{"ip":"147.90.209.26","total_events":24,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["24 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,162 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,162 bytes sent","bytes_sent":4162,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-22T12:06:32","last_seen":"2026-08-10T18:41:34","events_24h":0,"events_7d":2,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":212238,"org":"Datacamp Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":8},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":6},{"port":5678,"proto":"tcp","label":"","count":4},{"port":9002,"proto":"tcp","label":"","count":4},{"port":4153,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd"],"tls_ja3":["a0048febaaae0d872a61a4659d4b0be4","55bd60660a2e7fb5681bb9ea794f7cdf","8e4bfc4c82eac8474734b8a9877ba8a4","6c9c1b12963d83a25b93ba62164a343f"],"ja4h":[]},"fingerprint_peers":{"t13i1515h2_8daaf6152771_d8a2da3f94cd":146},"user_agents":[],"timeline":[{"date":"2026-07-22","count":4},{"date":"2026-07-23","count":2},{"date":"2026-07-24","count":2},{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":2},{"date":"2026-08-05","count":2},{"date":"2026-08-07","count":6},{"date":"2026-08-08","count":2},{"date":"2026-08-10","count":2}],"recent_events":[{"timestamp":"2026-08-10T18:41:34","port":4153,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��(�i\u0000","payload_hex":"040101bbbc28da6900","method":"","user_agent":"","ja3":"","session":"4bb2354e-4b13-42da-9b29-998b6b017986","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-10T18:41:34","port":4153,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��(�i\u0000","payload_hex":"040101bbbc28da6900","method":"","user_agent":"","ja3":"","session":"b7721d73-d28f-443b-89f7-531e9ae1921d","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-08T00:57:30","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT koerber-stiftung.de:443 HTTP/1.1\r\nHost: koerber-stiftung.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206b6f65726265722d7374696674756e672e64653a34343320485454502f312e310d0a486f73743a206b6f65726265722d7374696674756e672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"0240303b-18f7-4f46-8f6c-27baaf1d196a","seq":1,"duration_ms":101,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"30641d5a6a06161c","label":"HTTP","strings":["CONNECT koerber-stiftung.de:443 HTTP/1.1","Host: koerber-stiftung.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["koerber-stiftung.de"]}}},{"timestamp":"2026-08-08T00:57:23","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT koerber-stiftung.de:443 HTTP/1.1\r\nHost: koerber-stiftung.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206b6f65726265722d7374696674756e672e64653a34343320485454502f312e310d0a486f73743a206b6f65726265722d7374696674756e672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"f186d35c-b5a0-441b-9cba-6b67b1e19a7e","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"30641d5a6a06161c","label":"HTTP","strings":["CONNECT koerber-stiftung.de:443 HTTP/1.1","Host: koerber-stiftung.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["koerber-stiftung.de"]}}},{"timestamp":"2026-08-07T14:50:53","port":5678,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��\u0012\u0010�\u0000","payload_hex":"040101bb8b12108500","method":"","user_agent":"","ja3":"","session":"0eb632fd-e83c-434d-8960-489b4ebdc770","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-07T14:50:52","port":5678,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��\u0012\u0010�\u0000","payload_hex":"040101bb8b12108500","method":"","user_agent":"","ja3":"","session":"fb73614f-3a82-4001-811d-eea923bdc411","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-07T11:57:10","port":5678,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��2a�\u0000","payload_hex":"040101bb923261d300","method":"","user_agent":"","ja3":"","session":"73349b24-6731-434f-b729-e76e04f5bae5","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-07T11:57:10","port":5678,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��2a�\u0000","payload_hex":"040101bb923261d300","method":"","user_agent":"","ja3":"","session":"48884f4c-ae09-4834-a917-c5f893915f42","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-07T03:45:56","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.uni-leipzig.de:443 HTTP/1.1\r\nHost: www.uni-leipzig.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d6c6569707a69672e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d6c6569707a69672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"50203b65-ad11-4741-81cd-ad27407f1e2a","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":13,"enriched":{"digest":"491e1a76ff658bdd","label":"HTTP","strings":["CONNECT www.uni-leipzig.de:443 HTTP/1.1","Host: www.uni-leipzig.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-leipzig.de"]}}},{"timestamp":"2026-08-07T03:45:49","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.uni-leipzig.de:443 HTTP/1.1\r\nHost: www.uni-leipzig.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d6c6569707a69672e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d6c6569707a69672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"ba9f55d4-f2a3-47a6-b6f7-7da5daca8130","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":13,"enriched":{"digest":"491e1a76ff658bdd","label":"HTTP","strings":["CONNECT www.uni-leipzig.de:443 HTTP/1.1","Host: www.uni-leipzig.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-leipzig.de"]}}}],"http_methods":[],"distinct_ports_total":5,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T11:40:17.363055+00:00"}