1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
{
"total_events": 9934,
"first_seen": "2026-03-10T13:01:04",
"last_seen": "2026-08-31T09:44:38",
"asn_number": 198953,
"asn_org": "Proton66 OOO",
"country_name": "Russia",
"country_code": "RU",
"ports_targeted": [
1435,
1433,
1434,
3433,
11433,
3005,
14333,
1800,
5005,
14330,
8433,
2433,
1533,
8888,
18433,
1437,
23341,
33000,
7433,
1455,
4171,
21433,
6240,
25366,
61433,
9999,
41433,
6802,
2468,
12433,
10433,
42130,
5000,
5367,
43399,
1444,
3333,
6433,
6366,
51433,
1551,
3341,
6602,
17433,
22020,
9433,
14331,
1002,
1501,
45366
],
"ports_targeted_count": 289,
"tls_event_count": 0,
"top_http_methods": [],
"top_user_agents": [],
"top_url_paths": [],
"top_ja4_fingerprints": [],
"top_ja3_fingerprints": [],
"top_hassh_fingerprints": [],
"client_cert_event_count": 0,
"client_cert_subjects": [],
"rdns": "",
"loader_hits": 0,
"exploit_hits": 0,
"bytes_sent": 476678,
"unique_source_ips": 1,
"ioc": "::ffff:176.120.22.61",
"window": "all retained data (no time filter)",
"query_type": "ip",
"scanner": null,
"verdict_key": "scanning",
"verdict": "Unrecognized scanner",
"verdict_why": [
"No exploit payloads observed.",
"Swept 289 distinct ports (threshold for a sweep is 10).",
"Not in any known-scanner range."
],
"verdict_confidence": "medium",
"cve_probes": []
}
|
