{"ip":"47.44.31.87","total_events":79,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-04T15:55:20","last_seen":"2026-07-08T09:38:18","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Georgia","city":"Columbus","lat":32.4732,"lon":-84.9754,"asn":20115,"org":"Charter Communications LLC"},"source_domain":"syn-047-044-031-087.biz.spectrum.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as20115","label":"Charter Communications","category":"isp","url":"https://www.peeringdb.com/asn/20115"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":27},{"port":3391,"proto":"tcp","label":"","count":14},{"port":3392,"proto":"tcp","label":"","count":12},{"port":3390,"proto":"tcp","label":"","count":5},{"port":3398,"proto":"tcp","label":"","count":5},{"port":3396,"proto":"tcp","label":"","count":5},{"port":3397,"proto":"tcp","label":"","count":4},{"port":3395,"proto":"tcp","label":"","count":4},{"port":3393,"proto":"tcp","label":"","count":2},{"port":3399,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-04","count":27},{"date":"2026-07-06","count":42},{"date":"2026-07-08","count":10}],"recent_events":[{"timestamp":"2026-07-08T09:38:18","port":3397,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:vH25a+pGPx6BBx/LId2oFrxFq9o=","ja3":"","session":"a95e9a0e-9421-44b1-a007-ff520701b8f2","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:37:40","port":3395,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:Hr+PA63N+4zIRZlAx4W3LxsaEEg=","ja3":"","session":"2dc1b497-3270-4714-a617-c8d7f0bce820","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:32:16","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:+RjKK9oZ/J4u6MvJGzeVp3GcPzM=","ja3":"","session":"b567c149-e796-49a5-96d3-82a0e24090ea","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:31:57","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:clkohaK85I/ePclfXUBlxpV7hUw=","ja3":"","session":"e8dedb2e-84d0-4aed-916c-ce4bd08f7ae5","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:31:26","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:h8V+NqYhztz0CmpEcSE92l5o28c=","ja3":"","session":"522e44dc-e092-4a04-936b-ee575fe8296c","seq":1,"duration_ms":101,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:30:00","port":3398,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:FYd4KGmgiotPhTgcNfEkOY/JlRc=","ja3":"","session":"4ca8400d-afdb-445c-b4ea-2ebe66dd0f6c","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:28:00","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:kt3Ur8qXAAQpzvVZnVuPwU0F3OA=","ja3":"","session":"864e8c6a-ea08-4e2e-a17e-757a34c20710","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:26:33","port":3396,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:Qe7VHrj8wMVuWqnpjAQwoh0Zxbk=","ja3":"","session":"5a63ce9d-ad81-4db3-9658-31f527417efe","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:22:23","port":3392,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:f0uZuvaJPMyWWi/vLEuftSRa5Do=","ja3":"","session":"bf2b4caa-f231-455c-b04f-38a3c2deb5f8","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}},{"timestamp":"2026-07-08T09:22:10","port":3392,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d68656c6c6f0d0a0100080003000000","method":"","user_agent":"","community_id":"1:RD5Z9Zn7UTCbDe+FPphNavz7bPo=","ja3":"","session":"17a511c3-e288-4410-a4eb-8dbd5f7a548d","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":11,"enriched":{"digest":"2a9e9bfa45800f63","label":"RDP (X.224)","strings":["Cookie: mstshash=hello"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-26T12:43:02.223563+00:00"}