{"ip":"213.209.159.20","total_events":3118,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"1213+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 1213 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"135,140 bytes sent","bytes_sent":135140,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-18T22:10:26","last_seen":"2026-09-19T16:55:46","events_24h":68,"events_7d":447,"geo":{"country_code":"DE","country_name":"Germany","region":"North Rhine-Westphalia","city":"Aachen","lat":50.7745,"lon":6.0861,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":11220,"proto":"tcp","label":"","count":15},{"port":11001,"proto":"tcp","label":"","count":13},{"port":5555,"proto":"tcp","label":"","count":13},{"port":10080,"proto":"tcp","label":"","count":13},{"port":10025,"proto":"tcp","label":"","count":13},{"port":10001,"proto":"tcp","label":"","count":12},{"port":5103,"proto":"tcp","label":"","count":12},{"port":18088,"proto":"tcp","label":"","count":12},{"port":2030,"proto":"tcp","label":"","count":12},{"port":11000,"proto":"tcp","label":"","count":11},{"port":7897,"proto":"tcp","label":"","count":11},{"port":11905,"proto":"tcp","label":"","count":11},{"port":60009,"proto":"tcp","label":"","count":11},{"port":50004,"proto":"tcp","label":"","count":11},{"port":9090,"proto":"tcp","label":"Prometheus","count":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":11},{"date":"2026-08-19","count":865},{"date":"2026-08-20","count":483},{"date":"2026-08-21","count":382},{"date":"2026-08-22","count":247},{"date":"2026-08-23","count":63},{"date":"2026-08-24","count":98},{"date":"2026-08-25","count":50},{"date":"2026-08-26","count":29},{"date":"2026-08-27","count":16},{"date":"2026-08-28","count":10},{"date":"2026-08-29","count":16},{"date":"2026-08-30","count":26},{"date":"2026-08-31","count":18},{"date":"2026-09-01","count":13},{"date":"2026-09-02","count":3},{"date":"2026-09-03","count":7},{"date":"2026-09-04","count":3},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":131},{"date":"2026-09-11","count":110},{"date":"2026-09-12","count":119},{"date":"2026-09-13","count":90},{"date":"2026-09-14","count":50},{"date":"2026-09-15","count":33},{"date":"2026-09-16","count":11},{"date":"2026-09-17","count":88},{"date":"2026-09-18","count":109},{"date":"2026-09-19","count":34}],"recent_events":[{"timestamp":"2026-09-19T16:55:46","port":11318,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ca2d640f-6408-444f-9ff0-7434e8cd606e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T16:39:32","port":11309,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3231178b-82b4-471c-90fb-2b63f57d808f","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T15:17:20","port":8181,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"0c2cc824-eb8c-47b6-a94a-2148ec9f5df6","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T15:11:56","port":10249,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"7d97bf99-5fab-4e4c-832d-d1ddedddda64","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T14:45:12","port":10056,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"c9672623-e37b-4858-aa53-525535b685a8","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T14:20:01","port":18888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"03f538fb-7bc0-4663-b57a-593a6f8d6d68","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T14:09:22","port":999,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n","payload_hex":"434f4e4e4543542061706936342e69706966792e6f72673a34343320485454502f312e310d0a486f73743a2061706936342e69706966792e6f72673a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"25d3566a-2f92-4b67-b0a9-ec6d643e7b3b","seq":1,"duration_ms":101,"bytes_in":67,"bytes_out":14,"enriched":{"digest":"a21c43effbd52bce","label":"HTTP","strings":["CONNECT api64.ipify.org:443 HTTP/1.1","Host: api64.ipify.org:443"],"iocs":{"domains":["api64.ipify.org"]}}},{"timestamp":"2026-09-19T13:44:55","port":60003,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"8664ca66-ae7c-4869-aecc-29634b255a00","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T13:21:25","port":55555,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"4a33e60c-3ef5-4f2e-8b79-83b91476acec","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-19T13:06:44","port":10086,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n","payload_hex":"434f4e4e454354206963616e68617a69702e636f6d3a34343320485454502f312e310d0a486f73743a206963616e68617a69702e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"4ad43b7d-7338-47b5-bce4-73cf35bb1dea","seq":1,"duration_ms":102,"bytes_in":63,"bytes_out":14,"enriched":{"digest":"af2464dfb023fc5a","label":"HTTP","strings":["CONNECT icanhazip.com:443 HTTP/1.1","Host: icanhazip.com:443"],"iocs":{"domains":["icanhazip.com"]}}}],"http_methods":[],"distinct_ports_total":1213,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-19T17:00:32.002757+00:00"}