{"ip":"157.245.163.64","total_events":29339,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23943+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 23943 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"88,595 bytes sent","bytes_sent":88595,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-29T20:37:20","last_seen":"2026-09-28T00:01:28","events_24h":29334,"events_7d":29334,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":48061,"proto":"tcp","label":"","count":5},{"port":127,"proto":"tcp","label":"","count":4},{"port":38379,"proto":"tcp","label":"","count":4},{"port":4208,"proto":"tcp","label":"","count":4},{"port":3412,"proto":"tcp","label":"","count":4},{"port":58909,"proto":"tcp","label":"","count":4},{"port":36604,"proto":"tcp","label":"","count":4},{"port":33331,"proto":"tcp","label":"","count":4},{"port":20783,"proto":"tcp","label":"","count":4},{"port":41869,"proto":"tcp","label":"","count":4},{"port":34631,"proto":"tcp","label":"","count":4},{"port":13993,"proto":"tcp","label":"","count":4},{"port":13200,"proto":"tcp","label":"","count":4},{"port":5551,"proto":"tcp","label":"","count":4},{"port":50024,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-29","count":5},{"date":"2026-09-27","count":28965},{"date":"2026-09-28","count":369}],"recent_events":[{"timestamp":"2026-09-28T00:01:28","port":45071,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"189d506e-2236-43cf-b187-c308a48bc511","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":2505,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"c4a548ad-bb64-40d8-aeab-66f4edc2a3a3","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":950,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"f9f54498-6f21-4e38-b5fc-6f59188a270a","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":18106,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a6f0c7eb-5834-4aab-88cc-d1db16a6626c","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":22165,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ae15bf73-9d24-41a7-ae75-4ceb06c7789e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":30880,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"66166930-e46c-4322-a4d7-80f5115820ba","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:28","port":31415,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"93c3f312-c792-44bc-a6aa-6fc212aee039","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:24","port":3244,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"e69e5055-e506-41ba-8e20-4cfa2a747fe7","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:24","port":23249,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"767cc1e4-a454-4c73-8e67-1fe7e12d19f9","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-28T00:01:24","port":41996,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a0b2c87b-9697-4302-ba19-b59bb92f084c","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":23943,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T21:35:17.875440+00:00"}