{"ip":"120.48.84.44","total_events":58,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["58 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 12,344 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,344 bytes sent","bytes_sent":12344,"session_seconds":13,"persistent":false}},"first_seen":"2026-06-15T01:24:59","last_seen":"2026-08-14T13:04:00","events_24h":0,"events_7d":45,"geo":{"country_code":"CN","country_name":"China","region":"Beijing","city":"Beijing","lat":39.911,"lon":116.395,"asn":38365,"org":"Beijing Baidu Netcom Science and Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as38365","label":"Baidu Netcom Science and Technology Co., Ltd.","category":"cdn","url":"https://www.peeringdb.com/asn/38365"},"cve_matches":[],"malware":[],"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":58}],"fingerprints":{"ssh_hassh":["98ddc5604ef6a1006a2b49a58759fbe6"],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{"98ddc5604ef6a1006a2b49a58759fbe6":130},"user_agents":[],"timeline":[{"date":"2026-06-15","count":13},{"date":"2026-08-14","count":45}],"recent_events":[{"timestamp":"2026-08-14T13:04:00","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"4697c8b1-de56-4ba9-895e-0e26915b722e","seq":1,"duration_ms":2100,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:56","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"701b6a8d-7582-47f9-9346-c25e0266caf2","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:47","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"da6674b2-71d3-460f-90b5-5fdc1b4a9153","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:41","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"8afbc6fc-d4a3-4203-8587-8d33e6892d47","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:41","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0003|\u000b\u0014Lڏ\u0003]ɞ$y����ҫ�\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001�rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\b���z�?db(","payload_hex":"0000037c0b144cda8f035dc99e2479effcc0a1d2abb500000071637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861310000018b7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3531322c7273612d736861322d3235362c7373682d7273612c7373682d6473732c7373682d65643235353139000000556165733132382d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d637472000000556165733132382d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d63747200000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000f408cffcf57ae33f646228","method":"","user_agent":"","ja3":"","session":"913d87c8-f855-478e-84cb-c2ebe35ebd4a","seq":2,"duration_ms":6340,"bytes_in":908,"bytes_out":24,"enriched":{"digest":"b1e4a98fae14286e","strings":["qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-ni…","rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert…","Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes2…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","?db("],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-08-14T13:03:37","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"913d87c8-f855-478e-84cb-c2ebe35ebd4a","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:33","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"944482e6-160e-4edf-a119-2e0b8757dd91","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:20","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"7e39ee15-ad5a-4848-a8e5-2ea3465528da","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:15","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"60170068-9709-4a4d-ae59-ea4b781075b1","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-08-14T13:03:10","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"47a2eb01-fb89-4747-8b6b-94f12290293f","seq":1,"duration_ms":2100,"bytes_in":12,"bytes_out":12,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":53}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-16T12:58:54.782968+00:00"}