{"ip":"47.238.90.202","total_events":88,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"88+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 88 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,198 bytes sent","bytes_sent":1198,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-28T06:04:58","last_seen":"2026-09-28T06:05:26","events_24h":0,"events_7d":88,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":81,"proto":"tcp","label":"","count":1},{"port":3306,"proto":"tcp","label":"MySQL","count":1},{"port":8090,"proto":"tcp","label":"","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1},{"port":58000,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":888,"proto":"tcp","label":"","count":1},{"port":2096,"proto":"tcp","label":"","count":1},{"port":8001,"proto":"tcp","label":"","count":1},{"port":5060,"proto":"tcp","label":"SIP","count":1},{"port":23,"proto":"tcp","label":"Telnet","count":1},{"port":2052,"proto":"tcp","label":"","count":1},{"port":5000,"proto":"tcp","label":"Web-alt","count":1},{"port":1717,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq060_00450811_68e7e286"]},"fingerprint_peers":{"b11cuq060_00450811_68e7e286":5},"akin_families":{},"user_agents":["Microsoft WinRM Client"],"timeline":[{"date":"2026-09-28","count":88}],"recent_events":[{"timestamp":"2026-09-28T06:05:26","port":2077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"958240b0-5492-4cfe-a2f7-2476a1394fa6","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:26","port":2078,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"e840f09d-502e-4d49-83f1-d4974d6e7ecd","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:25","port":6467,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"e0b1ef5f-667f-4cd2-bacf-7c123605bf8a","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:25","port":7170,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"114e6092-6624-440b-8d56-032f9ca06d93","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:25","port":1717,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"400a7b45-72a3-4f56-8c05-7cf0914e7173","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:25","port":51005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"44d2df37-5415-4b6a-9623-fd0a355b1da1","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:24","port":2095,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"02eb29a3-b61a-4847-aa04-67681b1526c4","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:24","port":6466,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"509a3f68-c611-482d-b927-b424fee74ce5","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:23","port":20201,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"c89b930f-1d32-40b8-8d12-7049b8c16d41","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-28T06:05:23","port":40000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"88a1a33c-bdf1-4980-800d-a9aae8f5817c","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13}],"http_methods":[{"method":"POST","count":1}],"distinct_ports_total":88,"top_paths":[{"path":"/wsman","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.081.201","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.4","count":1}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T16:01:53.626359+00:00"}