":47,"proto":"tcp","label":"","count":2,"sessions":1},{"port":31,"proto":"tcp","label":"","count":2,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":13,"sessions":9},{"date":"2026-10-17","count":15,"sessions":9},{"date":"2026-10-19","count":15,"sessions":10},{"date":"2026-10-20","count":9,"sessions":10},{"date":"2026-10-21","count":15,"sessions":10}],"recent_events":[{"timestamp":"2026-10-21T15:02:22","port":53,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"bcb0cf2a-29d2-445f-8a1d-f444f0ff6da3","seq":1,"duration_ms":2101,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T14:39:55","port":55,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"2515699a-3110-4419-815e-3ab28ec1243b","seq":1,"duration_ms":164,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T14:23:19","port":57,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"34e4dbca-ef48-43ee-b57a-88fa45470de6","seq":1,"duration_ms":165,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T14:22:48","port":61,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"c1ff8617-e390-4446-91e4-86c15cbdbefa","seq":1,"duration_ms":251,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T13:38:09","port":53,"proto":"tcp","app_proto":"dns","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"b75a530f-764d-48a1-882f-945db2c88980-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]},"interactive":true},{"timestamp":"2026-10-21T13:16:14","port":54,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"57a8b4a2-2bf4-4988-a87e-7856facd3500","seq":1,"duration_ms":142,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T12:54:14","port":60,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"d43c21de-099c-44f3-a1a6-84b4bad9f126","seq":1,"duration_ms":423,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T12:01:47","port":52,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"23194563-e1bf-428e-a4d9-c1c44de66976","seq":1,"duration_ms":144,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T11:52:42","port":56,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"b3159f7c-d92c-4c7b-8af6-0bcc01a15149","seq":1,"duration_ms":142,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-21T11:10:59","port":56,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"d35df72c-0714-447a-a676-20a0000c2460","seq":1,"duration_ms":164,"bytes_in":17,"bytes_out":13,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}}],"http_methods":[],"distinct_ports_total":49,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":67}],"credentials":[],"header_profile":null,"tags":[]}