{"ip":"146.19.248.106","total_events":207,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"17+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 17 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,570 bytes sent","bytes_sent":15570,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T15:11:50","last_seen":"2026-09-29T14:33:56","events_24h":16,"events_7d":207,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":62068,"org":"SpectraIP B.V."},"source_domain":"146-19-248-106.static.spectraip.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as62068","label":"SpectraIP B.V.","category":"isp","url":"https://www.peeringdb.com/asn/62068"},"cve_matches":[],"malware":[],"top_ports":[{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":27},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":24},{"port":80,"proto":"tcp","label":"HTTP","count":20},{"port":1081,"proto":"tcp","label":"","count":20},{"port":7890,"proto":"tcp","label":"","count":16},{"port":9050,"proto":"tcp","label":"","count":16},{"port":10808,"proto":"tcp","label":"","count":16},{"port":999,"proto":"tcp","label":"","count":12},{"port":1080,"proto":"tcp","label":"SOCKS","count":10},{"port":8118,"proto":"tcp","label":"","count":8},{"port":4145,"proto":"tcp","label":"","count":8},{"port":3129,"proto":"tcp","label":"","count":8},{"port":9150,"proto":"tcp","label":"","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":20171,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":14},{"date":"2026-09-24","count":30},{"date":"2026-09-25","count":28},{"date":"2026-09-26","count":39},{"date":"2026-09-27","count":56},{"date":"2026-09-28","count":28},{"date":"2026-09-29","count":12}],"recent_events":[{"timestamp":"2026-09-29T14:33:56","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"827cfdf2-bb71-442e-abbb-b6a6ddd32a95","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T14:33:52","port":8888,"proto":"tcp","app_proto":"","app_protocol":"doh_dot","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT dns.google:443 HTTP/1.1\r\nHost: dns.google:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420646e732e676f6f676c653a34343320485454502f312e310d0a486f73743a20646e732e676f6f676c653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"70994adc-8da8-4821-a1dd-8111a692f3df","seq":1,"duration_ms":100,"bytes_in":142,"bytes_out":14,"enriched":{"digest":"903688b14e0ae5c6","label":"HTTP","strings":["CONNECT dns.google:443 HTTP/1.1","Host: dns.google:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["dns.google"]}}},{"timestamp":"2026-09-29T14:29:40","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"48c37997-3304-46e6-b9cb-4e53057ef4a9","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T14:29:36","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"75fcebe8-12e8-4163-930a-09b37c85e4ee","seq":1,"duration_ms":101,"bytes_in":150,"bytes_out":14,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-29T06:44:37","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"aa5c00a3-7c3f-42f1-ad51-64af1d0f8183","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T06:44:32","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"037bbcd0-9ff1-4760-bc43-69c690cc388a","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":14,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-29T06:41:45","port":8888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ee272d3b-8bb9-4cba-914d-d595921789ad","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T06:41:41","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"3913ef83-0bca-4809-8ebc-0aa0ef2a7e3a","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":14,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-29T04:19:36","port":3128,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"108477f2-341b-40bc-8b9a-f5a4508e2d45","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T04:19:32","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"df037d8d-f570-40a3-a76d-8e0b180f0ab7","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":14,"enriched":{"digest":"29189dd78d0304b9","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}}],"http_methods":[],"distinct_ports_total":17,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T19:35:47.553090+00:00"}