{"ip":"107.175.148.253","total_events":290,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"168+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 168 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,470 bytes sent","bytes_sent":12470,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-13T07:42:12","last_seen":"2026-08-14T11:44:32","events_24h":125,"events_7d":290,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Buffalo","lat":42.8864,"lon":-78.8784,"asn":36352,"org":"HostPapa"},"source_domain":"107-175-148-253-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":3300,"proto":"tcp","label":"","count":6},{"port":4567,"proto":"tcp","label":"","count":4},{"port":6600,"proto":"tcp","label":"","count":4},{"port":33896,"proto":"tcp","label":"","count":4},{"port":4004,"proto":"tcp","label":"","count":4},{"port":11999,"proto":"tcp","label":"","count":4},{"port":1488,"proto":"tcp","label":"","count":4},{"port":452,"proto":"tcp","label":"","count":4},{"port":8933,"proto":"tcp","label":"","count":3},{"port":6070,"proto":"tcp","label":"","count":3},{"port":7789,"proto":"tcp","label":"","count":3},{"port":23389,"proto":"tcp","label":"","count":3},{"port":432,"proto":"tcp","label":"","count":3},{"port":53389,"proto":"tcp","label":"","count":3},{"port":5005,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-13","count":138},{"date":"2026-08-14","count":152}],"recent_events":[{"timestamp":"2026-08-14T11:44:32","port":7890,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"3688e28f-6c49-4c3a-a950-adc8dcf1cc40","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:30:17","port":6677,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"54007f1b-ad79-4be2-991a-ba13fdc13939","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:29:56","port":6677,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"ef6b9b77-4091-4d04-9c55-24b88dbca3a3","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:29:39","port":6677,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"46fb1400-e23d-4206-b836-c00ec25601c2","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:23:01","port":33891,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"4d134ecb-7bd0-4375-8efd-0f49a070a367","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:22:26","port":33891,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"dd0177ff-8a5a-4d13-aa1e-53b13342cfc4","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:09:58","port":7788,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"11475c26-aaaf-4d16-91c2-ee3729804b93","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:09:33","port":7788,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"3b989f65-acb4-43fb-8e0c-6e076d755f3e","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T11:09:25","port":7788,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"a60c45e7-494f-4e9e-a54a-a79291754749","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-08-14T10:45:32","port":9988,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"d5ece756-cebc-4eb6-8b4f-ff273bb39c98","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":15,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}}],"http_methods":[],"distinct_ports_total":168,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T07:01:06.683467+00:00"}