{"ip":"204.76.203.4","total_events":1630,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"412+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 412 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"35,860 bytes sent","bytes_sent":35860,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-29T15:03:47","last_seen":"2026-09-29T10:15:52","events_24h":208,"events_7d":525,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.4.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":458},{"port":25566,"proto":"tcp","label":"","count":408},{"port":25564,"proto":"tcp","label":"","count":355},{"port":30164,"proto":"tcp","label":"","count":1},{"port":12332,"proto":"tcp","label":"","count":1},{"port":37989,"proto":"tcp","label":"","count":1},{"port":62667,"proto":"tcp","label":"","count":1},{"port":55572,"proto":"tcp","label":"","count":1},{"port":7755,"proto":"tcp","label":"","count":1},{"port":64496,"proto":"tcp","label":"","count":1},{"port":19697,"proto":"tcp","label":"","count":1},{"port":39826,"proto":"tcp","label":"","count":1},{"port":48634,"proto":"tcp","label":"","count":1},{"port":58182,"proto":"tcp","label":"","count":1},{"port":50911,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-29","count":36},{"date":"2026-08-30","count":90},{"date":"2026-08-31","count":51},{"date":"2026-09-11","count":77},{"date":"2026-09-12","count":109},{"date":"2026-09-13","count":110},{"date":"2026-09-14","count":110},{"date":"2026-09-15","count":113},{"date":"2026-09-16","count":108},{"date":"2026-09-17","count":111},{"date":"2026-09-18","count":112},{"date":"2026-09-19","count":48},{"date":"2026-09-20","count":12},{"date":"2026-09-21","count":13},{"date":"2026-09-22","count":12},{"date":"2026-09-23","count":23},{"date":"2026-09-24","count":24},{"date":"2026-09-25","count":24},{"date":"2026-09-26","count":24},{"date":"2026-09-27","count":126},{"date":"2026-09-28","count":209},{"date":"2026-09-29","count":88}],"recent_events":[{"timestamp":"2026-09-29T10:15:52","port":38963,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"cff29436-b834-4508-891e-d3b1b8126b54","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T10:13:21","port":14675,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"1847e57e-bbfe-48d1-9683-9356199944b2","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T10:11:08","port":16355,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"00f69e90-60a1-4781-9828-8490b7c4f57a","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T09:53:15","port":60174,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"ab14d3b2-7e0c-4960-ad6c-5e5c41699ff3","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T09:15:30","port":24508,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"25dd32e5-107f-4d1e-9170-be0e4a801ff8","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T08:55:06","port":5048,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"da9ef393-e336-4b6a-8f73-90e1f00c6002","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T08:52:03","port":4988,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"c05b917e-28fd-406b-bb55-1584eed10047","seq":1,"duration_ms":101,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T08:50:08","port":15181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"e0cf802b-3ac8-44e4-9ce8-95cc729fe3c6","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T08:49:52","port":8207,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"6d96dbcc-eb4e-4b78-bbcf-d7678e2fd3af","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}},{"timestamp":"2026-09-29T08:34:50","port":15296,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000�\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_hex":"130089060c736c6f77737461636b2e74760539010100","method":"","user_agent":"","ja3":"","session":"02ed7350-7cb4-4c5e-8a93-fb9fac0948c8","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":12,"enriched":{"digest":"4da18ce2f7b09532","strings":["slowstack.tv"],"iocs":{"domains":["slowstack.tv"]}}}],"http_methods":[],"distinct_ports_total":412,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T10:19:52.999577+00:00"}