{"ip":"102.220.163.72","observed":true,"total_events":105,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["105 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 7,352 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,352 bytes sent","bytes_sent":7352,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-29T05:31:27","last_seen":"2026-10-12T23:42:49","events_24h":0,"events_7d":39,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SI","country_name":"Slovenia","region":"","city":"","lat":46.0833,"lon":15.0,"asn":197769,"org":"VPS Dedicated LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":15},{"port":4145,"proto":"tcp","label":"","count":15},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":15},{"port":443,"proto":"tcp","label":"HTTPS","count":15},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":15},{"port":1081,"proto":"tcp","label":"","count":12},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":9},{"port":1080,"proto":"tcp","label":"SOCKS","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":24},{"date":"2026-09-30","count":18},{"date":"2026-10-08","count":39},{"date":"2026-10-12","count":24}],"recent_events":[{"timestamp":"2026-10-12T23:42:49","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipify.org:443 HTTP/1.1\r\nHost: api.ipify.org:443\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e69706966792e6f72673a34343320485454502f312e310d0a486f73743a206170692e69706966792e6f72673a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131332e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"20bf662a-cf84-4f9b-b478-e8f45f8f013c","seq":1,"duration_ms":100,"bytes_in":224,"bytes_out":14,"enriched":{"digest":"2d1ede6eb44027bb","label":"HTTP","strings":["CONNECT api.ipify.org:443 HTTP/1.1","Host: api.ipify.org:443","User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (…","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.ipify.org"]}}},{"timestamp":"2026-10-12T23:42:49","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipify.org:443 HTTP/1.1\r\nHost: api.ipify.org:443\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e69706966792e6f72673a34343320485454502f312e310d0a486f73743a206170692e69706966792e6f72673a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131332e300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"695dea6d-d15b-44ac-8cc3-6cf32087f708","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":14,"enriched":{"digest":"e78ab880a7785842","label":"HTTP","strings":["CONNECT api.ipify.org:443 HTTP/1.1","Host: api.ipify.org:443","User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113…","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.ipify.org"]}}},{"timestamp":"2026-10-12T23:42:49","port":1081,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206874747062696e2e6f72673a34343320485454502f312e310d0a486f73743a206874747062696e2e6f72673a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131332e300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"83a8d51d-ea15-4657-8428-3066eec96712","seq":1,"duration_ms":101,"bytes_in":173,"bytes_out":14,"enriched":{"digest":"05031d038aa7e6fa","label":"HTTP","strings":["CONNECT httpbin.org:443 HTTP/1.1","Host: httpbin.org:443","User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113…","Proxy-Connection: keep-alive"],"iocs":{"domains":["httpbin.org"]}}},{"timestamp":"2026-10-12T23:42:49","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131342e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"b33f33be-fbed-4577-a2b1-ba8c1b7b9e37","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":14,"enriched":{"digest":"b47e9a7c74372635","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-10-12T23:42:49","port":4145,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131342e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"0c091dec-50e2-4dc6-9281-00c49a5ba847","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":14,"enriched":{"digest":"b47e9a7c74372635","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-10-12T23:42:49","port":443,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131332e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"534257a3-6392-471c-b5aa-e642f42515c0","seq":1,"duration_ms":101,"bytes_in":226,"bytes_out":14,"enriched":{"digest":"27de93e74d82d84f","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (…","Proxy-Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-10-12T23:42:49","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206874747062696e2e6f72673a34343320485454502f312e310d0a486f73743a206874747062696e2e6f72673a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131332e300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"de0188da-ee50-4659-a452-1a51f37cf09f","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":14,"enriched":{"digest":"05031d038aa7e6fa","label":"HTTP","strings":["CONNECT httpbin.org:443 HTTP/1.1","Host: httpbin.org:443","User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113…","Proxy-Connection: keep-alive"],"iocs":{"domains":["httpbin.org"]}}},{"timestamp":"2026-10-12T23:42:49","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131342e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"7af86282-d15a-4506-9f69-5fc3327fdec1","seq":1,"duration_ms":104,"bytes_in":220,"bytes_out":14,"enriched":{"digest":"2fe636f4bb2f3b76","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-10-12T23:42:46","port":1080,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"b94d6ac0-c3b0-4241-9905-f39c1df6e6f3","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-10-12T23:42:46","port":4145,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"946cdb10-e83d-4940-958e-758f90407652","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":14}],"http_methods":[],"distinct_ports_total":8,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T04:08:50.650935+00:00"}