{"ip":"47.76.135.163","total_events":90,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"90+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 90 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,200 bytes sent","bytes_sent":1200,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-07T20:29:17","last_seen":"2026-09-07T20:29:45","events_24h":0,"events_7d":0,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":81,"proto":"tcp","label":"","count":1},{"port":3306,"proto":"tcp","label":"MySQL","count":1},{"port":8090,"proto":"tcp","label":"","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1},{"port":58000,"proto":"tcp","label":"","count":1},{"port":1717,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":7777,"proto":"tcp","label":"Oracle","count":1},{"port":24442,"proto":"tcp","label":"","count":1},{"port":2096,"proto":"tcp","label":"","count":1},{"port":8001,"proto":"tcp","label":"","count":1},{"port":5060,"proto":"tcp","label":"SIP","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":4343,"proto":"tcp","label":"","count":1},{"port":1024,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq060_00450811_68e7e286"]},"fingerprint_peers":{"b11cuq060_00450811_68e7e286":5},"akin_families":{},"user_agents":["Microsoft WinRM Client"],"timeline":[{"date":"2026-09-07","count":90}],"recent_events":[{"timestamp":"2026-09-07T20:29:45","port":2078,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"48b009f2-7970-4296-8903-18a1447a4b25","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:45","port":51005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"f7f3a3e7-6a10-4209-9eb1-fc0d6d3772cd","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:45","port":24442,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"62572fca-3b6b-4b1d-9421-4c70e4aa311a","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:44","port":7170,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"978c0795-cf5c-47fa-ae27-423e22e1b98d","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:44","port":1717,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"c9a003b7-ecaf-4b80-9ce8-2035c1ca3bd9","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:44","port":2077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"62fabd3a-48be-437c-98d2-a3d4f8355f83","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:43","port":6466,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"3737462a-ba89-4f0e-a010-1b96c48e0018","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:41","port":2096,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"fb38d2c4-71d2-4ed1-94ba-f9cde37f2593","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:41","port":2086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"f58ff2e9-3c90-430b-b947-331a256d81f6","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-09-07T20:29:41","port":6699,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"33d5a575-cbc7-4cfd-a08d-1c31ce35699e","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13}],"http_methods":[{"method":"POST","count":1}],"distinct_ports_total":90,"top_paths":[{"path":"/wsman","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"023.094.036.141","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_7.4","count":1}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T16:01:54.039355+00:00"}