{"ip":"141.98.10.198","data_as_of":"2026-10-23T02:35:04+00:00","observed":true,"total_events":773,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"54+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 54 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 347 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"109,586 bytes sent","bytes_sent":109586,"session_seconds":4,"persistent":false},"basis":"combined"},"first_seen":"2026-10-11T18:55:16","last_seen":"2026-10-23T01:54:54","events_24h":56,"events_7d":489,"interactive_sessions":347,"interactive_sessions_24h":45,"interactive_sessions_7d":307,"interactive_protocols":[{"protocol":"http-proxy","sessions":141},{"protocol":"socks5","sessions":114}],"geo":{"country_code":"LT","country_name":"Lithuania","region":"","city":"","lat":55.4167,"lon":24.0,"asn":209605,"org":"UAB Host Baltic"},"source_domain":"1rja.talonted.eu.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":347,"first_seen":"2026-10-14T20:35:56","last_seen":"2026-10-23T00:44:20","verdicts":[{"verdict":"scan","sessions":247},{"verdict":"unknown","sessions":100}],"personas":[{"persona":"proxy@squid/5.7","sessions":155},{"persona":"proxy@squid/4.13","sessions":100}],"services":[{"protocol":"socks5","port":1081,"sessions":10},{"protocol":"socks5","port":1080,"sessions":10},{"protocol":"http-proxy","port":1086,"sessions":6},{"protocol":"http-proxy","port":8838,"sessions":6},{"protocol":"tcp","port":60010,"sessions":6},{"protocol":"http-proxy","port":1087,"sessions":6},{"protocol":"http-proxy","port":8818,"sessions":6},{"protocol":"http-proxy","port":1090,"sessions":6},{"protocol":"http-proxy","port":8858,"sessions":6},{"protocol":"http-proxy","port":8828,"sessions":6},{"protocol":"http-proxy","port":8868,"sessions":6},{"protocol":"tcp","port":8988,"sessions":6}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":247}]},"top_ports":[{"port":1090,"proto":"tcp","label":"","count":16,"sessions":12},{"port":8858,"proto":"tcp","label":"","count":16,"sessions":12},{"port":8868,"proto":"tcp","label":"","count":16,"sessions":12},{"port":1083,"proto":"tcp","label":"","count":16,"sessions":12},{"port":8988,"proto":"tcp","label":"","count":16,"sessions":11},{"port":8016,"proto":"tcp","label":"","count":16,"sessions":6},{"port":8014,"proto":"tcp","label":"","count":16,"sessions":6},{"port":8013,"proto":"tcp","label":"","count":16,"sessions":6},{"port":8010,"proto":"tcp","label":"","count":16,"sessions":5},{"port":8099,"proto":"tcp","label":"","count":16,"sessions":5},{"port":8808,"proto":"tcp","label":"","count":16,"sessions":5},{"port":3130,"proto":"tcp","label":"","count":16,"sessions":0},{"port":3129,"proto":"tcp","label":"","count":16,"sessions":0},{"port":8085,"proto":"tcp","label":"","count":16,"sessions":0},{"port":8087,"proto":"tcp","label":"","count":16,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["d5df8ed14c6aa4b7f756d4a97207974f"],"http_akin":["b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["d5df8ed14c6aa4b7f756d4a97207974f"]}},"fingerprint_peers":{"t13d131100_f57a46bbacb6_ab7e3b40a677":172,"b11cun040_00040013_608dab68":4346},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":4,"ips":4346}},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-11","count":12,"sessions":0},{"date":"2026-10-12","count":60,"sessions":0},{"date":"2026-10-13","count":64,"sessions":0},{"date":"2026-10-14","count":72,"sessions":17},{"date":"2026-10-15","count":60,"sessions":23},{"date":"2026-10-16","count":80,"sessions":22},{"date":"2026-10-17","count":84,"sessions":35},{"date":"2026-10-18","count":64,"sessions":41},{"date":"2026-10-19","count":76,"sessions":54},{"date":"2026-10-20","count":64,"sessions":59},{"date":"2026-10-21","count":73,"sessions":46},{"date":"2026-10-22","count":52,"sessions":44},{"date":"2026-10-23","count":12,"sessions":6}],"recent_events":[{"timestamp":"2026-10-23T01:54:54","port":1088,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"aa19fb51-0a4d-44c6-9bae-997e5521b72f","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-23T01:54:54","port":1088,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"710facbe-415d-44dd-b0d4-23ffff6fb69b","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-23T01:54:54","port":1088,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"6e53ede2-b471-4203-8dbf-eaf25630e2ac","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-23T01:54:54","port":1088,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ffaa0d6d-e4d9-4511-b8c5-2fdb88596c6d","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-23T01:39:48","port":1085,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ffaec79c-9771-4fe4-bdfe-e08de19619e5","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-23T01:39:48","port":1085,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"91edf72a-5d97-4cfb-938c-64d4e9f727e4","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-23T01:39:48","port":1085,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"dd410d4b-c6fd-42ee-924b-bd16a35f23d4","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-23T01:39:48","port":1085,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"9a059c08-fd0a-436f-993e-cc0279e28e22","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-23T00:44:20","port":1088,"proto":"tcp","app_proto":"http-proxy","app_protocol":"http","host":"example.com","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"example.com\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"example.com","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206578616d706c652e636f6d0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"d5df8ed14c6aa4b7f756d4a97207974f","session":"b78fdefd-e547-411a-a8b2-af0f0752edc0-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:44:20","port":1088,"proto":"tcp","app_proto":"http-proxy","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"example.com","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"d5df8ed14c6aa4b7f756d4a97207974f","session":"b78fdefd-e547-411a-a8b2-af0f0752edc0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"868a671eda531879","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["example.com"]}},"interactive":true}],"http_methods":[{"method":"GET","count":581}],"distinct_ports_total":54,"top_paths":[{"path":"http://proxy.flarevpn.digital:8080/judge","count":387,"ports":54},{"path":"/judge","count":100,"ports":34},{"path":"/","count":94,"ports":32}],"distinct_paths_total":3,"top_snis":[{"value":"example.com","count":188}],"top_hosts":[{"value":"proxy.flarevpn.digital","count":487},{"value":"example.com","count":94}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"proxy.flarevpn.digital:8080","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[]}