{
 "total_events": 7,
 "first_seen": "2026-07-22T10:02:16",
 "last_seen": "2026-08-27T07:59:32",
 "asn_number": 138915,
 "asn_org": "Kaopu Cloud HK Limited",
 "country_name": "Philippines",
 "country_code": "PH",
 "ports_targeted": [
  1190,
  5986,
  6666,
  11111,
  9092,
  9030
 ],
 "ports_targeted_count": 6,
 "tls_event_count": 1,
 "top_http_methods": [
  "POST"
 ],
 "top_user_agents": [
  "Microsoft WinRM Client"
 ],
 "top_url_paths": [
  "/wsman?PSVersion=5.1.19041.1"
 ],
 "top_ja4_fingerprints": [
  "t13i220900_231e334592e8_29829a46703f"
 ],
 "top_ja3_fingerprints": [
  "622a7fd6adbafa3736c1a3468db8a8e0"
 ],
 "top_hassh_fingerprints": [
  "eb0e0554de9aeb368191c86016a40080"
 ],
 "client_cert_event_count": 0,
 "client_cert_subjects": [],
 "rdns": "",
 "loader_hits": 0,
 "exploit_hits": 0,
 "bytes_sent": 1124,
 "unique_source_ips": 1,
 "ioc": "::ffff:154.90.37.55",
 "window": "all retained data (no time filter)",
 "query_type": "ip",
 "scanner": null,
 "verdict_key": "probing",
 "verdict": "Low-level probing",
 "verdict_why": [
  "7 event(s), fewer than 10 distinct ports, no exploit payloads.",
  "Not in any known-scanner range."
 ],
 "verdict_confidence": "low",
 "cve_probes": []
}