{"ip":"107.189.2.172","total_events":160,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"17+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 17 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,088 bytes sent","bytes_sent":12088,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-05T14:37:57","last_seen":"2026-10-09T11:59:18","events_24h":60,"events_7d":160,"geo":{"country_code":"LU","country_name":"Luxembourg","region":"Luxembourg","city":"Luxembourg","lat":49.7855,"lon":6.1001,"asn":53667,"org":"FranTech Solutions"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":16},{"port":9999,"proto":"tcp","label":"","count":14},{"port":1080,"proto":"tcp","label":"SOCKS","count":12},{"port":10808,"proto":"tcp","label":"","count":12},{"port":1089,"proto":"tcp","label":"","count":12},{"port":8889,"proto":"tcp","label":"","count":12},{"port":8118,"proto":"tcp","label":"","count":12},{"port":7890,"proto":"tcp","label":"","count":10},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":8},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":8},{"port":10800,"proto":"tcp","label":"","count":8},{"port":9002,"proto":"tcp","label":"","count":8},{"port":4145,"proto":"tcp","label":"","count":8},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":8},{"port":6588,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-05","count":18},{"date":"2026-10-06","count":20},{"date":"2026-10-07","count":28},{"date":"2026-10-08","count":74},{"date":"2026-10-09","count":20}],"recent_events":[{"timestamp":"2026-10-09T11:59:18","port":8080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a1de03d8-71ff-4325-b144-97e666a5ca6a","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-09T11:59:14","port":8080,"proto":"tcp","app_proto":"","app_protocol":"doh_dot","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT dns.google:443 HTTP/1.1\r\nHost: dns.google:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420646e732e676f6f676c653a34343320485454502f312e310d0a486f73743a20646e732e676f6f676c653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"4ca451d0-f6e1-43a3-8883-d1e92d632bf8","seq":1,"duration_ms":100,"bytes_in":142,"bytes_out":13,"enriched":{"digest":"903688b14e0ae5c6","label":"HTTP","strings":["CONNECT dns.google:443 HTTP/1.1","Host: dns.google:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["dns.google"]}}},{"timestamp":"2026-10-09T11:55:07","port":8080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ee578f74-0df5-472c-b3fe-7f6fd1f7466e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-09T11:55:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"7688e378-6635-4136-b750-7b6530254e5a","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":13,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-10-09T11:40:58","port":1089,"proto":"tcp","app_proto":"","app_protocol":"doh_dot","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT dns.google:443 HTTP/1.1\r\nHost: dns.google:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420646e732e676f6f676c653a34343320485454502f312e310d0a486f73743a20646e732e676f6f676c653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"bdbb229e-7be0-4feb-aee3-1d5ef5dee899","seq":1,"duration_ms":100,"bytes_in":142,"bytes_out":13,"enriched":{"digest":"903688b14e0ae5c6","label":"HTTP","strings":["CONNECT dns.google:443 HTTP/1.1","Host: dns.google:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["dns.google"]}}},{"timestamp":"2026-10-09T11:40:57","port":1089,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"2fb35f38-dd07-477c-8c1a-b1146acec85e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-09T11:37:29","port":1089,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"232d8032-caee-4bb9-bc06-0d89c593da6e","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":13,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-10-09T11:37:28","port":1089,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a045152f-0524-4e12-8042-205019502eec","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-09T11:00:07","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"db47f360-db5e-43fb-9c52-70c0fa03242e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-09T11:00:02","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"3c0debc6-1dc1-42d0-83a8-3080c2bddee4","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":13,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}}],"http_methods":[],"distinct_ports_total":17,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-09T12:10:53.720177+00:00"}