{"ip":"103.244.88.17","total_events":2650,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"339+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 339 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-09T13:34:49","last_seen":"2026-07-10T02:29:58","events_24h":0,"events_7d":2650,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":6134,"org":"XNNET LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as6134","label":"XNNET LLC","category":"isp","url":"https://www.peeringdb.com/asn/6134"},"cve_matches":[],"malware":[],"top_ports":[{"port":686,"proto":"tcp","label":"","count":32},{"port":612,"proto":"tcp","label":"","count":31},{"port":624,"proto":"tcp","label":"","count":30},{"port":663,"proto":"tcp","label":"","count":30},{"port":656,"proto":"tcp","label":"","count":30},{"port":607,"proto":"tcp","label":"","count":29},{"port":657,"proto":"tcp","label":"","count":29},{"port":680,"proto":"tcp","label":"","count":29},{"port":644,"proto":"tcp","label":"","count":28},{"port":608,"proto":"tcp","label":"","count":28},{"port":629,"proto":"tcp","label":"","count":27},{"port":639,"proto":"tcp","label":"","count":27},{"port":699,"proto":"tcp","label":"","count":27},{"port":683,"proto":"tcp","label":"","count":27},{"port":651,"proto":"tcp","label":"","count":27}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-09","count":2064},{"date":"2026-07-10","count":586}],"recent_events":[{"timestamp":"2026-07-10T02:29:58","port":639,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:dPX1M18DYY5aPjqmQzT5xTZVK30=","ja3":"","session":"5af20959-7a47-4631-95ff-31652e0b512b","seq":1,"duration_ms":321,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:57","port":13389,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:xuBttqdba3HfwMqT7e7oE5/5NUo=","ja3":"","session":"23b44702-e951-47f9-980b-81c3787be00d","seq":1,"duration_ms":306,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:56","port":624,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:fHkBjWI8ONbqJk4/50hqfnGLCyM=","ja3":"","session":"8d3e6e36-b580-403c-ab34-6bb4ba93e363","seq":1,"duration_ms":318,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:55","port":680,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:dh4bFzARYAVjQK3KOlI8DRvoJsI=","ja3":"","session":"072d2c5e-b201-424f-a985-570b5f390a26","seq":1,"duration_ms":319,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:48","port":621,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:5XKjCzxH7Mnug3CzMoQq62GXm5w=","ja3":"","session":"74290aab-ae84-49a4-ae79-555240f3d6a2","seq":1,"duration_ms":306,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:40","port":689,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:S341COXWv+8xrh1Ak5eRpf9Ra3M=","ja3":"","session":"4f9c5c68-ec28-4d94-a868-93da031c3e90","seq":1,"duration_ms":314,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:39","port":625,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:frKz0Ktlkp1vxvqM79kOvbwnyKs=","ja3":"","session":"6cfd55ce-edf4-4896-a6c1-3188a1fd06d7","seq":1,"duration_ms":317,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:35","port":631,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:O2AY1xHZxat/WoEavl5MenCxfHk=","ja3":"","session":"61ddbcd4-d68b-4381-a3e3-d296ec5c0089","seq":1,"duration_ms":317,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:33","port":692,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:yB0L5Y7HtGtfAGP+CSouEjSUDfU=","ja3":"","session":"9a2582e3-bfca-4dd0-8b59-fd98b58b0830","seq":1,"duration_ms":310,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}},{"timestamp":"2026-07-10T02:29:27","port":643,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-ssh-sift_0.1\r\n","payload_hex":"5353482d322e302d7373682d736966745f302e310d0a","method":"","user_agent":"","community_id":"1:VnocQdCBpCsXpDn2AulhJ5Rt2Ig=","ja3":"","session":"c66ad890-e088-4acb-ba99-dc1cf95c5a64","seq":1,"duration_ms":322,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"7d79f56dd5f4242f","label":"SSH","strings":["SSH-2.0-ssh-sift_0.1"]}}],"http_methods":[],"distinct_ports_total":339,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ssh-sift_0.1","count":2198}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-13T03:06:22.312726+00:00"}