{"ip":"176.65.134.67","data_as_of":"2026-10-23T02:34:54+00:00","observed":true,"total_events":299,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"56+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 56 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 22 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"26,980 bytes sent","bytes_sent":26980,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T23:39:07","last_seen":"2026-10-19T16:16:21","events_24h":0,"events_7d":291,"interactive_sessions":22,"interactive_sessions_24h":0,"interactive_sessions_7d":22,"interactive_protocols":[{"protocol":"http-proxy","sessions":6},{"protocol":"socks5","sessions":4}],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"si-5saxuq.pfcloud.io","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":22,"first_seen":"2026-10-16T08:26:58","last_seen":"2026-10-17T00:01:40","verdicts":[{"verdict":"unknown","sessions":12},{"verdict":"scan","sessions":10}],"personas":[{"persona":"proxy@squid/5.7","sessions":10}],"services":[{"protocol":"tcp","port":8082,"sessions":5},{"protocol":"tcp","port":8083,"sessions":5},{"protocol":"http-proxy","port":3129,"sessions":3},{"protocol":"http-proxy","port":3130,"sessions":3},{"protocol":"socks5","port":3129,"sessions":2},{"protocol":"socks5","port":3130,"sessions":2},{"protocol":"tcp","port":3129,"sessions":1},{"protocol":"tcp","port":3130,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":10}]},"top_ports":[{"port":3130,"proto":"tcp","label":"","count":20,"sessions":6},{"port":3129,"proto":"tcp","label":"","count":20,"sessions":6},{"port":8083,"proto":"tcp","label":"","count":20,"sessions":5},{"port":8082,"proto":"tcp","label":"","count":16,"sessions":5},{"port":8084,"proto":"tcp","label":"","count":12,"sessions":0},{"port":8085,"proto":"tcp","label":"","count":12,"sessions":0},{"port":1099,"proto":"tcp","label":"","count":4,"sessions":0},{"port":8787,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1080,"proto":"tcp","label":"SOCKS","count":4,"sessions":0},{"port":1086,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1089,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1091,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1081,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1082,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1083,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["d5df8ed14c6aa4b7f756d4a97207974f"],"http_akin":["b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["d5df8ed14c6aa4b7f756d4a97207974f"]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4346,"t13d131100_f57a46bbacb6_ab7e3b40a677":172},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":4,"ips":4346}},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-15","count":4,"sessions":0},{"date":"2026-10-16","count":48,"sessions":17},{"date":"2026-10-17","count":24,"sessions":5},{"date":"2026-10-18","count":32,"sessions":0},{"date":"2026-10-19","count":191,"sessions":0}],"recent_events":[{"timestamp":"2026-10-19T16:16:21","port":1099,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3dfe776b-16c0-4108-8a86-a9aafb0e5349","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-19T16:16:21","port":1099,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"259dc4b7-49b3-442a-bbe6-485d2c866e63","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-19T16:16:21","port":1099,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"251b3f13-7809-4467-969c-15a99d0de4ef","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-19T16:16:20","port":1099,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a7175f0-1286-4843-a873-50d039ec0cfb","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-19T16:15:00","port":4145,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"f274dbf3-b399-44d4-87f3-ac3a7d4cd034","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-19T16:15:00","port":4145,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"cc662378-a12b-4686-89c2-2abda575e59e","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-19T16:14:59","port":4145,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"8cf07cad-3ac9-4a9a-ba9e-c9ee94d889bf","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-19T16:14:59","port":4145,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"0ba88321-bb85-40c8-9906-7abb87f24ea5","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-19T15:59:07","port":1088,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3207fb90-1ace-4756-8dac-6353da74de69","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-19T15:59:07","port":1088,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"877422c8-6995-4e69-a31a-3946c58199d3","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78}],"http_methods":[{"method":"GET","count":157}],"distinct_ports_total":56,"top_paths":[{"path":"http://proxy.flarevpn.digital:8080/judge","count":149,"ports":56},{"path":"/","count":4,"ports":2},{"path":"/judge","count":4,"ports":2}],"distinct_paths_total":3,"top_snis":[{"value":"example.com","count":8}],"top_hosts":[{"value":"proxy.flarevpn.digital","count":153},{"value":"example.com","count":4}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"proxy.flarevpn.digital:8080","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[]}