{"ip":"149.56.31.99","data_as_of":"2026-10-25T13:06:55+00:00","observed":true,"total_events":648,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"648 events across 1 port(s)","confidence":"medium","network_type":"CDN","why":["648 requests against 1 service(s), so the activity is deep on few services.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload was observed, so this describes volume and focus only.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"25,992 bytes sent","bytes_sent":25992,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-05T11:57:16","last_seen":"2026-10-25T11:19:19","events_24h":28,"events_7d":216,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CA","country_name":"Canada","region":"Quebec","city":"Montreal","lat":45.5075,"lon":-73.5887,"asn":16276,"org":"OVH SAS"},"source_domain":"ns533642.ip-149-56-31.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as16276","label":"OVHcloud","category":"cdn","url":"https://www.peeringdb.com/asn/16276"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":20081,"proto":"tcp","label":"","count":648}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e00303f713b6c03241e2f5d018aa56ee9dd6dbdc5d5da20f18fe1e592f66111a48fc34201b73a40ace1f40cddf9feb775b71ff07ea40324623e07334b4f145ef14b3d57d001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d00200d349eb996d414e6333a7f09a4a07d6fd301d9d383081f82db8c1a67","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun010_00040000_c4b2c4aa"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":892,"b11cun010_00040000_c4b2c4aa":935},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-05","count":8},{"date":"2026-10-06","count":12},{"date":"2026-10-07","count":16},{"date":"2026-10-08","count":12},{"date":"2026-10-09","count":12},{"date":"2026-10-10","count":36},{"date":"2026-10-11","count":52},{"date":"2026-10-12","count":48},{"date":"2026-10-13","count":48},{"date":"2026-10-14","count":44},{"date":"2026-10-15","count":40},{"date":"2026-10-16","count":40},{"date":"2026-10-17","count":40},{"date":"2026-10-18","count":40},{"date":"2026-10-19","count":36},{"date":"2026-10-20","count":32},{"date":"2026-10-21","count":24},{"date":"2026-10-22","count":32},{"date":"2026-10-23","count":32},{"date":"2026-10-24","count":28},{"date":"2026-10-25","count":16}],"recent_events":[{"timestamp":"2026-10-25T11:19:19","port":20081,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"check2.zennolab.com","headers":"{\"host\":\"check2.zennolab.com:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"check2.zennolab.com:443","summary":"CONNECT check2.zennolab.com:443 HTTP/1.1\r\nHost: check2.zennolab.com:443\r\n\r\n","payload_hex":"434f4e4e45435420636865636b322e7a656e6e6f6c61622e636f6d3a34343320485454502f312e310d0a486f73743a20636865636b322e7a656e6e6f6c61622e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"98269e32-4f85-49a0-9e2b-c9d926f0feb7","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":12},{"timestamp":"2026-10-25T11:19:19","port":20081,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"check2.zennolab.com","headers":"{\"host\":\"check2.zennolab.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"check2.zennolab.com:443","summary":"CONNECT check2.zennolab.com:443 HTTP/1.1\r\nHost: check2.zennolab.com:443\r\n\r\n","payload_hex":"434f4e4e45435420636865636b322e7a656e6e6f6c61622e636f6d3a34343320485454502f312e310d0a486f73743a20636865636b322e7a656e6e6f6c61622e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"667ae2b2-d947-4303-84bc-3d79ed50fdca","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":12},{"timestamp":"2026-10-25T11:19:19","port":20081,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0005-^�\u0000","payload_hex":"040101bb052d5ef700","method":"","user_agent":"","ja3":"","session":"72acb68f-6a20-4217-bb02-bcb095fc6bf5","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-10-25T11:19:19","port":20081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a11dfa05-2a50-4559-a90e-d4c09e18b451","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-25T07:56:28","port":20081,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"ip0.zenno.services","headers":"{\"host\":\"ip0.zenno.services:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"ip0.zenno.services:443","summary":"CONNECT ip0.zenno.services:443 HTTP/1.1\r\nHost: ip0.zenno.services:443\r\n\r\n","payload_hex":"434f4e4e454354206970302e7a656e6e6f2e73657276696365733a34343320485454502f312e310d0a486f73743a206970302e7a656e6e6f2e73657276696365733a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"4b2ab1a0-8449-4ee0-88cf-bd9e8ad6fb33","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":12},{"timestamp":"2026-10-25T07:56:28","port":20081,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"ip0.zenno.services","headers":"{\"host\":\"ip0.zenno.services:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"ip0.zenno.services:443","summary":"CONNECT ip0.zenno.services:443 HTTP/1.1\r\nHost: ip0.zenno.services:443\r\n\r\n","payload_hex":"434f4e4e454354206970302e7a656e6e6f2e73657276696365733a34343320485454502f312e310d0a486f73743a206970302e7a656e6e6f2e73657276696365733a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"19061725-6744-4afa-a215-fafec7b2a1c1","seq":1,"duration_ms":101,"bytes_in":73,"bytes_out":12},{"timestamp":"2026-10-25T07:56:28","port":20081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��W�\u0016\u0000","payload_hex":"040101bbb957961600","method":"","user_agent":"","ja3":"","session":"77154b2b-0beb-4e3f-8bd2-7ebffcee8203","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":12},{"timestamp":"2026-10-25T07:56:28","port":20081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"0d5829bb-4d4f-4e3c-b461-a9a4885afe35","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-25T04:25:47","port":20081,"proto":"tcp","app_proto":"tls","app_protocol":"http_connect","host":"ip0.zenno.services","headers":"{\"host\":\"ip0.zenno.services:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"ip0.zenno.services:443","summary":"CONNECT ip0.zenno.services:443 HTTP/1.1\r\nHost: ip0.zenno.services:443\r\n\r\n","payload_hex":"434f4e4e454354206970302e7a656e6e6f2e73657276696365733a34343320485454502f312e310d0a486f73743a206970302e7a656e6e6f2e73657276696365733a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"7ed32123-39a9-4f6a-b071-daad160c167d","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":12},{"timestamp":"2026-10-25T04:25:47","port":20081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��W�\u0016\u0000","payload_hex":"040101bbb957961600","method":"","user_agent":"","ja3":"","session":"a3c85003-5edd-483a-b732-7e48e6015937","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":12}],"http_methods":[{"method":"CONNECT","count":188}],"distinct_ports_total":1,"top_paths":[{"path":"check2.zennolab.com:443","count":42,"ports":1},{"path":"chekfast.zennolab.com:443","count":40,"ports":1},{"path":"ip0.zenno.services:443","count":38,"ports":1},{"path":"chek.zennolab.com:443","count":38,"ports":1},{"path":"ip1.zenno.services:443","count":30,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"check2.zennolab.com","count":42},{"value":"chekfast.zennolab.com","count":40},{"value":"ip0.zenno.services","count":38},{"value":"chek.zennolab.com","count":38},{"value":"ip1.zenno.services","count":30}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"check2.zennolab.com:443","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[]}