{"ip":"99.85.13.172","total_events":4860,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"4859+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 4859 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"92,340 bytes sent","bytes_sent":92340,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T17:39:16","last_seen":"2026-09-05T04:02:58","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Louisiana","city":"Houma","lat":29.6289,"lon":-90.7262,"asn":7018,"org":"AT&T Enterprises, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as7018","label":"AT&T US - 7018","category":"isp","url":"https://www.peeringdb.com/asn/7018"},"cve_matches":[],"malware":[],"top_ports":[{"port":2584,"proto":"tcp","label":"","count":2},{"port":13747,"proto":"tcp","label":"","count":1},{"port":4309,"proto":"tcp","label":"","count":1},{"port":1573,"proto":"tcp","label":"","count":1},{"port":921,"proto":"tcp","label":"","count":1},{"port":4252,"proto":"tcp","label":"","count":1},{"port":2273,"proto":"tcp","label":"","count":1},{"port":2781,"proto":"tcp","label":"","count":1},{"port":3937,"proto":"tcp","label":"","count":1},{"port":421,"proto":"tcp","label":"","count":1},{"port":3421,"proto":"tcp","label":"","count":1},{"port":976,"proto":"tcp","label":"","count":1},{"port":1049,"proto":"tcp","label":"","count":1},{"port":2216,"proto":"tcp","label":"","count":1},{"port":1644,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":468},{"date":"2026-08-28","count":1642},{"date":"2026-08-29","count":1623},{"date":"2026-08-30","count":529},{"date":"2026-09-03","count":10},{"date":"2026-09-04","count":501},{"date":"2026-09-05","count":87}],"recent_events":[{"timestamp":"2026-09-05T04:02:58","port":11171,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"6cb46e7f-75f9-48eb-a88b-61961e7b0142","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T04:00:33","port":10232,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"27b521af-17c9-4b51-9071-2528eb98f41f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:59:56","port":14844,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"f52eee2c-ec51-4b87-86ea-4a5e373e8b6e","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:58:36","port":14653,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"04bd7239-d4be-4fde-a278-b6a2ef18f08f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:56:00","port":10381,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9cf51fe4-ab05-4f4c-a1fa-b13ef62fd971","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:52:49","port":10503,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"b53f37be-e202-4673-9adb-f843653d05e7","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:49:21","port":14642,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"8aeda6c4-cc96-4cd4-a3ba-1e0475abdefc","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:49:13","port":13916,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"1ce933c7-b45a-4c72-90b4-e5e150365753","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:48:17","port":14417,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"82df0b0d-3799-4372-8d3c-d6b6b433e5dc","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-05T03:47:50","port":10453,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"12e8ceee-dcff-42b3-aa3a-66169d910b6b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"fa962c48ab1145cc","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[],"distinct_ports_total":4859,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T11:34:00.432151+00:00"}