{"ip":"204.76.203.44","observed":true,"total_events":2491,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"2399+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 2399 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 1,171 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"130,970 bytes sent","bytes_sent":130970,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-09-26T08:26:03","last_seen":"2026-10-20T09:41:23","events_24h":5,"events_7d":2395,"interactive_sessions":1171,"interactive_sessions_24h":0,"interactive_sessions_7d":1171,"interactive_protocols":[{"protocol":"socks5","sessions":590},{"protocol":"http-proxy","sessions":566},{"protocol":"http","sessions":4},{"protocol":"ftp","sessions":1},{"protocol":"smtp","sessions":1},{"protocol":"cassandra","sessions":1},{"protocol":"kafka","sessions":1},{"protocol":"pjl","sessions":1},{"protocol":"imap","sessions":1},{"protocol":"stratum","sessions":1},{"protocol":"smb","sessions":1},{"protocol":"dvrip","sessions":1},{"protocol":"ldap","sessions":1},{"protocol":"kerberos","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.44.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1171,"first_seen":"2026-10-18T16:36:23","last_seen":"2026-10-18T19:35:46","verdicts":[{"verdict":"scan","sessions":1171}],"personas":[{"persona":"proxy@squid/4.13","sessions":1155},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1},{"persona":"ldap@Windows Server 2016","sessions":1},{"persona":"kerberos@Windows Server 2016","sessions":1},{"persona":"kafka@Kafka 2.6.3","sessions":1},{"persona":"miner@bfgminer 5.5.0","sessions":1},{"persona":"smtp@3.8.6","sessions":1},{"persona":"ftp@3.0.5","sessions":1},{"persona":"dovecot@2.3.13","sessions":1},{"persona":"printer@HP LaserJet 4250","sessions":1}],"services":[{"protocol":"socks5","port":46956,"sessions":1},{"protocol":"socks5","port":31406,"sessions":1},{"protocol":"http-proxy","port":22325,"sessions":1},{"protocol":"socks5","port":11600,"sessions":1},{"protocol":"socks5","port":31061,"sessions":1},{"protocol":"socks5","port":18081,"sessions":1},{"protocol":"socks5","port":11997,"sessions":1},{"protocol":"http-proxy","port":18966,"sessions":1},{"protocol":"http-proxy","port":7775,"sessions":1},{"protocol":"socks5","port":8188,"sessions":1},{"protocol":"socks5","port":8200,"sessions":1},{"protocol":"socks5","port":36945,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"bbfbd29775f3bef9eecfc4fb17f36442b4c55dfc12ecfaae43ba1abe6760dc39","name":"job-1","size":63,"mime_type":"text/plain","kind":"print-job","times":1,"first_seen":"2026-10-18T17:43:06","last_seen":"2026-10-18T17:43:06","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1171}]},"top_ports":[{"port":9000,"proto":"tcp","label":"Web-alt","count":4,"sessions":0},{"port":42146,"proto":"tcp","label":"","count":3,"sessions":1},{"port":10036,"proto":"tcp","label":"","count":3,"sessions":0},{"port":5123,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10052,"proto":"tcp","label":"","count":3,"sessions":0},{"port":11820,"proto":"tcp","label":"","count":3,"sessions":0},{"port":22142,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10062,"proto":"tcp","label":"","count":3,"sessions":0},{"port":7992,"proto":"tcp","label":"","count":3,"sessions":0},{"port":20115,"proto":"tcp","label":"","count":3,"sessions":0},{"port":11637,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10042,"proto":"tcp","label":"","count":3,"sessions":0},{"port":41001,"proto":"tcp","label":"","count":2,"sessions":0},{"port":39990,"proto":"tcp","label":"","count":2,"sessions":0},{"port":11394,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d101000_61a7ad8aa9b6_3fcd1a44f3e3","t13d101000_61a7ad8aa9b6_d4929ced8316"],"tls_client_hello":"","tls_ja3":["06e229f97016cb6b7e9259f449ecde10","633a736d8c7fb810f976dacecfe9ac14","6f5f5bc8eb74cf7c59d9607713b665fb","a5e0fb05b3af06de00a8b14040e74eb4","d15ee07d0063c0775d8f2ca5742188eb"],"http_akin":["b11cun010_00040000_c4b2c4aa"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d101000_61a7ad8aa9b6_3fcd1a44f3e3","t13d101000_61a7ad8aa9b6_d4929ced8316"],"tls_ja3":["06e229f97016cb6b7e9259f449ecde10","633a736d8c7fb810f976dacecfe9ac14","6f5f5bc8eb74cf7c59d9607713b665fb","a5e0fb05b3af06de00a8b14040e74eb4","d15ee07d0063c0775d8f2ca5742188eb"]}},"fingerprint_peers":{"t13d101000_61a7ad8aa9b6_3fcd1a44f3e3":0,"t13d101000_61a7ad8aa9b6_d4929ced8316":0,"b11cun010_00040000_c4b2c4aa":849},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":4,"sessions":0},{"date":"2026-09-30","count":92,"sessions":0},{"date":"2026-10-18","count":2390,"sessions":1171},{"date":"2026-10-20","count":5,"sessions":0}],"recent_events":[{"timestamp":"2026-10-20T09:41:23","port":10042,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"ipv4.icanhazip.com","headers":"{\"host\":\"ipv4.icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"ipv4.icanhazip.com:443","summary":"CONNECT ipv4.icanhazip.com:443 HTTP/1.1\r\nHost: ipv4.icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e45435420697076342e6963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a20697076342e6963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"9a0adfd0-8506-4fcb-8594-6e45a1cd42ae","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":13},{"timestamp":"2026-10-20T09:36:49","port":31193,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ad33db6e-2260-402e-abb2-e371b6661cfb","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-20T09:31:55","port":31168,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"ipv4.icanhazip.com","headers":"{\"host\":\"ipv4.icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"ipv4.icanhazip.com:443","summary":"CONNECT ipv4.icanhazip.com:443 HTTP/1.1\r\nHost: ipv4.icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e45435420697076342e6963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a20697076342e6963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"11ebcb8a-859f-4940-8f64-99a29794faec","seq":1,"duration_ms":101,"bytes_in":73,"bytes_out":13},{"timestamp":"2026-10-20T09:26:54","port":11827,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"api.ipinfo.io","headers":"{\"host\":\"api.ipinfo.io:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"api.ipinfo.io:443","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"835cd0f6-ed64-4799-aec4-6cc172bb5483","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":13},{"timestamp":"2026-10-20T09:22:20","port":7992,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"api.ipinfo.io","headers":"{\"host\":\"api.ipinfo.io:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"api.ipinfo.io:443","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"7bf10291-f971-4a89-a67f-4933faf22318","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":13},{"timestamp":"2026-10-18T19:36:18","port":3080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"icanhazip.com","headers":"{\"host\":\"icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"icanhazip.com:443","summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e454354206963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a206963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"7cef57c0-5f71-44cc-92f9-ad391c89e826","seq":1,"duration_ms":102,"bytes_in":63,"bytes_out":13},{"timestamp":"2026-10-18T19:36:16","port":7776,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"4067f76e-a214-4f64-9dad-b09b8ab3bee8","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:36:14","port":20180,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"c8031ca0-9aba-4d3e-b9cc-252b26fd0dbb","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:36:14","port":31204,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ba1b7a26-cd2a-4acc-9309-9bbe1955d2a6","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-18T19:36:12","port":803,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"icanhazip.com","headers":"{\"host\":\"icanhazip.com:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"icanhazip.com:443","summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e454354206963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a206963616e68617a69702e636f6d3a3434330d0a0d0a","method":"CONNECT","user_agent":"","ja3":"","session":"a9e7105c-2c50-40c2-9ad8-dc5c36e69be1","seq":1,"duration_ms":102,"bytes_in":63,"bytes_out":13}],"http_methods":[{"method":"CONNECT","count":1168}],"distinct_ports_total":2399,"top_paths":[{"path":"icanhazip.com:443","count":1164,"ports":1052},{"path":"ipv4.icanhazip.com:443","count":2,"ports":2},{"path":"api.ipinfo.io:443","count":2,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"icanhazip.com","count":1164},{"value":"api.ipinfo.io","count":2},{"value":"ipv4.icanhazip.com","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"ipv4.icanhazip.com:443","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-10-20T12:15:27.122118+00:00"}