{"ip":"23.132.164.76","total_events":92,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 19 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,400 bytes sent","bytes_sent":3400,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-25T09:40:08","last_seen":"2026-09-27T00:52:45","events_24h":0,"events_7d":92,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":401626,"org":"Netiface America, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9050,"proto":"tcp","label":"","count":12},{"port":10809,"proto":"tcp","label":"","count":9},{"port":8118,"proto":"tcp","label":"","count":9},{"port":8989,"proto":"tcp","label":"","count":9},{"port":8085,"proto":"tcp","label":"","count":6},{"port":1088,"proto":"tcp","label":"","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":5},{"port":9090,"proto":"tcp","label":"Prometheus","count":3},{"port":8082,"proto":"tcp","label":"","count":3},{"port":999,"proto":"tcp","label":"","count":3},{"port":7777,"proto":"tcp","label":"Oracle","count":3},{"port":3129,"proto":"tcp","label":"","count":3},{"port":10818,"proto":"tcp","label":"","count":3},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":3},{"port":1081,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-25","count":45},{"date":"2026-09-26","count":44},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T00:52:45","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"90b9b721-9499-4279-b6f1-720e14c767ee","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-27T00:52:45","port":3128,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"d3d3acc1-b0e5-4e5c-bab0-ca4ed335e28f","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-27T00:52:45","port":3128,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"efbae64c-0d2d-4a6d-90a5-71fd0934ab50","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-26T23:22:57","port":4145,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"e7102f0e-ca31-4ea1-bebd-28fd67d62113","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-26T23:22:57","port":4145,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"166e9fda-e272-4cb8-b76e-6cc08fe9d0f6","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-26T23:22:56","port":4145,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ad8f7cba-ceb3-4465-8457-54ed4e7a5b5f","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-26T21:16:05","port":1088,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"d328ff36-0203-4e99-89c0-251201cd2e99","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-26T21:16:05","port":1088,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d1e2995a-71b5-4fc7-8df1-726730cd21ab","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-26T21:16:04","port":1088,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"757279ef-8752-441b-9f07-2361bb4040ef","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-26T19:57:21","port":8118,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"f7dc9913-3e5f-44c1-8502-925311d34599","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}}],"http_methods":[],"distinct_ports_total":19,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T04:42:09.994459+00:00"}