{"ip":"176.65.148.150","total_events":50,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["50 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,018 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,018 bytes sent","bytes_sent":5018,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-23T23:44:41","last_seen":"2026-08-26T10:51:35","events_24h":0,"events_7d":13,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.150.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":15},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":11},{"port":8800,"proto":"tcp","label":"","count":10},{"port":9999,"proto":"tcp","label":"","count":6},{"port":3129,"proto":"tcp","label":"","count":5},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-23","count":2},{"date":"2026-07-24","count":7},{"date":"2026-07-25","count":6},{"date":"2026-07-26","count":2},{"date":"2026-08-05","count":4},{"date":"2026-08-06","count":2},{"date":"2026-08-11","count":2},{"date":"2026-08-12","count":6},{"date":"2026-08-13","count":3},{"date":"2026-08-14","count":3},{"date":"2026-08-24","count":4},{"date":"2026-08-25","count":3},{"date":"2026-08-26","count":6}],"recent_events":[{"timestamp":"2026-08-26T10:51:35","port":3128,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"c705d8df-5d1a-4e11-86e4-d8843d2ae0bf","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-26T10:04:28","port":3128,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"c85ca1c0-a0c0-4c93-be6c-e6ebb7a6adb4","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-26T09:50:51","port":8800,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"1599974a-8f35-492b-a93f-6c35144a2b75","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-26T09:41:37","port":8800,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"a00e5fc6-84df-4032-a2d7-12ecbb7de4ca","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-26T05:31:48","port":9999,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"ff28ff32-d41a-45e3-a198-1e64b53473c9","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-26T04:33:17","port":8800,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"eccdab50-e71c-4bdd-9c9e-abb05ed8cd03","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-25T19:22:24","port":3129,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"6aa231c6-c297-4fb6-b8a6-d6853c62987e","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-25T10:31:01","port":3129,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"14fecad4-8f42-4dc6-adfa-2f1a8640c81e","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-25T02:14:55","port":3128,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"03a04e70-c6a4-4ffc-9e97-8408952f27c6","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-08-24T21:28:29","port":9999,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"81f6969b-8353-4bc9-8ed4-fcf3e1fdfe45","seq":1,"duration_ms":101,"bytes_in":97,"bytes_out":14,"enriched":{"digest":"4ec859372a1f27d9","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-28T16:59:32.117482+00:00"}