1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
{
"total_events": 365,
"first_seen": "2026-02-16T21:48:36",
"last_seen": "2026-08-31T06:06:56",
"asn_number": 200651,
"asn_org": "FlokiNET ehf",
"country_name": "Romania",
"country_code": "RO",
"ports_targeted": [
443,
80,
8080,
444,
2222,
22,
8443
],
"ports_targeted_count": 7,
"tls_event_count": 97,
"top_http_methods": [
"GET",
"POST"
],
"top_user_agents": [
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2",
"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0",
"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0",
"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"
],
"top_url_paths": [
"/",
"/images/transparentpix.gif",
"/eventmanager",
"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows",
"/ajax",
"/api/checkin",
"/api/v1/update",
"/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7"
],
"top_ja4_fingerprints": [
"t13i1909h2_9dc949149365_97f8aa674fd9"
],
"top_ja3_fingerprints": [
"7c1e207beb00684bbbe144f1b0abe1d5"
],
"top_hassh_fingerprints": [
"e54ef3ec27fe1fea7ab64d3fa05359fd"
],
"client_cert_event_count": 0,
"client_cert_subjects": [],
"rdns": "",
"loader_hits": 0,
"exploit_hits": 0,
"bytes_sent": 38825,
"unique_source_ips": 1,
"ioc": "::ffff:185.100.87.136",
"window": "all retained data (no time filter)",
"query_type": "ip",
"scanner": null,
"verdict_key": "probing",
"verdict": "Low-level probing",
"verdict_why": [
"365 event(s), fewer than 10 distinct ports, no exploit payloads.",
"Not in any known-scanner range.",
"Sent 38,825 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."
],
"verdict_confidence": "low",
"cve_probes": []
}
|
