{"ip":"204.76.203.40","observed":true,"total_events":2498,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"2424+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 2424 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 1,146 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"131,250 bytes sent","bytes_sent":131250,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-09-30T10:40:35","last_seen":"2026-10-20T09:40:19","events_24h":5,"events_7d":2408,"interactive_sessions":1146,"interactive_sessions_24h":0,"interactive_sessions_7d":1146,"interactive_protocols":[{"protocol":"socks5","sessions":569},{"protocol":"http-proxy","sessions":559},{"protocol":"http","sessions":2},{"protocol":"stratum","sessions":2},{"protocol":"pop3","sessions":1},{"protocol":"ntp","sessions":1},{"protocol":"adb","sessions":1},{"protocol":"smtp","sessions":1},{"protocol":"cassandra","sessions":1},{"protocol":"dnp3","sessions":1},{"protocol":"s7comm","sessions":1},{"protocol":"atg","sessions":1},{"protocol":"imap","sessions":1},{"protocol":"sunrpc","sessions":1},{"protocol":"vnc","sessions":1},{"protocol":"msrpc","sessions":1},{"protocol":"elasticsearch-transport","sessions":1},{"protocol":"rtsp","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.40.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1146,"first_seen":"2026-10-18T16:36:25","last_seen":"2026-10-18T19:36:09","verdicts":[{"verdict":"scan","sessions":1146}],"personas":[{"persona":"proxy@squid/4.13","sessions":1127},{"persona":"ics@Schneider Modicon M340","sessions":2},{"persona":"miner@bfgminer 5.5.0","sessions":2},{"persona":"dovecot@2.3.13","sessions":2},{"persona":"vnc@RealVNC Server 6.11.0","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dns@1.10, fortigate@7.0.5","sessions":1},{"persona":"elasticsearch@6.8.23","sessions":1},{"persona":"smtp@3.8.6","sessions":1},{"persona":"ntp@ntpd 4.2.8p10","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":1},{"persona":"atg@Veeder-Root TLS-350R","sessions":1}],"services":[{"protocol":"http-proxy","port":892,"sessions":1},{"protocol":"socks5","port":31346,"sessions":1},{"protocol":"http-proxy","port":52928,"sessions":1},{"protocol":"socks5","port":2025,"sessions":1},{"protocol":"socks5","port":9882,"sessions":1},{"protocol":"socks5","port":31373,"sessions":1},{"protocol":"http-proxy","port":8890,"sessions":1},{"protocol":"socks5","port":4447,"sessions":1},{"protocol":"http-proxy","port":36509,"sessions":1},{"protocol":"http-proxy","port":52134,"sessions":1},{"protocol":"socks5","port":31818,"sessions":1},{"protocol":"http-proxy","port":4002,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1146}]},"top_ports":[{"port":52110,"proto":"tcp","label":"","count":3,"sessions":1},{"port":5567,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10018,"proto":"tcp","label":"","count":3,"sessions":0},{"port":22112,"proto":"tcp","label":"","count":3,"sessions":0},{"port":18884,"proto":"tcp","label":"","count":3,"sessions":0},{"port":5116,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10061,"proto":"tcp","label":"","count":3,"sessions":0},{"port":11225,"proto":"tcp","label":"","count":3,"sessions":0},{"port":14323,"proto":"tcp","label":"","count":3,"sessions":0},{"port":65535,"proto":"tcp","label":"","count":2,"sessions":0},{"port":11428,"proto":"tcp","label":"","count":2,"sessions":0},{"port":12334,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9905,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10898,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10017,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d101000_61a7ad8aa9b6_3fcd1a44f3e3","t13d101000_61a7ad8aa9b6_d4929ced8316"],"tls_client_hello":"","tls_ja3":["2a189a6f3fd17aa9f17f0e8b8b025d17","53de36ae1f9b2ca151fb45a79d7e1f3a","8c3d14a8181c42f27f3957a5e5356d64","8f8650766aca917cada55e51b907a546","c552316e8a2eca80ea70b41d3763e26f"],"http_akin":["b11cun010_00040000_c4b2c4aa"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d101000_61a7ad8aa9b6_3fcd1a44f3e3","t13d101000_61a7ad8aa9b6_d4929ced8316"],"tls_ja3":["2a189a6f3fd17aa9f17f0e8b8b025d17","53de36ae1f9b2ca151fb45a79d7e1f3a","8c3d14a8181c42f27f3957a5e5356d64","8f8650766aca917cada55e51b907a546","c552316e8a2eca80ea70b41d3763e26f"]}},"fingerprint_peers":{"t13d101000_61a7ad8aa9b6_3fcd1a44f3e3":0,"t13d101000_61a7ad8aa9b6_d4929ced8316":0,"b11cun010_00040000_c4b2c4aa":849},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-30","count":90,"sessions":0},{"date":"2026-10-18","count":2403,"sessions":1146},{"date":"2026-10-20","count":5,"sessions":0}],"recent_events":[{"timestamp":"2026-10-20T09:40:19","port":14323,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"55075867-3ad4-4cab-84dc-f42e05e32f67","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-20T09:33:21","port":5567,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"536ef8f8-979a-4b8d-b930-f52974a872da","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-20T09:31:56","port":2933,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"36f2293e-3f71-4a91-8004-9b9ae01fe0e3","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-20T09:27:13","port":5123,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"api.ipinfo.io","headers":"{\"host\":\"api.ipinfo.io:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"api.ipinfo.io:443","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"8241cd0a-1023-4c9f-935f-5219d68011bd","seq":1,"duration_ms":102,"bytes_in":63,"bytes_out":13},{"timestamp":"2026-10-20T09:11:57","port":10300,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"ipv4.icanhazip.com","headers":"{\"host\":\"ipv4.icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"ipv4.icanhazip.com:443","summary":"CONNECT ipv4.icanhazip.com:443 HTTP/1.1\r\nHost: ipv4.icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e45435420697076342e6963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a20697076342e6963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"e1bf543a-6cc5-4c31-8b3f-c118b0edc676","seq":1,"duration_ms":102,"bytes_in":73,"bytes_out":13},{"timestamp":"2026-10-18T19:36:13","port":31140,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"icanhazip.com","headers":"{\"host\":\"icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"icanhazip.com:443","summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e454354206963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a206963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"80c37c45-082a-433f-a930-acc7ce63aaff","seq":1,"duration_ms":101,"bytes_in":63,"bytes_out":13},{"timestamp":"2026-10-18T19:36:10","port":11725,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"7b8dc412-061b-41d0-a788-6bc68952cdf0","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:36:03","port":6688,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"62a7240b-570f-4408-b1a4-ae72962cd628","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:36:00","port":55557,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"e1da3baf-768e-4cfb-bb11-34c4e5f21063","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:35:52","port":3341,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"icanhazip.com","headers":"{\"host\":\"icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"icanhazip.com:443","summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e454354206963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a206963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"84ccfcf5-b9c1-459d-9efe-368811d0c6f2","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":13}],"http_methods":[{"method":"CONNECT","count":1196}],"distinct_ports_total":2424,"top_paths":[{"path":"icanhazip.com:443","count":1194,"ports":1068},{"path":"ipv4.icanhazip.com:443","count":1,"ports":1},{"path":"api.ipinfo.io:443","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"icanhazip.com","count":1194},{"value":"api.ipinfo.io","count":1},{"value":"ipv4.icanhazip.com","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"api.ipinfo.io:443","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-10-20T13:08:27.885608+00:00"}