{"ip":"185.224.128.14","total_events":156,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,407 bytes sent","bytes_sent":4407,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-18T08:04:33","last_seen":"2026-08-20T19:44:29","events_24h":80,"events_7d":156,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":49870,"org":"Alsycon B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"top_ports":[{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":16},{"port":1443,"proto":"tcp","label":"","count":12},{"port":2080,"proto":"tcp","label":"","count":12},{"port":1080,"proto":"tcp","label":"SOCKS","count":12},{"port":1452,"proto":"tcp","label":"","count":8},{"port":83,"proto":"tcp","label":"","count":8},{"port":1256,"proto":"tcp","label":"","count":8},{"port":2026,"proto":"tcp","label":"","count":8},{"port":1,"proto":"tcp","label":"","count":8},{"port":3127,"proto":"tcp","label":"","count":8},{"port":3125,"proto":"tcp","label":"","count":8},{"port":82,"proto":"tcp","label":"","count":4},{"port":4145,"proto":"tcp","label":"","count":4},{"port":100,"proto":"tcp","label":"","count":4},{"port":84,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":24},{"date":"2026-08-19","count":52},{"date":"2026-08-20","count":80}],"recent_events":[{"timestamp":"2026-08-20T19:44:29","port":3129,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u0014\u0017�\u0000","payload_hex":"040101bb6814179a00","method":"","user_agent":"","ja3":"","session":"da680c43-d2a7-43ca-896d-7ecf9ecaa702","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-08-20T19:44:28","port":3129,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��B��\u0000","payload_hex":"040101bbac4293f300","method":"","user_agent":"","ja3":"","session":"73b7ab4a-e7a5-4938-945d-d49c0be6b65c","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-08-20T19:44:28","port":3129,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3c14b5e8-3d77-4276-b11c-5cd87708cd9d","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-20T19:43:58","port":3129,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.example.com:443 HTTP/1.1\r\nHost: www.example.com:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e454354207777772e6578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e6578616d706c652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"c6f60907-ec5d-4122-8cd0-263dfa8a11be","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":14,"enriched":{"digest":"a942e7216af7d1a2","label":"HTTP","strings":["CONNECT www.example.com:443 HTTP/1.1","Host: www.example.com:443","Proxy-Connection: close"],"iocs":{"domains":["www.example.com"]}}},{"timestamp":"2026-08-20T18:38:55","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��B��\u0000","payload_hex":"040101bbac4293f300","method":"","user_agent":"","ja3":"","session":"33584bbe-8b9b-4a40-b243-7257e90ac36a","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-08-20T18:38:55","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��B��\u0000","payload_hex":"040101bbac4293f300","method":"","user_agent":"","ja3":"","session":"df4bcfea-f913-4e07-93f7-a949f7e556f5","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-08-20T18:38:55","port":3128,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"2ba0ea8e-f36c-4b09-99a3-9faae5afe30b","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-20T18:38:25","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.example.com:443 HTTP/1.1\r\nHost: www.example.com:443\r\nProxy-Connection: close\r\n\r\n","payload_hex":"434f4e4e454354207777772e6578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e6578616d706c652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"477c4ed1-8c3a-4cdd-a874-ddfc10172b01","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":14,"enriched":{"digest":"a942e7216af7d1a2","label":"HTTP","strings":["CONNECT www.example.com:443 HTTP/1.1","Host: www.example.com:443","Proxy-Connection: close"],"iocs":{"domains":["www.example.com"]}}},{"timestamp":"2026-08-20T17:12:30","port":3127,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u0014\u0017�\u0000","payload_hex":"040101bb6814179a00","method":"","user_agent":"","ja3":"","session":"d56351ec-5950-4afa-aee0-3791f8201ce3","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14},{"timestamp":"2026-08-20T17:12:30","port":3127,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001��B��\u0000","payload_hex":"040101bbac4293f300","method":"","user_agent":"","ja3":"","session":"7087c431-3586-448f-bda8-921e58ea1c8f","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":14}],"http_methods":[],"distinct_ports_total":23,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:23:17.529067+00:00"}