{"ip":"204.76.203.7","total_events":711,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"126+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 126 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"47,639 bytes sent","bytes_sent":47639,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-10T12:50:10","last_seen":"2026-08-15T07:04:44","events_24h":144,"events_7d":711,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.7.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":64,"proto":"tcp","label":"","count":8},{"port":10800,"proto":"tcp","label":"","count":8},{"port":69,"proto":"tcp","label":"","count":8},{"port":161,"proto":"tcp","label":"SNMP","count":7},{"port":777,"proto":"tcp","label":"","count":6},{"port":14,"proto":"tcp","label":"","count":6},{"port":591,"proto":"tcp","label":"","count":6},{"port":77,"proto":"tcp","label":"","count":6},{"port":193,"proto":"tcp","label":"","count":6},{"port":115,"proto":"tcp","label":"","count":6},{"port":50,"proto":"tcp","label":"","count":6},{"port":138,"proto":"tcp","label":"","count":6},{"port":11,"proto":"tcp","label":"","count":6},{"port":650,"proto":"tcp","label":"","count":6},{"port":330,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"ge11nn0400_9c3956fad5da":1491},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-08-10","count":67},{"date":"2026-08-11","count":148},{"date":"2026-08-12","count":146},{"date":"2026-08-13","count":155},{"date":"2026-08-14","count":149},{"date":"2026-08-15","count":46}],"recent_events":[{"timestamp":"2026-08-15T07:04:44","port":808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"4b5bfe6e-c660-419d-86b4-7e3442418eee","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-15T07:04:23","port":808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"d0a61311-6949-40c4-89e1-24ceed86150b","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-15T07:03:22","port":808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"65b65905-7ffc-4810-a6eb-4d9c97852ffb","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-15T07:02:13","port":808,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"azenv.net","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://azenv.net/","summary":"","payload_hex":"47455420687474703a2f2f617a656e762e6e65742f20485454502f312e310d0a486f73743a20617a656e762e6e65740d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8f9ee462-af7e-435a-8c87-933efedf9373","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-08-15T07:01:53","port":808,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"azenv.net","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://azenv.net/","summary":"","payload_hex":"47455420687474703a2f2f617a656e762e6e65742f20485454502f312e310d0a486f73743a20617a656e762e6e65740d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"b3c42f3c-9ce4-4ed9-bed6-42746133d5de","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-08-15T07:00:54","port":808,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"azenv.net","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://azenv.net/","summary":"","payload_hex":"47455420687474703a2f2f617a656e762e6e65742f20485454502f312e310d0a486f73743a20617a656e762e6e65740d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"76f5f282-3cc8-4573-93bf-e89c3f8fed3a","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-08-15T06:09:48","port":805,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3ed46d3f-ddb8-4f82-8719-3c7b7ab3c7e2","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-15T06:09:23","port":805,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ae9866ed-eac5-41b6-905d-0e10a74450f2","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-15T06:07:31","port":805,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"azenv.net","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://azenv.net/","summary":"","payload_hex":"47455420687474703a2f2f617a656e762e6e65742f20485454502f312e310d0a486f73743a20617a656e762e6e65740d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"562997b7-57d8-4849-9fdc-9234a6b2fc92","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-08-15T06:07:09","port":805,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"azenv.net","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"azenv.net\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://azenv.net/","summary":"","payload_hex":"47455420687474703a2f2f617a656e762e6e65742f20485454502f312e310d0a486f73743a20617a656e762e6e65740d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"70d2b861-7ab2-481b-abfb-06ee2961ca47","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77}],"http_methods":[{"method":"GET","count":373}],"distinct_ports_total":126,"top_paths":[{"path":"http://azenv.net/","count":373,"ports":126}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"azenv.net","count":373}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"azenv.net","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-08-15T07:44:14.130576+00:00"}