{"ip":"185.73.23.162","total_events":908,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"249,772 bytes sent","bytes_sent":249772,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-13T17:50:14","last_seen":"2026-09-23T10:22:46","events_24h":266,"events_7d":320,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":29484,"org":"Ruhr-Universitaet Bochum"},"source_domain":"goose.softsec.ruhr-uni-bochum.de","known_scanners":["universities","Ruhr-Universitaet Bochum"],"scanner_tag":{"key":"peeringdb:as29484","label":"Ruhr-Universitaet Bochum","category":"research","url":"https://www.peeringdb.com/asn/29484"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":892},{"port":80,"proto":"tcp","label":"HTTP","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1011h1_61a7ad8aa9b6_35d235a1c490","t13d1011h1_61a7ad8aa9b6_f9531d972513"],"tls_client_hello":"160301015a010001560303db3bae0c0098bfca546947e3bf53ae0f70e9b3ad4bab57fc265386341ddeffcc201234b3d141dca092749e118528d6c2ebf57fb2587138736c16476dfc6e1ca2e80014130213011303c02cc02bcca9c030c02fcca800ff010000f9000500050100000000000d001600140503040306030807080608050804060105010401002b000504030403030010000b000908687474702f312e3100170000002d0002010100000013001100000e657870616e73616f2e636f2e616f000a000a0008001d0017001811ec003300260024001d00206c9b6608b730d6b6738e35fe700d98b8707dd69aa47ec7afd7bb3d84fd618802000b000201000029005b00260020d08e4363bb4d5c166163843e6cf61d53bf332635961d350a11d310e9c06e222a2fa1af34003130cce501a849b0a794fe8836695a89ef38eeb7736dd52c2468b37ab6451a14679246d9161a86b763ee8710c148bab14d37","tls_ja3":["cf72d84db3ceb6ce944bbc7e7daf5a1f","51c6dc34a24fdfa19b6ec66e254b132f","a3b4f78bf286b9ed616d7350e15d41e9","bafedb6c06084b42680d55d4307e0620","f28a815bcfc853e97ecc664fd9f7537a"],"http_akin":["a11cun050_0000005b_e6fe1ac3"]},"fingerprint_peers":{"t13d1011h1_61a7ad8aa9b6_35d235a1c490":1,"t13d1011h1_61a7ad8aa9b6_f9531d972513":1,"a11cun050_0000005b_e6fe1ac3":1},"akin_families":{},"user_agents":["Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)"],"timeline":[{"date":"2026-08-13","count":39},{"date":"2026-08-14","count":34},{"date":"2026-08-15","count":53},{"date":"2026-08-16","count":462},{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":2},{"date":"2026-09-18","count":1},{"date":"2026-09-20","count":18},{"date":"2026-09-21","count":32},{"date":"2026-09-23","count":266}],"recent_events":[{"timestamp":"2026-09-23T10:22:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"expansao.co.ao","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"expansao.co.ao\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"expansao.co.ao","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20657870616e73616f2e636f2e616f0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"4453183cc26e82f00178fc34a2d0a998","session":"08d049db-3f17-4a99-8dd2-a6e2c73c5184","seq":1,"duration_ms":106,"bytes_in":281,"bytes_out":78},{"timestamp":"2026-09-23T10:19:37","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"elitemarketnetwork.nl","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"elitemarketnetwork.nl\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"elitemarketnetwork.nl","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20656c6974656d61726b65746e6574776f726b2e6e6c0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"84747e2dd73af5f83ef3c104c083097a","session":"8d47c01f-e5fb-4e79-85eb-c12df363e2bb","seq":1,"duration_ms":106,"bytes_in":288,"bytes_out":78},{"timestamp":"2026-09-23T10:18:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"emmaus.org.uk","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"emmaus.org.uk\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"emmaus.org.uk","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20656d6d6175732e6f72672e756b0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"beba8499e10eb2942a8230babc19809b","session":"a7a65074-797b-4729-838f-2b17a9acebc0","seq":1,"duration_ms":115,"bytes_in":280,"bytes_out":78},{"timestamp":"2026-09-23T10:14:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"free-putlockers.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"free-putlockers.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"free-putlockers.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20667265652d7075746c6f636b6572732e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"0c2004c5b464d5e3e84f5bcb3f230684","session":"79f0239b-7bba-4e15-9bf6-d1ff0cdd8449","seq":1,"duration_ms":106,"bytes_in":286,"bytes_out":78},{"timestamp":"2026-09-23T10:14:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"free-putlockers.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"free-putlockers.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"free-putlockers.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20667265652d7075746c6f636b6572732e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"0c89499b55c3174323a2dcb7a9841db8","session":"99dab424-fd8e-474a-bd29-dd799e823171","seq":1,"duration_ms":115,"bytes_in":286,"bytes_out":78},{"timestamp":"2026-09-23T10:10:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localmart.kz","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"localmart.kz\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"localmart.kz","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a206c6f63616c6d6172742e6b7a0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"d5a9b66960d5fc75b902ee455f922210","session":"5e711d97-1373-40b4-a0f2-8472b5a9d166","seq":1,"duration_ms":105,"bytes_in":279,"bytes_out":78},{"timestamp":"2026-09-23T10:07:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"business-communicator.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"business-communicator.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"business-communicator.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20627573696e6573732d636f6d6d756e696361746f722e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"894d5f89e7888cadeb2e1df4348f48ec","session":"dd45d3c4-a58e-4e86-8885-0284344df800","seq":1,"duration_ms":106,"bytes_in":292,"bytes_out":78},{"timestamp":"2026-09-23T10:05:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"for-minecraft.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"for-minecraft.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"for-minecraft.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20666f722d6d696e6563726166742e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"a4f33d2fe59b37833b3485e17485f198","session":"6c574f52-4e3d-40bf-a654-a805000cfd63","seq":1,"duration_ms":105,"bytes_in":284,"bytes_out":78},{"timestamp":"2026-09-23T10:04:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"for-minecraft.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"for-minecraft.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"for-minecraft.com","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20666f722d6d696e6563726166742e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"46a6d09ba9ee3f30b270c94df69ef196","session":"79054fc0-7ab3-41b7-a1d4-ea247e425af9","seq":1,"duration_ms":115,"bytes_in":284,"bytes_out":78},{"timestamp":"2026-09-23T10:02:56","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"faketaxi1.com","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"keep-alive\",\"host\":\"faketaxi1.com\",\"user-agent\":\"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a2066616b6574617869312e636f6d0d0a557365722d4167656e743a20536f6674776172652053656375726974792052657365617263682f312e3020282b68747470733a2f2f726576657273652d70726f786965732d6d6561737572656d656e74732e736f66747365632e727568722d756e692d626f6368756d2e6465290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","ja3":"","session":"ecf1d20f-2415-49fa-aee8-541633159dd7","seq":1,"duration_ms":100,"bytes_in":280,"bytes_out":78}],"http_methods":[{"method":"GET","count":908}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":830,"ports":2},{"path":"/en","count":16,"ports":2},{"path":"/en/","count":10,"ports":1},{"path":"/de/","count":7,"ports":1},{"path":"/de-de","count":7,"ports":1},{"path":"/en/passenger-ferries","count":7,"ports":1},{"path":"/de-de/","count":6,"ports":1},{"path":"/en-de","count":5,"ports":1},{"path":"/de/home","count":4,"ports":1},{"path":"/entry/login","count":3,"ports":1},{"path":"/it.html","count":2,"ports":1},{"path":"/en-de/","count":2,"ports":1},{"path":"/uk/","count":2,"ports":1},{"path":"/home","count":1,"ports":1},{"path":"/de","count":1,"ports":1}],"distinct_paths_total":20,"top_snis":[{"value":"www.dfds.com","count":7},{"value":"bolt.eu","count":6},{"value":"hisky.aero","count":5},{"value":"pornokrol.com","count":5},{"value":"www.aveloair.com","count":5},{"value":"ruralwebtelecom.com.br","count":4},{"value":"cosmicbettingstation.com","count":4},{"value":"fapclub.vip","count":4},{"value":"www.momondo.it","count":4},{"value":"www.paypal.com","count":4},{"value":"solarroulettehub.com","count":4},{"value":"wisecars.pt","count":4}],"top_hosts":[{"value":"www.dfds.com","count":7},{"value":"bolt.eu","count":6},{"value":"www.momondo.it","count":5},{"value":"hisky.aero","count":5},{"value":"pornokrol.com","count":5},{"value":"www.aveloair.com","count":5},{"value":"supremepalacemarket.com","count":4},{"value":"solarroulettehub.com","count":4},{"value":"leasingengel.de","count":4},{"value":"alphapalacelounge.com","count":4},{"value":"mostbet.bet","count":4},{"value":"messengerbot.app","count":4}],"top_alpns":[{"value":"http/1.1","count":892}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"expansao.co.ao","notable":false},{"name":"User-Agent","value":"Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T13:36:43.707959+00:00"}