{"ip":"213.209.159.21","total_events":2037,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"985+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 985 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"96,861 bytes sent","bytes_sent":96861,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-18T22:10:26","last_seen":"2026-08-25T09:17:02","events_24h":61,"events_7d":2037,"geo":{"country_code":"DE","country_name":"Germany","region":"North Rhine-Westphalia","city":"Aachen","lat":50.7745,"lon":6.0861,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":10004,"proto":"tcp","label":"","count":10},{"port":8085,"proto":"tcp","label":"","count":9},{"port":2002,"proto":"tcp","label":"","count":9},{"port":1145,"proto":"tcp","label":"","count":9},{"port":2001,"proto":"tcp","label":"","count":8},{"port":50001,"proto":"tcp","label":"","count":8},{"port":1080,"proto":"tcp","label":"SOCKS","count":8},{"port":11080,"proto":"tcp","label":"","count":8},{"port":60016,"proto":"tcp","label":"","count":8},{"port":18888,"proto":"tcp","label":"","count":8},{"port":12004,"proto":"tcp","label":"","count":8},{"port":2222,"proto":"tcp","label":"SSH-alt","count":7},{"port":10025,"proto":"tcp","label":"","count":7},{"port":10020,"proto":"tcp","label":"","count":7},{"port":11220,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":13},{"date":"2026-08-19","count":830},{"date":"2026-08-20","count":419},{"date":"2026-08-21","count":371},{"date":"2026-08-22","count":244},{"date":"2026-08-23","count":63},{"date":"2026-08-24","count":75},{"date":"2026-08-25","count":22}],"recent_events":[{"timestamp":"2026-08-25T09:17:02","port":5888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"3d2c5df7-1dc5-421b-bada-8af123a2ed07","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T08:24:23","port":5524,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"8f36d2ef-cdfd-44c0-b2d9-5b2f2c854352","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T08:06:03","port":10076,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"cd158ad2-7a88-4250-9f1c-3f8a38e17a11","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":14,"enriched":{"digest":"6d22b01fb752497e","label":"HTTP","strings":["CONNECT api.ipinfo.io:443 HTTP/1.1","Host: api.ipinfo.io:443"],"iocs":{"domains":["api.ipinfo.io"]}}},{"timestamp":"2026-08-25T08:05:06","port":20172,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"f3f20920-21f2-4d5f-9ec0-0d873da808d1","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T07:58:46","port":10083,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"1fde84f8-d821-4dc8-9ac7-e41100fe2a18","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T07:21:36","port":11432,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT proxy4.proxiesfood.com:443 HTTP/1.1\r\nHost: proxy4.proxiesfood.com:443\r\n\r\n","payload_hex":"434f4e4e4543542070726f7879342e70726f78696573666f6f642e636f6d3a34343320485454502f312e310d0a486f73743a2070726f7879342e70726f78696573666f6f642e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"339bb379-3dc6-4f88-839e-c46f711357df","seq":1,"duration_ms":102,"bytes_in":81,"bytes_out":14,"enriched":{"digest":"b13a1c738e767b5f","label":"HTTP","strings":["CONNECT proxy4.proxiesfood.com:443 HTTP/1.1","Host: proxy4.proxiesfood.com:443"],"iocs":{"domains":["proxy4.proxiesfood.com"]}}},{"timestamp":"2026-08-25T06:59:41","port":7451,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"180b1435-5992-4a59-9e66-c03e604aae93","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":14,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T06:34:18","port":11003,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"6f49fe5d-88cf-4fec-8400-b8a925bc837c","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":14,"enriched":{"digest":"6d22b01fb752497e","label":"HTTP","strings":["CONNECT api.ipinfo.io:443 HTTP/1.1","Host: api.ipinfo.io:443"],"iocs":{"domains":["api.ipinfo.io"]}}},{"timestamp":"2026-08-25T06:28:04","port":20005,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT proxy3.proxiesfood.com:443 HTTP/1.1\r\nHost: proxy3.proxiesfood.com:443\r\n\r\n","payload_hex":"434f4e4e4543542070726f7879332e70726f78696573666f6f642e636f6d3a34343320485454502f312e310d0a486f73743a2070726f7879332e70726f78696573666f6f642e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"9b741ce4-b72a-4aa7-8776-7c1f84140a00","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":14,"enriched":{"digest":"c193b2a7d9d2a767","label":"HTTP","strings":["CONNECT proxy3.proxiesfood.com:443 HTTP/1.1","Host: proxy3.proxiesfood.com:443"],"iocs":{"domains":["proxy3.proxiesfood.com"]}}},{"timestamp":"2026-08-25T06:07:43","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipinfo.io:443 HTTP/1.1\r\nHost: api.ipinfo.io:443\r\n\r\n","payload_hex":"434f4e4e454354206170692e6970696e666f2e696f3a34343320485454502f312e310d0a486f73743a206170692e6970696e666f2e696f3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"82aed24a-f629-4861-96e4-6c6169d17d25","seq":1,"duration_ms":103,"bytes_in":63,"bytes_out":14,"enriched":{"digest":"6d22b01fb752497e","label":"HTTP","strings":["CONNECT api.ipinfo.io:443 HTTP/1.1","Host: api.ipinfo.io:443"],"iocs":{"domains":["api.ipinfo.io"]}}}],"http_methods":[],"distinct_ports_total":985,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-25T09:24:38.858030+00:00"}