{"ip":"147.90.209.7","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,500 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,500 bytes sent","bytes_sent":4500,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-31T05:16:12","last_seen":"2026-09-08T00:45:24","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":212238,"org":"Datacamp Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":999,"proto":"tcp","label":"","count":4},{"port":9002,"proto":"tcp","label":"","count":4},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"","tls_ja3":["fb20d9357a1f3cd498c690da2784c365","3549aa6d1ff753689137c211707df7d5","cf1d1b82e83fc9a2f48ee0ae59a8d063","1804bc8dba689111570905faed1151d4"],"http_akin":[]},"fingerprint_peers":{"t13i1515h2_8daaf6152771_d8a2da3f94cd":27},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-31","count":6},{"date":"2026-09-02","count":2},{"date":"2026-09-03","count":2},{"date":"2026-09-04","count":2},{"date":"2026-09-05","count":4},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":2}],"recent_events":[{"timestamp":"2026-09-08T00:45:24","port":999,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"84aed5a5-8f2e-4a2d-80e3-76dd3dad53f9","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":12,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}},{"timestamp":"2026-09-08T00:45:16","port":999,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"74284824-7e85-4a44-8109-1a26350f6ba0","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":12,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}},{"timestamp":"2026-09-07T18:40:48","port":999,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.uni-potsdam.de:443 HTTP/1.1\r\nHost: www.uni-potsdam.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d706f747364616d2e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d706f747364616d2e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"24429d94-9d99-4bb7-9b9e-e6fac2801f21","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":12,"enriched":{"digest":"990d1c0b53107c0b","label":"HTTP","strings":["CONNECT www.uni-potsdam.de:443 HTTP/1.1","Host: www.uni-potsdam.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-potsdam.de"]}}},{"timestamp":"2026-09-07T18:40:41","port":999,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.uni-potsdam.de:443 HTTP/1.1\r\nHost: www.uni-potsdam.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d706f747364616d2e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d706f747364616d2e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"80af0d07-65bd-47c3-9794-be453c45a3ea","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":12,"enriched":{"digest":"990d1c0b53107c0b","label":"HTTP","strings":["CONNECT www.uni-potsdam.de:443 HTTP/1.1","Host: www.uni-potsdam.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-potsdam.de"]}}},{"timestamp":"2026-09-05T06:01:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ivi.fnwi.uva.nl:443 HTTP/1.1\r\nHost: ivi.fnwi.uva.nl:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206976692e666e77692e7576612e6e6c3a34343320485454502f312e310d0a486f73743a206976692e666e77692e7576612e6e6c3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"58e64d8b-81e6-42a1-be32-e5d9e9e8d534","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":12,"enriched":{"digest":"33a652f36fb36c47","label":"HTTP","strings":["CONNECT ivi.fnwi.uva.nl:443 HTTP/1.1","Host: ivi.fnwi.uva.nl:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["ivi.fnwi.uva.nl"]}}},{"timestamp":"2026-09-05T06:01:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ivi.fnwi.uva.nl:443 HTTP/1.1\r\nHost: ivi.fnwi.uva.nl:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206976692e666e77692e7576612e6e6c3a34343320485454502f312e310d0a486f73743a206976692e666e77692e7576612e6e6c3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"2b74f5a7-302d-4dd6-a9d8-82308194154a","seq":1,"duration_ms":101,"bytes_in":222,"bytes_out":12,"enriched":{"digest":"33a652f36fb36c47","label":"HTTP","strings":["CONNECT ivi.fnwi.uva.nl:443 HTTP/1.1","Host: ivi.fnwi.uva.nl:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["ivi.fnwi.uva.nl"]}}},{"timestamp":"2026-09-05T04:28:40","port":9002,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.uni-leipzig.de:443 HTTP/1.1\r\nHost: www.uni-leipzig.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d6c6569707a69672e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d6c6569707a69672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"e35add5182800f24bbaedb7eac8a76d3","session":"1ac65e14-2eb5-49c7-8094-f407fc033dfd","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":12,"enriched":{"digest":"491e1a76ff658bdd","label":"HTTP","strings":["CONNECT www.uni-leipzig.de:443 HTTP/1.1","Host: www.uni-leipzig.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-leipzig.de"]}}},{"timestamp":"2026-09-05T04:28:33","port":9002,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.uni-leipzig.de:443 HTTP/1.1\r\nHost: www.uni-leipzig.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d6c6569707a69672e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d6c6569707a69672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"b515793fd8c8b6461b0750580467425c","session":"75a4f25d-662f-40e4-87c4-a05378c7c9cd","seq":1,"duration_ms":101,"bytes_in":228,"bytes_out":12,"enriched":{"digest":"491e1a76ff658bdd","label":"HTTP","strings":["CONNECT www.uni-leipzig.de:443 HTTP/1.1","Host: www.uni-leipzig.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-leipzig.de"]}}},{"timestamp":"2026-09-04T18:55:43","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"3a4f0ccd-e4d5-4545-aa60-98473c2a7559","seq":1,"duration_ms":103,"bytes_in":214,"bytes_out":12,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}},{"timestamp":"2026-09-04T18:55:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d1213c1c-166c-49b9-8912-79b633c13a41","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":12,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}}],"http_methods":[],"distinct_ports_total":5,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":8}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T14:27:43.723368+00:00"}