{"ip":"102.220.160.39","total_events":77,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-05-19T23:14:36","last_seen":"2026-07-08T10:02:49","events_24h":6,"events_7d":40,"geo":{"country_code":"SI","country_name":"Slovenia","region":"","city":"","lat":46.0833,"lon":15.0,"asn":197769,"org":"VPS Dedicated LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":10003,"proto":"tcp","label":"","count":12},{"port":11530,"proto":"tcp","label":"","count":6},{"port":20109,"proto":"tcp","label":"","count":6},{"port":9898,"proto":"tcp","label":"","count":4},{"port":16629,"proto":"tcp","label":"","count":4},{"port":3876,"proto":"tcp","label":"","count":4},{"port":8989,"proto":"tcp","label":"","count":3},{"port":10808,"proto":"tcp","label":"","count":3},{"port":27508,"proto":"tcp","label":"","count":3},{"port":57182,"proto":"tcp","label":"","count":3},{"port":57181,"proto":"tcp","label":"","count":3},{"port":2303,"proto":"tcp","label":"","count":3},{"port":9030,"proto":"tcp","label":"","count":3},{"port":3829,"proto":"tcp","label":"","count":3},{"port":8282,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":["4ed0d5b0dc3be39c7f96ba3a3cc77895"],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{"4ed0d5b0dc3be39c7f96ba3a3cc77895":42},"user_agents":[],"timeline":[{"date":"2026-05-19","count":2},{"date":"2026-05-25","count":1},{"date":"2026-06-04","count":2},{"date":"2026-06-05","count":4},{"date":"2026-06-24","count":1},{"date":"2026-06-26","count":1},{"date":"2026-06-28","count":4},{"date":"2026-06-29","count":6},{"date":"2026-06-30","count":16},{"date":"2026-07-02","count":9},{"date":"2026-07-04","count":6},{"date":"2026-07-05","count":6},{"date":"2026-07-06","count":9},{"date":"2026-07-07","count":4},{"date":"2026-07-08","count":6}],"recent_events":[{"timestamp":"2026-07-08T10:02:49","port":10808,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.0\r\nHost: 1.1.1.1\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e300d0a486f73743a20312e312e312e310d0a0d0a","method":"","user_agent":"","community_id":"1:kQNiRzFEXiFgCYt8Y0xm3ziHla8=","ja3":"","session":"d62fa5c2-cd9c-4000-a411-55100c925749","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"7bf4fcd09bb7e254","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.0","Host: 1.1.1.1"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-07-08T10:02:48","port":10808,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000","payload_hex":"040100500000000000","method":"","user_agent":"","community_id":"1:PK/QVVn4cZqMRTsHkWqFJcOkMrk=","ja3":"","session":"8f2dedd2-0e55-4593-ac16-6deb35ed6632","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-07-08T10:02:47","port":10808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","community_id":"1:YdZm5tKr7DaWfMie9psY36/wzXY=","ja3":"","session":"92c814fc-19c6-4a5a-aaea-4982c82c24fa","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":14,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-07-08T02:51:15","port":27508,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.0\r\nHost: 1.1.1.1\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e300d0a486f73743a20312e312e312e310d0a0d0a","method":"","user_agent":"","community_id":"1:VWUDtAI1uAGLD0m9XGa6sUSnISA=","ja3":"","session":"857bc640-4ae6-443f-b558-abf6522a2fe7","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"7bf4fcd09bb7e254","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.0","Host: 1.1.1.1"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-07-08T02:51:14","port":27508,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000","payload_hex":"040100500000000000","method":"","user_agent":"","community_id":"1:ZpuQHaiN4ZBfo9i9ROLOmzxc4r4=","ja3":"","session":"e9ef8e46-c8d2-42c8-97bb-f03d152b3a5c","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-07-08T02:51:14","port":27508,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","community_id":"1:ItS3dBbUiMyF91NzqwgdovNRb70=","ja3":"","session":"bba6b099-fd94-41bd-8518-94a79e472e4b","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":14,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-07-07T00:19:46","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 102.220.160.39:80 HTTP/1.0\r\nHost: 102.220.160.39:80\r\n\r\n","payload_hex":"434f4e4e454354203130322e3232302e3136302e33393a383020485454502f312e300d0a486f73743a203130322e3232302e3136302e33393a38300d0a0d0a","method":"","user_agent":"","community_id":"1:7SxkWIHeNAcaOzt+wwqwIwoYfB4=","ja3":"","session":"2a247f9d-7787-46c6-9dde-769514a0ac94","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":14,"enriched":{"digest":"9f6e2cb23072ad4b","label":"HTTP","strings":["CONNECT 102.220.160.39:80 HTTP/1.0","Host: 102.220.160.39:80"],"iocs":{"ips":["102.220.160.39"]}}},{"timestamp":"2026-07-07T00:04:17","port":8282,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.0\r\nHost: 1.1.1.1\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e300d0a486f73743a20312e312e312e310d0a0d0a","method":"","user_agent":"","community_id":"1:GC7LSQQZ3MoSNjxKKth3G9ghTgg=","ja3":"","session":"35f479f2-d5da-4515-bf23-5f27d5c320b7","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14,"enriched":{"digest":"7bf4fcd09bb7e254","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.0","Host: 1.1.1.1"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-07-07T00:04:17","port":8282,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000","payload_hex":"040100500000000000","method":"","user_agent":"","community_id":"1:5i4BRWxRDiVlj54XIK2awSAz5TE=","ja3":"","session":"34fb0beb-b475-4fef-bdd4-143b3f1ec3b0","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-07-07T00:04:16","port":8282,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","community_id":"1:7t+9JhUzSfkn+VllPjt+FYrTnQ4=","ja3":"","session":"9adb7b77-5c2b-4270-b611-88ac30323aae","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":14,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":23,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh_0.11.4","count":7}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-08T13:24:27.293542+00:00"}