{"ip":"104.194.94.88","total_events":376,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"20+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 20 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"23,076 bytes sent","bytes_sent":23076,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T04:45:41","last_seen":"2026-08-31T01:04:08","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0481,"lon":-118.2531,"asn":25820,"org":"IT7 Networks Inc"},"source_domain":"104.194.94.88.16clouds.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as25820","label":"IT7 Networks","category":"cdn","url":"https://www.peeringdb.com/asn/25820"},"cve_matches":[],"malware":[],"top_ports":[{"port":1124,"proto":"tcp","label":"","count":32},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":32},{"port":1024,"proto":"tcp","label":"","count":32},{"port":1234,"proto":"tcp","label":"","count":32},{"port":2001,"proto":"tcp","label":"","count":32},{"port":6005,"proto":"tcp","label":"","count":24},{"port":8082,"proto":"tcp","label":"","count":24},{"port":40000,"proto":"tcp","label":"","count":24},{"port":3126,"proto":"tcp","label":"","count":24},{"port":10086,"proto":"tcp","label":"","count":24},{"port":8383,"proto":"tcp","label":"","count":24},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":8},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":8},{"port":9050,"proto":"tcp","label":"","count":8},{"port":3172,"proto":"tcp","label":"","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-30","count":280},{"date":"2026-08-31","count":96}],"recent_events":[{"timestamp":"2026-08-31T01:04:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"081ccd8c-47ef-42fe-93d9-f8f34071ee84","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:04:06","port":1124,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"3136bc5b-bc6d-4ea4-96d6-855e4b0704c0","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:04:05","port":8888,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\nUser-Agent: Go-http-client/1.1\r\nProxy-Authorization: Basic cHJveHk6MTIzNDU2\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a34343320485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a50726f78792d417574686f72697a6174696f6e3a2042617369632063484a7665486b364d54497a4e4455320d0a0d0a","method":"","user_agent":"","ja3":"","session":"74e071e6-b11e-45da-a8dd-1cae86d30c9d","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"81cf4142126f652c","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:443 HTTP/1.1","Host: checkip.amazonaws.com:443","User-Agent: Go-http-client/1.1","Proxy-Authorization: Basic cHJveHk6MTIzNDU2"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-08-31T01:04:05","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"1a1e647d-938c-4856-bf36-76d6a57b34bd","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:04:03","port":1124,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipify.org:443 HTTP/1.1\r\nHost: api.ipify.org:443\r\nUser-Agent: Go-http-client/1.1\r\nProxy-Authorization: Basic cHJveHk6MTIzNDU2\r\n\r\n","payload_hex":"434f4e4e454354206170692e69706966792e6f72673a34343320485454502f312e310d0a486f73743a206170692e69706966792e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a50726f78792d417574686f72697a6174696f6e3a2042617369632063484a7665486b364d54497a4e4455320d0a0d0a","method":"","user_agent":"","ja3":"","session":"bdcc9dc7-ef2d-4ba5-9282-51dea5f3939c","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":13,"enriched":{"digest":"3808721d6d046f02","label":"HTTP","strings":["CONNECT api.ipify.org:443 HTTP/1.1","Host: api.ipify.org:443","User-Agent: Go-http-client/1.1","Proxy-Authorization: Basic cHJveHk6MTIzNDU2"],"iocs":{"domains":["api.ipify.org"]}}},{"timestamp":"2026-08-31T01:04:03","port":1124,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"4492cf48-34ec-4a4e-9f2b-7b7f6a76e014","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:04:02","port":6669,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"d1fc8680-ae97-4134-b892-adc688176c43","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:03:59","port":6669,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\nUser-Agent: Go-http-client/1.1\r\nProxy-Authorization: Basic cHJveHk6MTIzNDU2\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a34343320485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a50726f78792d417574686f72697a6174696f6e3a2042617369632063484a7665486b364d54497a4e4455320d0a0d0a","method":"","user_agent":"","ja3":"","session":"d2376806-c7bd-45bb-b952-16a08981588c","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"81cf4142126f652c","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:443 HTTP/1.1","Host: checkip.amazonaws.com:443","User-Agent: Go-http-client/1.1","Proxy-Authorization: Basic cHJveHk6MTIzNDU2"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-08-31T01:03:59","port":6669,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"dca124be-c8a0-4486-b7c3-626dd8f70a54","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-31T01:03:59","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ipv4.icanhazip.com:443 HTTP/1.1\r\nHost: ipv4.icanhazip.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e45435420697076342e6963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a20697076342e6963616e68617a69702e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"194ca774-c7f0-4c3a-b26b-ef8275f2a6b3","seq":1,"duration_ms":101,"bytes_in":105,"bytes_out":13,"enriched":{"digest":"0bf61141df3c88ca","label":"HTTP","strings":["CONNECT ipv4.icanhazip.com:443 HTTP/1.1","Host: ipv4.icanhazip.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ipv4.icanhazip.com"]}}}],"http_methods":[],"distinct_ports_total":20,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T07:56:03.848313+00:00"}