{"ip":"20.55.15.97","data_as_of":"2026-10-21T15:02:22+00:00","observed":true,"total_events":0,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counted from 39 interactive session(s); the first-packet sensors recorded no TCP events from this address."],"engagement":{"level":"request","label":"Request traffic","detail":"1,910 bytes sent","bytes_sent":1910,"session_seconds":4,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-20T21:53:26","last_seen":"2026-10-20T21:53:34","events_24h":0,"events_7d":0,"interactive_sessions":39,"interactive_sessions_24h":39,"interactive_sessions_7d":39,"interactive_protocols":[{"protocol":"socks5","sessions":13},{"protocol":"socks4","sessions":10},{"protocol":"http-proxy","sessions":10},{"protocol":"http","sessions":3},{"protocol":"dnp3","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":39,"first_seen":"2026-10-20T21:53:26","last_seen":"2026-10-20T21:53:34","verdicts":[{"verdict":"scan","sessions":39}],"personas":[{"persona":"proxy@squid/4.13","sessions":33},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":3},{"persona":"ics@Schneider Modicon M340","sessions":3}],"services":[{"protocol":"socks5","port":1081,"sessions":3},{"protocol":"http","port":80,"sessions":3},{"protocol":"dnp3","port":20000,"sessions":3},{"protocol":"http-proxy","port":8888,"sessions":1},{"protocol":"socks5","port":8888,"sessions":1},{"protocol":"socks4","port":9998,"sessions":1},{"protocol":"socks4","port":808,"sessions":1},{"protocol":"socks5","port":808,"sessions":1},{"protocol":"socks5","port":9998,"sessions":1},{"protocol":"http-proxy","port":9998,"sessions":1},{"protocol":"socks5","port":82,"sessions":1},{"protocol":"http-proxy","port":1314,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":39}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":3},{"port":82,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":808,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":1081,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":1314,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":3},{"port":8001,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":8123,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":8880,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":3},{"port":8889,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":9998,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":20000,"proto":"tcp","label":"DNP3","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_ja3":["8bee49baa010986785a9e74d688ed7e9"]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-20","count":0,"sessions":39}],"recent_events":[{"timestamp":"2026-10-20T21:53:34","port":9998,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"f3d54623-fcbd-431d-ae6c-5d424ff5209f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:34","port":8888,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"1807e9eb-7c86-4f51-81f8-145863076cf7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:34","port":8880,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"73f5e615-992a-4a30-b8ef-a735313bc812-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":8889,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"b7e647f7-52b3-4c01-b30f-cb4c5484b96a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":1314,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"0e2f9566-3569-4585-9879-e9766a86aeeb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":808,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"04819736-15ff-46ee-8d04-fde812c44d45-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":8001,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"f04de7c3-f28c-4e96-a7f1-a286e2adb077-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":8123,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"718cdf75-50ae-481d-9704-c88106204f48-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":8000,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"0a6623a6-37c6-4571-9509-70e2c5325cbd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T21:53:33","port":82,"proto":"tcp","app_proto":"socks4","app_protocol":"socks4","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"b2f182b7-7816-45d2-96ea-5ae2f8f9974d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"CONNECT","count":1}],"distinct_ports_total":13,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"api.ipify.org:443","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}