{"ip":"185.130.82.133","observed":true,"total_events":13402,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"13,402 events across 3 port(s)","confidence":"high","network_type":null,"why":["13,402 requests against only 3 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"790,610 bytes sent","bytes_sent":790610,"session_seconds":29,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-12T16:26:50","last_seen":"2026-10-15T03:37:27","events_24h":7751,"events_7d":13402,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":56981,"org":"JSC ER-Telecom Holding"},"source_domain":"185x130x82x133.static-customer.tomsk.ertelecom.ru","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1080,"proto":"tcp","label":"SOCKS","count":4871},{"port":1081,"proto":"tcp","label":"","count":4821},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":3710}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun010_00040000_c4b2c4aa"]},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":813},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-12","count":708},{"date":"2026-10-13","count":3234},{"date":"2026-10-14","count":7706},{"date":"2026-10-15","count":1754}],"recent_events":[{"timestamp":"2026-10-15T03:37:27","port":1081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: k.lkeportal.com:443\r\n\r\n","payload_hex":"486f73743a206b2e6c6b65706f7274616c2e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"8f574b6b-96d9-477a-a5c2-c6a92e7279cd","seq":2,"duration_ms":274,"bytes_in":67,"bytes_out":28,"enriched":{"digest":"e2676eb19ac3fbba","strings":["Host: k.lkeportal.com:443"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:37:27","port":1081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT k.lkeportal.com:443 HTTP/1.1\r\n","payload_hex":"434f4e4e454354206b2e6c6b65706f7274616c2e636f6d3a34343320485454502f312e310d0a","method":"","user_agent":"","ja3":"","session":"8f574b6b-96d9-477a-a5c2-c6a92e7279cd","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":14,"enriched":{"digest":"457dc58877f48ce1","label":"HTTP","strings":["CONNECT k.lkeportal.com:443 HTTP/1.1"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:37:23","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: ofx.netteller.com:443\r\n\r\n","payload_hex":"486f73743a206f66782e6e657474656c6c65722e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"75adae8e-4068-4e31-a67a-4aff86fe803f","seq":2,"duration_ms":277,"bytes_in":71,"bytes_out":28,"enriched":{"digest":"d3cd7d4f55013d95","strings":["Host: ofx.netteller.com:443"],"iocs":{"domains":["ofx.netteller.com"]}}},{"timestamp":"2026-10-15T03:37:22","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT ofx.netteller.com:443 HTTP/1.1\r\n","payload_hex":"434f4e4e454354206f66782e6e657474656c6c65722e636f6d3a34343320485454502f312e310d0a","method":"","user_agent":"","ja3":"","session":"75adae8e-4068-4e31-a67a-4aff86fe803f","seq":1,"duration_ms":100,"bytes_in":40,"bytes_out":14,"enriched":{"digest":"4092e074c6bc25bf","label":"HTTP","strings":["CONNECT ofx.netteller.com:443 HTTP/1.1"],"iocs":{"domains":["ofx.netteller.com"]}}},{"timestamp":"2026-10-15T03:37:13","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: k.lkeportal.com:443\r\n\r\n","payload_hex":"486f73743a206b2e6c6b65706f7274616c2e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"b6efb58e-838e-46cf-ac72-b139469f660a","seq":2,"duration_ms":278,"bytes_in":67,"bytes_out":28,"enriched":{"digest":"e2676eb19ac3fbba","strings":["Host: k.lkeportal.com:443"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:37:12","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT k.lkeportal.com:443 HTTP/1.1\r\n","payload_hex":"434f4e4e454354206b2e6c6b65706f7274616c2e636f6d3a34343320485454502f312e310d0a","method":"","user_agent":"","ja3":"","session":"b6efb58e-838e-46cf-ac72-b139469f660a","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":14,"enriched":{"digest":"457dc58877f48ce1","label":"HTTP","strings":["CONNECT k.lkeportal.com:443 HTTP/1.1"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:37:09","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"ofx.netteller.com","headers":"{\"host\":\"ofx.netteller.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"ofx.netteller.com:443","summary":"CONNECT ofx.netteller.com:443 HTTP/1.1\r\nHost: ofx.netteller.com:443\r\n\r\n","payload_hex":"434f4e4e454354206f66782e6e657474656c6c65722e636f6d3a34343320485454502f312e310d0a486f73743a206f66782e6e657474656c6c65722e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"8996e73b-cbf9-41bf-88bb-f10eccf178f9","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":14},{"timestamp":"2026-10-15T03:37:02","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: k.lkeportal.com:443\r\n\r\n","payload_hex":"486f73743a206b2e6c6b65706f7274616c2e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"e8442a3b-4298-4e10-9e90-2a83e54dcca7","seq":2,"duration_ms":284,"bytes_in":67,"bytes_out":28,"enriched":{"digest":"e2676eb19ac3fbba","strings":["Host: k.lkeportal.com:443"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:37:02","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT k.lkeportal.com:443 HTTP/1.1\r\n","payload_hex":"434f4e4e454354206b2e6c6b65706f7274616c2e636f6d3a34343320485454502f312e310d0a","method":"","user_agent":"","ja3":"","session":"e8442a3b-4298-4e10-9e90-2a83e54dcca7","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":14,"enriched":{"digest":"457dc58877f48ce1","label":"HTTP","strings":["CONNECT k.lkeportal.com:443 HTTP/1.1"],"iocs":{"domains":["k.lkeportal.com"]}}},{"timestamp":"2026-10-15T03:36:55","port":1081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Host: ofx.netteller.com:443\r\n\r\n","payload_hex":"486f73743a206f66782e6e657474656c6c65722e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"a7896e01-e58b-43c7-b1e7-dd16aa7fb89a","seq":2,"duration_ms":273,"bytes_in":71,"bytes_out":28,"enriched":{"digest":"d3cd7d4f55013d95","strings":["Host: ofx.netteller.com:443"],"iocs":{"domains":["ofx.netteller.com"]}}}],"http_methods":[{"method":"CONNECT","count":848}],"distinct_ports_total":3,"top_paths":[{"path":"k.lkeportal.com:443","count":474,"ports":3},{"path":"ofx.netteller.com:443","count":374,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"k.lkeportal.com","count":474},{"value":"ofx.netteller.com","count":374}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"ofx.netteller.com:443","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-15T04:50:39.998746+00:00"}