1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
{
"total_events": 36,
"first_seen": "2026-08-28T20:14:49",
"last_seen": "2026-08-29T08:27:41",
"asn_number": 210644,
"asn_org": "Aeza Group LLC",
"country_name": "Austria",
"country_code": "AT",
"ports_targeted": [
8080,
8090,
8081,
8085,
8999,
8989,
8282
],
"ports_targeted_count": 7,
"tls_event_count": 25,
"top_http_methods": [
"GET"
],
"top_user_agents": [
"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",
"Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18",
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18"
],
"top_url_paths": [
"/",
"/favicon.ico",
"/v1/getinfo"
],
"top_ja4_fingerprints": [
"t12i130500_2d7513195f68_e51b7354d87f",
"t13i1909h2_9dc949149365_97f8aa674fd9"
],
"top_ja3_fingerprints": [
"cba7f34191ef2379c1325641f6c6c4f4",
"7c1e207beb00684bbbe144f1b0abe1d5"
],
"top_hassh_fingerprints": [],
"client_cert_event_count": 0,
"client_cert_subjects": [],
"rdns": "",
"loader_hits": 0,
"exploit_hits": 0,
"bytes_sent": 8107,
"unique_source_ips": 1,
"ioc": "147.45.71.214",
"window": "all retained data (no time filter)",
"query_type": "ip",
"scanner": null,
"verdict_key": "probing",
"verdict": "Low-level probing",
"verdict_why": [
"36 event(s), fewer than 10 distinct ports, no exploit payloads.",
"Not in any known-scanner range.",
"Sent 8,107 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."
],
"verdict_confidence": "low",
"cve_probes": []
}
|
