{"ip":"176.65.148.93","total_events":115,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"35+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 35 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,158 bytes sent","bytes_sent":7158,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-16T12:28:07","last_seen":"2026-09-11T08:55:54","events_24h":12,"events_7d":74,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.93.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1234,"proto":"tcp","label":"","count":6},{"port":1085,"proto":"tcp","label":"","count":5},{"port":1082,"proto":"tcp","label":"","count":5},{"port":1080,"proto":"tcp","label":"SOCKS","count":5},{"port":1088,"proto":"tcp","label":"","count":4},{"port":9150,"proto":"tcp","label":"","count":4},{"port":1102,"proto":"tcp","label":"","count":4},{"port":1084,"proto":"tcp","label":"","count":4},{"port":1091,"proto":"tcp","label":"","count":4},{"port":1089,"proto":"tcp","label":"","count":4},{"port":1094,"proto":"tcp","label":"","count":4},{"port":1092,"proto":"tcp","label":"","count":4},{"port":1098,"proto":"tcp","label":"","count":4},{"port":9151,"proto":"tcp","label":"","count":4},{"port":1096,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge10nn0200_f24fcf356134","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"ge10nn0200_f24fcf356134":751,"ge11nn0100_4740ae6347b0":638},"user_agents":[],"timeline":[{"date":"2026-07-29","count":1},{"date":"2026-09-01","count":8},{"date":"2026-09-02","count":10},{"date":"2026-09-03","count":14},{"date":"2026-09-04","count":12},{"date":"2026-09-05","count":12},{"date":"2026-09-06","count":11},{"date":"2026-09-07","count":8},{"date":"2026-09-08","count":7},{"date":"2026-09-09","count":14},{"date":"2026-09-10","count":8},{"date":"2026-09-11","count":7}],"recent_events":[{"timestamp":"2026-09-11T08:55:54","port":8118,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ecea38ab-68e0-433f-8cb3-e7da053b4218","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-11T07:58:11","port":8118,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"cf6b3ec3-ee31-498d-8cea-ccf46b982ca9","seq":1,"duration_ms":101,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-09-11T07:58:11","port":8118,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"9422f68b-26e1-46c3-b1cb-1624f03c4e97","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-11T05:43:07","port":9151,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"99ab92b5-ecbd-4567-90b3-91205ff6adb6","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-09-11T04:26:05","port":9151,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"0e14931f-a6b4-4a08-a91c-7154e17da509","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-09-11T02:41:05","port":9151,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"cfea9300-b9f1-48fc-bdb9-ae9fcc7a225d","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-09-11T02:41:05","port":9151,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"890b0d7b-c7df-4e78-aef4-48f189b3abd6","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-10T23:27:14","port":9150,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"981e3d6e-0ea0-4691-b97d-5e5af3320e2e","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-10T23:27:14","port":9150,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"ece176c5-89b2-49e4-a210-073c61bd3a21","seq":1,"duration_ms":101,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}},{"timestamp":"2026-09-10T17:02:58","port":9150,"proto":"tcp","app_proto":"","app_protocol":"amazonaws","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT checkip.amazonaws.com:80 HTTP/1.1\r\nHost: checkip.amazonaws.com:80\r\nProxy-Connection: keep-alive\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e45435420636865636b69702e616d617a6f6e6177732e636f6d3a383020485454502f312e310d0a486f73743a20636865636b69702e616d617a6f6e6177732e636f6d3a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"580ba8c4-d176-4ad9-ae0d-a7b2427ef6c1","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"accf2ecff5dd7584","label":"HTTP","strings":["CONNECT checkip.amazonaws.com:80 HTTP/1.1","Host: checkip.amazonaws.com:80","Proxy-Connection: keep-alive","Connection: close"],"iocs":{"domains":["checkip.amazonaws.com"]}}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":35,"top_paths":[{"path":"/","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T10:28:51.394458+00:00"}