{"ip":"138.2.229.45","total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,250 bytes sent","bytes_sent":2250,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-08T15:41:09","last_seen":"2026-08-19T23:11:43","events_24h":9,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"San Jose","lat":37.2379,"lon":-121.7946,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[],"malware":[],"top_ports":[{"port":9080,"proto":"tcp","label":"","count":6},{"port":5080,"proto":"tcp","label":"","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6},{"port":4080,"proto":"tcp","label":"","count":3},{"port":6080,"proto":"tcp","label":"","count":3},{"port":7080,"proto":"tcp","label":"","count":3},{"port":9150,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":[]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":172},"user_agents":[],"timeline":[{"date":"2026-08-08","count":21},{"date":"2026-08-19","count":9}],"recent_events":[{"timestamp":"2026-08-19T23:11:43","port":9080,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"01f5dbd1-4962-450f-83b3-c42891bd2b6b","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:11:43","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"460c4955-01fc-4765-8d06-afcb5ee5bb9e","seq":1,"duration_ms":101,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:11:43","port":5080,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"3d6eb8b0-8400-41bf-9f68-4249c5195454","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:08:36","port":9080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"77d4544a-28f6-4040-9e3b-fe6aec0f9d1a","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:08:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"7a8632b5-d4ba-475d-89e1-c0fbff43f440","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:08:36","port":5080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"a2040ed2-77dc-4e74-9c2b-01a69b340f78","seq":1,"duration_ms":102,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}},{"timestamp":"2026-08-19T23:08:26","port":5080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"206a3eba-31bf-49d3-aa61-6f78f08dcaae","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-19T23:08:26","port":9080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"73264476-ec85-48ac-930a-641be74fdf5c","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-19T23:08:26","port":8080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"aee95046-6962-4f2a-8995-6122b5c57b9c","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-08T15:44:24","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1\r\nHost: ip.ifconfig.dpdns.org:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e4543542069702e6966636f6e6669672e6470646e732e6f72673a34343320485454502f312e310d0a486f73743a2069702e6966636f6e6669672e6470646e732e6f72673a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"9f404276-03e7-4c87-bf61-353c2824bbca","seq":1,"duration_ms":101,"bytes_in":111,"bytes_out":12,"enriched":{"digest":"983a6af792235189","label":"HTTP","strings":["CONNECT ip.ifconfig.dpdns.org:443 HTTP/1.1","Host: ip.ifconfig.dpdns.org:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["ip.ifconfig.dpdns.org"]}}}],"http_methods":[],"distinct_ports_total":7,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:21:36.472109+00:00"}