{"ip":"204.76.203.195","total_events":126,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["126 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,418 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,418 bytes sent","bytes_sent":5418,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T00:04:57","last_seen":"2026-10-02T05:59:47","events_24h":36,"events_7d":126,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.195.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":24},{"port":10808,"proto":"tcp","label":"","count":24},{"port":1080,"proto":"tcp","label":"SOCKS","count":22},{"port":4145,"proto":"tcp","label":"","count":20},{"port":4148,"proto":"tcp","label":"","count":20},{"port":30000,"proto":"tcp","label":"","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-01","count":90},{"date":"2026-10-02","count":36}],"recent_events":[{"timestamp":"2026-10-02T05:59:47","port":3128,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"982aaa14-2731-4adf-9949-9f73f98ab0f0","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-02T05:59:47","port":4145,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"8edb97b0-4750-44e7-988a-3bea1e1fef9e","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-02T05:59:47","port":10808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"5f549171-4660-401b-8938-b7aaea1b5d5b","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-02T05:59:47","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3be6bcc1-fa24-4ebf-bd96-6d235821c653","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-02T05:59:42","port":4145,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.i.pn:443 HTTP/1.1\r\nHost: api.i.pn:443\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e692e706e3a34343320485454502f312e310d0a486f73743a206170692e692e706e3a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"2e5122e1-4ea5-4a93-ac01-5f5b9dc463bb","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":14,"enriched":{"digest":"c18b37950f28dd94","label":"HTTP","strings":["CONNECT api.i.pn:443 HTTP/1.1","Host: api.i.pn:443","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.i.pn"]}}},{"timestamp":"2026-10-02T05:59:42","port":10808,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.i.pn:443 HTTP/1.1\r\nHost: api.i.pn:443\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e692e706e3a34343320485454502f312e310d0a486f73743a206170692e692e706e3a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"6a32c190-522c-41c5-9bfe-31ad60693938","seq":1,"duration_ms":102,"bytes_in":83,"bytes_out":14,"enriched":{"digest":"c18b37950f28dd94","label":"HTTP","strings":["CONNECT api.i.pn:443 HTTP/1.1","Host: api.i.pn:443","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.i.pn"]}}},{"timestamp":"2026-10-02T05:59:42","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.i.pn:443 HTTP/1.1\r\nHost: api.i.pn:443\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e692e706e3a34343320485454502f312e310d0a486f73743a206170692e692e706e3a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"964ec663-61b3-4425-8523-2bac7e522d53","seq":1,"duration_ms":102,"bytes_in":83,"bytes_out":14,"enriched":{"digest":"c18b37950f28dd94","label":"HTTP","strings":["CONNECT api.i.pn:443 HTTP/1.1","Host: api.i.pn:443","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.i.pn"]}}},{"timestamp":"2026-10-02T05:59:42","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.i.pn:443 HTTP/1.1\r\nHost: api.i.pn:443\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e692e706e3a34343320485454502f312e310d0a486f73743a206170692e692e706e3a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"314397b5-a1d8-4f93-85ea-72f528baaac5","seq":1,"duration_ms":102,"bytes_in":83,"bytes_out":14,"enriched":{"digest":"c18b37950f28dd94","label":"HTTP","strings":["CONNECT api.i.pn:443 HTTP/1.1","Host: api.i.pn:443","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.i.pn"]}}},{"timestamp":"2026-10-02T05:01:40","port":10808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"29953eed-9ea8-49d8-af02-b9e59da1433c","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-02T05:01:40","port":3128,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"497b8797-cb34-4fa1-b593-a7a6e9298761","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-02T21:48:52.870758+00:00"}