{"ip":"113.194.88.168","observed":true,"total_events":2081,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 9 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,454,169 bytes sent","bytes_sent":2454169,"session_seconds":32,"persistent":false},"basis":"combined"},"first_seen":"2026-10-17T15:44:43","last_seen":"2026-10-19T01:53:51","events_24h":0,"events_7d":2081,"interactive_sessions":9,"interactive_sessions_24h":0,"interactive_sessions_7d":9,"interactive_protocols":[{"protocol":"ssh","sessions":9}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":"168.88.194.113.adsl-pool.jx.chinaunicom.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":9,"first_seen":"2026-10-18T12:56:32","last_seen":"2026-10-18T22:29:07","verdicts":[{"verdict":"unknown","sessions":9}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":9}],"services":[{"protocol":"ssh","port":6,"sessions":1},{"protocol":"ssh","port":1,"sessions":1},{"protocol":"ssh","port":7,"sessions":1},{"protocol":"ssh","port":10,"sessions":1},{"protocol":"ssh","port":5,"sessions":1},{"protocol":"ssh","port":3,"sessions":1},{"protocol":"ssh","port":2,"sessions":1},{"protocol":"ssh","port":9,"sessions":1},{"protocol":"ssh","port":4,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":9,"proto":"tcp","label":"","count":1034,"sessions":1},{"port":7,"proto":"tcp","label":"","count":1031,"sessions":1},{"port":10,"proto":"tcp","label":"","count":2,"sessions":1},{"port":2,"proto":"tcp","label":"","count":2,"sessions":1},{"port":5,"proto":"tcp","label":"","count":2,"sessions":1},{"port":6,"proto":"tcp","label":"","count":2,"sessions":1},{"port":4,"proto":"tcp","label":"","count":2,"sessions":1},{"port":3,"proto":"tcp","label":"","count":2,"sessions":1},{"port":1,"proto":"tcp","label":"","count":2,"sessions":1},{"port":8,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":445},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-17","count":2064,"sessions":0},{"date":"2026-10-18","count":16,"sessions":9},{"date":"2026-10-19","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-19T01:53:51","port":6,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"b3d84fa8-e05f-433c-ab98-68ca2c69c52d","seq":1,"duration_ms":300,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T22:54:43","port":2,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"08de2384-6c14-4d40-a628-3d2d08299e01","seq":1,"duration_ms":324,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T22:54:39","port":6,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"1d1a82d4-a870-4a7f-966f-2dbffb9cecbf","seq":1,"duration_ms":358,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T22:54:39","port":3,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"b352db11-6be2-4415-bdd3-d0c946ad58c1","seq":1,"duration_ms":446,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T22:29:07","port":2,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"77e89168-2d99-4092-9301-eb0995fcae75","seq":1,"duration_ms":409,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T21:55:31","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"0e6be8a6-bf94-46c4-9224-1d6f8427a5a2","seq":1,"duration_ms":302,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T21:55:02","port":10,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"aefa6ce6-d518-4fb5-b8ae-eb78cc23faed","seq":1,"duration_ms":346,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T21:54:59","port":3,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"84b09fd9-efa6-4cc7-833d-45acd4c77d24","seq":1,"duration_ms":380,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T21:09:55","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"449e5dae-9d37-438d-a03d-f6eeaab58303","seq":1,"duration_ms":354,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T21:09:50","port":9,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"2ed1d421-c31b-4899-a894-00749ac7b3ec","seq":1,"duration_ms":397,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":2020}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-20T12:02:06.638847+00:00"}