{"ip":"160.119.76.137","total_events":139,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,827 bytes sent","bytes_sent":3827,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-13T05:13:46","last_seen":"2026-09-30T09:25:34","events_24h":10,"events_7d":21,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":"160-119-76-137.ptr.as49870.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"top_ports":[{"port":1080,"proto":"tcp","label":"SOCKS","count":62},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":9},{"port":808,"proto":"tcp","label":"","count":8},{"port":9050,"proto":"tcp","label":"","count":8},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":8},{"port":1081,"proto":"tcp","label":"","count":8},{"port":9150,"proto":"tcp","label":"","count":8},{"port":52931,"proto":"tcp","label":"","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6},{"port":52951,"proto":"tcp","label":"","count":5},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":40000,"proto":"tcp","label":"","count":3},{"port":1,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun020_00040001_78f1f19c"]},"fingerprint_peers":{"b11cun020_00040001_78f1f19c":49},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-13","count":62},{"date":"2026-09-19","count":56},{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":9},{"date":"2026-09-29","count":7},{"date":"2026-09-30","count":3}],"recent_events":[{"timestamp":"2026-09-30T09:25:34","port":443,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"0f4a4766-899d-4f96-8351-4aa263d36f2e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-30T09:25:34","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��r`\u0000\u0000","payload_hex":"040101bbbc72600000","method":"","user_agent":"","ja3":"","session":"4bc10a29-5533-40d9-a1f6-e9342e352c82","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-09-30T09:25:04","port":443,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT whatismyip.technology:443 HTTP/1.1\r\nHost: whatismyip.technology:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e454354207768617469736d7969702e746563686e6f6c6f67793a34343320485454502f312e310d0a486f73743a207768617469736d7969702e746563686e6f6c6f67793a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"2ee5305c-fec7-4065-b6fd-612ba42a3341","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":14,"enriched":{"digest":"3200ea7736deac95","label":"HTTP","strings":["CONNECT whatismyip.technology:443 HTTP/1.1","Host: whatismyip.technology:443","Proxy-Connection: close"],"iocs":{"domains":["whatismyip.technology"]}}},{"timestamp":"2026-09-29T23:53:19","port":1,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT jsonbucket.com:443 HTTP/1.1\r\nHost: jsonbucket.com:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e454354206a736f6e6275636b65742e636f6d3a34343320485454502f312e310d0a486f73743a206a736f6e6275636b65742e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"70d8ef9f-a133-4e45-b304-5831299ccace","seq":1,"duration_ms":101,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"81970c35a82aa3fa","label":"HTTP","strings":["CONNECT jsonbucket.com:443 HTTP/1.1","Host: jsonbucket.com:443","Proxy-Connection: close"],"iocs":{"domains":["jsonbucket.com"]}}},{"timestamp":"2026-09-29T21:39:28","port":52951,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��C�\u001a\u0000","payload_hex":"040101bbac438a1a00","method":"","user_agent":"","ja3":"","session":"026e962f-189b-4627-afe1-9fdd14fd6f4d","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-09-29T21:35:47","port":52951,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"68f5f0b1-08e5-4ead-ae54-4780da8b21e9","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T21:31:18","port":52951,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ippubblico.org:443 HTTP/1.1\r\nHost: ippubblico.org:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e454354206970707562626c69636f2e6f72673a34343320485454502f312e310d0a486f73743a206970707562626c69636f2e6f72673a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"8f67e4ca-8c81-4c9b-a832-e8e9a9c84059","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":14,"enriched":{"digest":"496c0adaf623c2f0","label":"HTTP","strings":["CONNECT ippubblico.org:443 HTTP/1.1","Host: ippubblico.org:443","Proxy-Connection: close"],"iocs":{"domains":["ippubblico.org"]}}},{"timestamp":"2026-09-29T18:42:56","port":52931,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��r`\u0000\u0000","payload_hex":"040101bbbc72600000","method":"","user_agent":"","ja3":"","session":"8ffee93a-9136-48ca-a42b-7e8a7ec99d3b","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-09-29T18:42:55","port":52931,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"cdd88eea-5e43-42ba-b431-ccba5d03c9a7","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-29T18:42:25","port":52931,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ipfastcheck.com:443 HTTP/1.1\r\nHost: ipfastcheck.com:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e45435420697066617374636865636b2e636f6d3a34343320485454502f312e310d0a486f73743a20697066617374636865636b2e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"37046590-6232-4089-95f5-746f9c192e93","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":14,"enriched":{"digest":"9a8bf42d9866c40d","label":"HTTP","strings":["CONNECT ipfastcheck.com:443 HTTP/1.1","Host: ipfastcheck.com:443","Proxy-Connection: close"],"iocs":{"domains":["ipfastcheck.com"]}}}],"http_methods":[{"method":"GET","count":16}],"distinct_ports_total":14,"top_paths":[{"path":"http://example.com/","count":16,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"example.com","count":16}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T16:13:24.883212+00:00"}