{"ip":"147.90.227.68","total_events":14,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["14 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,392 bytes sent","bytes_sent":1392,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T06:10:56","last_seen":"2026-09-29T11:35:55","events_24h":4,"events_7d":14,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":212238,"org":"Datacamp Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":5678,"proto":"tcp","label":"","count":2},{"port":22122,"proto":"tcp","label":"","count":2},{"port":4153,"proto":"tcp","label":"","count":2},{"port":9002,"proto":"tcp","label":"","count":2},{"port":1080,"proto":"tcp","label":"SOCKS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd"],"tls_client_hello":"1603010700010006fc03036600f21b05f87a8629710fb04074dd94b94fc5c2feed7abf5d1d9c6b02e83f5920331c40269942b06876a16092333e9b91faf1e738311cd3495b06a048f85d207500202a2a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010006932a2a000000170000ff01000100000d0012001004030804040105030805050108060601000b00020100fe0d011a000001000118002094fcbd61c0a1f8b211de81a8a70279574c0daf55ee7b5c8b5928b714f015911f00f0992e7e73bc0e8391729e1c14c0fa423b82e4771eb6a3c805a5db5a8975364ec8f1f24ce994f9c0e31ec1383a729e69205a8e2cf35af0c52dc662a469a488b76a823a4d639612a1fb8645e09aa126f3e92529dd8b3606382da6eac5b8e44067abb1a29764fe7eb8c598abc53f3081c0a827596e6f509d6f22d6ae0d8fbe16b56d6087f3e4a6dec949297043f16f8ce90906b495499ed4413f7ac37e0771a095ce821dcc3fe5d52102ddf72c60c1feb1d725b6cb0fa1318f3a441bba9f10d9d4f2b1612ce5c9dc21349928356057dc1b6036d783f8bf466a794f24993eeb576aaaa0a1f1beb5632f92ea49d344ffa99c73000a000c000a1a1a11ec001d001700180010000e000c02683208687474702f312e31002b000706caca030403030023000044cd00050003026832002d00020101003304ef04ed1a1a00010011ec04c07e5b0d38da28a3c357d988485a107cfbb0886b3bc165c7c8dc0842ccf88e2b4b6406aab7e66071ca1229c82bac90e3c8e6b2b61b754673a502bfc6341bc31189939cc3c76b9e1a9e3f437d84b18d8fd263d6dc951218742685998024b9710b29ccbc6ae63c034a772673233f68b1374b4736215398d315bbcf71c4b7fb3e4ca0c658b764d3ea7248f64e83164a7ddba9e3fa0c7f380020b8bceca891a7539e6d78b86025ad240b40a1cb6ae02668e6c1b5b1e8cf55fa9524c17bc7155b5b391787586d53134a1880af96501567b047ada7cd8be021f1b4b8b9d79e5067aafd6179cecc0f5ab49042a1c0ee1116a3c65aa5d86eb7c9977e416f6d8b66664c8d67496ee2f93bc4f8953efa060d658b412748b22c76e80ac825084ab7d6bc552506d3b5c43e3ba527c8661b747d7a277e8004a91861cb9e9317ab355fa0799367db0fefe02e1962ad01d21c6acc92c2e884727a3a88a25fb54192a8056f40e380803a2f6b84a7686853d556055e019afc0b882cb0268fd227e36c6211d4919da82255eb513503c8dce6547a2607741118a246b9c5f7094b680f03f1569bc06b9c2345ede557ea1847b7682dd9d6a0eaf126624520bd8482b6302c5114090511b12bb98ac4203ed1218ed17c5a0db60705497c3ab88437323adca97165e1439805305c9820282b8b879a09ca8cb52829329a927e01d08cca60ad24122368a67a5da46f1c48207a17afdd9b57f3f3295a789ea5fab93ff698e2d8a7067b731584391a908242b1cc0d07c6c8669b3e2b23e3a48c965c6439db6998cac35ce19a82707a2eab221939b92f693e2d70699169090099a5bcf20b54fca92fc866a19c1d50252e0fa277b7f9ad5198603ceb31064ab740e563d2ec41658bcf04f39efc40b1b41c3d76812e4067c547222ca4524eaa219880f79bd280a9e50b145273388301793673862f754904f3b9565597d9da315d15a28d235875534eba10928cf5b9e781bac7c60cd46545b2f8a667d74609789efbb92c2442a3ac031f21e78ed998332aca6faa3c2c10e1a7c26725486919bd5a96793188c2f8274d95ae998436ebd6c6ee2a4941f218744294d76189c3b28c666205f3b36727a36cda68882fe17b7c93bb069a765c427c2f996837acaae68a0709cc71e912021ea33a23678d36caacb382038cd3c9ef10a9e171269eb217f4e6a403d847fe9c0178b3befde04c08ab9de14189c6e263767731814c898c75c351791e4e6749ecb2678a5215f9e14c85746f47503e14e04d1c2042d2ebc59132830d1127e4561ced7711737534908784af576d31b834ffd106d96653c6e87c765281db8a28eec68f3a0bb9a4abb64b453d9466a131a066ac7a60b77893a8d20a73b51142f87bfd7a5e1a5a512ca81686cb2b41c74ec80bbbea3a574dbb9e9d9c233036153be98e03c33e3330099661112318cea2eb41932206c910354610297f4815f148af5153cfc93b6084751f449a43da815200f22eee98493c6634de1295abd64a365b8146a092ab6c5474fa1a72b33ff8c33b797527a6dcb8ce123083d8326d51c675b634756339d8523c4d5a60ed85404ee1aa0de7138733b40590010a71558f719d3caa8dc61072820c2c0d38c4e54f5a283d71eada8eb3347181afa896f7881deed79380235d7347d98134bcc5b7742fee7ed3f77b66ca0f9435e5bceb93dd0fda6296932124079719e1e1450f001d00202d16704f3f0e5807cbc41dafc414994f58c94afef3bfb052a4ecd32208574f13000500050100000000001b0003020002001200005a5a000100","tls_ja3":["8a8efefca4bc9ff012e09393a7303c31","a502a0b1513532acead23941803485f9","a58e3ef987379db292e8f188bb694bfd","4c6778b59e23e05c80c6ca5d1c6bc1d9"],"http_akin":[]},"fingerprint_peers":{"t13i1515h2_8daaf6152771_d8a2da3f94cd":27},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-24","count":4},{"date":"2026-09-27","count":4},{"date":"2026-09-28","count":2},{"date":"2026-09-29","count":4}],"recent_events":[{"timestamp":"2026-09-29T11:35:55","port":9002,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.uni-potsdam.de:443 HTTP/1.1\r\nHost: www.uni-potsdam.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d706f747364616d2e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d706f747364616d2e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"a58e3ef987379db292e8f188bb694bfd","session":"65fe4c01-c988-452d-99a5-1108a0ac749e","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":13,"enriched":{"digest":"990d1c0b53107c0b","label":"HTTP","strings":["CONNECT www.uni-potsdam.de:443 HTTP/1.1","Host: www.uni-potsdam.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-potsdam.de"]}}},{"timestamp":"2026-09-29T11:35:48","port":9002,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.uni-potsdam.de:443 HTTP/1.1\r\nHost: www.uni-potsdam.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e756e692d706f747364616d2e64653a34343320485454502f312e310d0a486f73743a207777772e756e692d706f747364616d2e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"8a8efefca4bc9ff012e09393a7303c31","session":"31e96827-b754-41cf-be41-a9a713ae8c27","seq":1,"duration_ms":103,"bytes_in":228,"bytes_out":13,"enriched":{"digest":"990d1c0b53107c0b","label":"HTTP","strings":["CONNECT www.uni-potsdam.de:443 HTTP/1.1","Host: www.uni-potsdam.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.uni-potsdam.de"]}}},{"timestamp":"2026-09-29T02:50:52","port":4153,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�[��;\u0000","payload_hex":"040101bb5befc93b00","method":"","user_agent":"","ja3":"","session":"30f7041e-e536-4e5e-bc4d-3541decab8dc","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-29T02:50:51","port":4153,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�[��;\u0000","payload_hex":"040101bb5befc93b00","method":"","user_agent":"","ja3":"","session":"bbe3ab4a-1739-4bc8-a003-e8e56997d7cb","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-28T06:17:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"4c6778b59e23e05c80c6ca5d1c6bc1d9","session":"2532fea4-891d-47e0-9acf-d4d840d4b32f","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":13,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}},{"timestamp":"2026-09-28T06:17:45","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT www.btha.cz:443 HTTP/1.1\r\nHost: www.btha.cz:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354207777772e627468612e637a3a34343320485454502f312e310d0a486f73743a207777772e627468612e637a3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"a502a0b1513532acead23941803485f9","session":"6bfcfe74-7bca-4d36-beb1-952eeb6c0dde","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":13,"enriched":{"digest":"8b64d205b58ad10c","label":"HTTP","strings":["CONNECT www.btha.cz:443 HTTP/1.1","Host: www.btha.cz:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["www.btha.cz"]}}},{"timestamp":"2026-09-27T23:53:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT koerber-stiftung.de:443 HTTP/1.1\r\nHost: koerber-stiftung.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206b6f65726265722d7374696674756e672e64653a34343320485454502f312e310d0a486f73743a206b6f65726265722d7374696674756e672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"75c71d28085a9c77002cdab9fb49c2ba","session":"9c71649b-c04f-4790-bd20-3fb4ce59a679","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"30641d5a6a06161c","label":"HTTP","strings":["CONNECT koerber-stiftung.de:443 HTTP/1.1","Host: koerber-stiftung.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["koerber-stiftung.de"]}}},{"timestamp":"2026-09-27T23:53:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"","summary":"CONNECT koerber-stiftung.de:443 HTTP/1.1\r\nHost: koerber-stiftung.de:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206b6f65726265722d7374696674756e672e64653a34343320485454502f312e310d0a486f73743a206b6f65726265722d7374696674756e672e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134352e302e302e30205361666172692f3533372e33360d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"abe26b9fb525ba62a2d0e1b262dc55d2","session":"6d850b49-0775-4106-89cc-f335ad87313e","seq":1,"duration_ms":101,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"30641d5a6a06161c","label":"HTTP","strings":["CONNECT koerber-stiftung.de:443 HTTP/1.1","Host: koerber-stiftung.de:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,…","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["koerber-stiftung.de"]}}},{"timestamp":"2026-09-27T03:35:40","port":22122,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"e0a05d96-b7d2-47cb-9a21-aeb50bc17e20","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-27T03:35:40","port":22122,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"c60075a9-1fbc-47db-b442-67685ca21cee","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T22:14:14.164231+00:00"}