1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
{
"total_events": 7,
"first_seen": "2026-07-22T10:02:16",
"last_seen": "2026-08-27T07:59:32",
"asn_number": 138915,
"asn_org": "Kaopu Cloud HK Limited",
"country_name": "Philippines",
"country_code": "PH",
"ports_targeted": [
1190,
5986,
6666,
11111,
9092,
9030
],
"ports_targeted_count": 6,
"tls_event_count": 1,
"top_http_methods": [
"POST"
],
"top_user_agents": [
"Microsoft WinRM Client"
],
"top_url_paths": [
"/wsman?PSVersion=5.1.19041.1"
],
"top_ja4_fingerprints": [
"t13i220900_231e334592e8_29829a46703f"
],
"top_ja3_fingerprints": [
"622a7fd6adbafa3736c1a3468db8a8e0"
],
"top_hassh_fingerprints": [
"eb0e0554de9aeb368191c86016a40080"
],
"client_cert_event_count": 0,
"client_cert_subjects": [],
"rdns": "",
"loader_hits": 0,
"exploit_hits": 0,
"bytes_sent": 1124,
"unique_source_ips": 1,
"ioc": "154.90.37.55",
"window": "all retained data (no time filter)",
"query_type": "ip",
"scanner": null,
"verdict_key": "probing",
"verdict": "Low-level probing",
"verdict_why": [
"7 event(s), fewer than 10 distinct ports, no exploit payloads.",
"Not in any known-scanner range."
],
"verdict_confidence": "low",
"cve_probes": []
}
|
