{"ip":"173.163.186.155","total_events":18,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"418 bytes sent","bytes_sent":418,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-22T08:25:26","last_seen":"2026-09-06T18:49:12","events_24h":0,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Pennsylvania","city":"Lancaster","lat":40.0793,"lon":-76.313,"asn":7922,"org":"Comcast Cable Communications, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as7922","label":"Comcast","category":"isp","url":"https://www.peeringdb.com/asn/7922"},"cve_matches":[],"malware":[],"top_ports":[{"port":84,"proto":"tcp","label":"","count":3},{"port":720,"proto":"tcp","label":"","count":2},{"port":1701,"proto":"tcp","label":"","count":1},{"port":2022,"proto":"tcp","label":"","count":1},{"port":1234,"proto":"tcp","label":"","count":1},{"port":7000,"proto":"tcp","label":"","count":1},{"port":1000,"proto":"tcp","label":"","count":1},{"port":1096,"proto":"tcp","label":"","count":1},{"port":9050,"proto":"tcp","label":"","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":10081,"proto":"tcp","label":"","count":1},{"port":1010,"proto":"tcp","label":"","count":1},{"port":11,"proto":"tcp","label":"","count":1},{"port":201,"proto":"tcp","label":"","count":1},{"port":4321,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-22","count":5},{"date":"2026-07-23","count":2},{"date":"2026-07-27","count":1},{"date":"2026-08-22","count":6},{"date":"2026-09-06","count":4}],"recent_events":[{"timestamp":"2026-09-06T18:49:12","port":1010,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"05d86b9c-3562-4f4f-8983-777e0d86aebd","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-09-06T18:46:14","port":4321,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"6b340f53-5d7e-401a-8444-27c49fee532a","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-09-06T17:46:05","port":1723,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"ccd98df2-3c22-4c59-9a83-35a998399b63","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-09-06T17:24:48","port":1096,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"6d13c152-6553-4e37-a4d9-23acf37b7edf","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T19:04:05","port":720,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"b45f9c28-525e-4d02-a0e7-5d3b1ec09f76","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T19:04:05","port":720,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"b45f9c28-525e-4d02-a0e7-5d3b1ec09f76","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T18:58:02","port":84,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"f51cbb55-4e8a-44b4-8553-41b7b9903f6f","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T18:58:02","port":84,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"f51cbb55-4e8a-44b4-8553-41b7b9903f6f","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T18:58:02","port":84,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"f51cbb55-4e8a-44b4-8553-41b7b9903f6f","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-22T18:56:43","port":201,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"9b347c59-caa7-41c2-8da1-ae207b2ce1d6","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":15,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T08:57:53.656360+00:00"}