{"ip":"175.41.176.248","total_events":68,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"55+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 55 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,924 bytes sent","bytes_sent":2924,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T21:02:34","last_seen":"2026-09-28T13:52:23","events_24h":16,"events_7d":68,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":16509,"org":"Amazon.com, Inc."},"source_domain":"ec2-175-41-176-248.ap-southeast-1.compute.amazonaws.com","known_scanners":[],"scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8899,"proto":"tcp","label":"","count":2},{"port":4433,"proto":"tcp","label":"","count":2},{"port":6677,"proto":"tcp","label":"","count":2},{"port":4455,"proto":"tcp","label":"","count":2},{"port":8877,"proto":"tcp","label":"","count":2},{"port":33895,"proto":"tcp","label":"","count":2},{"port":3333,"proto":"tcp","label":"","count":2},{"port":452,"proto":"tcp","label":"","count":2},{"port":3392,"proto":"tcp","label":"","count":2},{"port":2323,"proto":"tcp","label":"","count":2},{"port":3434,"proto":"tcp","label":"","count":2},{"port":5656,"proto":"tcp","label":"","count":2},{"port":53389,"proto":"tcp","label":"","count":2},{"port":12389,"proto":"tcp","label":"","count":1},{"port":33893,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":11},{"date":"2026-09-26","count":18},{"date":"2026-09-27","count":19},{"date":"2026-09-28","count":16}],"recent_events":[{"timestamp":"2026-09-28T13:52:23","port":6677,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"97101a5b-bdd8-4962-8799-403d34f8a2e6","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T13:50:14","port":5656,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"e468049e-2038-43e3-baae-4832bae8cf51","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T13:37:02","port":33389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"80deb73b-cb00-4bd2-8d62-ed3d9c637ce3","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T13:27:02","port":7777,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"101b9da3-eb54-4344-90cb-5f9aee1dff6c","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T10:58:21","port":4433,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"d1055d82-cceb-4fa9-aa12-f0dd0f9b5365","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T09:47:17","port":3434,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"e9d52e2a-52dd-4696-92b9-d7c989933919","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T09:40:13","port":1111,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"13209ca9-109e-4973-b919-9b53aa673831","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T09:01:35","port":452,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"88291639-cae1-4652-aadd-13589baeb6f5","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T08:39:57","port":53389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"4c3bf27a-41b3-4063-9f22-703eb738d7da","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-09-28T08:12:31","port":8877,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a010008000b000000","method":"","user_agent":"","ja3":"","session":"4e54ca5e-7649-4bd5-a2c2-42565a23c3ef","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":14,"enriched":{"digest":"5c203121797eabcd","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}}],"http_methods":[],"distinct_ports_total":55,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T22:25:45.275193+00:00"}