{"ip":"3.235.242.84","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"771 bytes sent","bytes_sent":771,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T04:15:59","last_seen":"2026-09-24T04:15:59","events_24h":3,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"ec2-3-235-242-84.compute-1.amazonaws.com","known_scanners":[],"scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1114h2_5e2a75874763_89e9e4bb3419"],"tls_client_hello":"16030301b1010001ad03037541815ec8acd7dcc5f4f7075a3e1aa1b4f6e40290e21722ef81c15db56e04ef204444b761484ce7faa440be75034361df04b2d1e79789f1285d612a6903e0061e0016130113021303c02bc02fc02cc030cca9cca8c013c0140100014e0000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000500050100000000000a00160014001d001700180019001e01000101010201030104000b000201000010000e000c02683208687474702f312e31001100090007020004000000000017000000230000000d00260024040305030603080708080804080508060809080a080b0401050106010402030303010302002b00050403040303002d000201010032002c002a040305030603080708080804080508060809080a080b04010501060104020303030103020203020102020033006b0069001d0020d31d06f5f7c7d1c67577f1e354e1cb8115cc8181afb5de65fedf72e007cbd3280017004104adc8bd19c634686dba7b8d57168166f6ecd359ebb135541fdd1863aaa59fca51a9f3723ac1cc793535e8f475266f6ff7e39dfc9d634b878fd88bbb66770f8640ff010001","tls_ja3":["0a80f68631b6e8b4634dbc261e8ba60b"],"http_akin":["a11cun040_0000004e_9a433d6e"]},"fingerprint_peers":{"t13d1114h2_5e2a75874763_89e9e4bb3419":3,"a11cun040_0000004e_9a433d6e":3},"akin_families":{},"user_agents":["okhttp/5.3.0"],"timeline":[{"date":"2026-09-24","count":3}],"recent_events":[{"timestamp":"2026-09-24T04:15:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"okhttp/5.3.0\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f352e332e300d0a0d0a","method":"GET","user_agent":"okhttp/5.3.0","ja3":"0a80f68631b6e8b4634dbc261e8ba60b","session":"4432c6f5-b47a-4b61-85bf-ce68961ad7f8","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":77},{"timestamp":"2026-09-24T04:15:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"okhttp/5.3.0\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f352e332e300d0a0d0a","method":"GET","user_agent":"okhttp/5.3.0","ja3":"0a80f68631b6e8b4634dbc261e8ba60b","session":"4432c6f5-b47a-4b61-85bf-ce68961ad7f8","seq":2,"duration_ms":250,"bytes_in":257,"bytes_out":154},{"timestamp":"2026-09-24T04:15:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"okhttp/5.3.0\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.png","summary":"","payload_hex":"474554202f66617669636f6e2e706e6720485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f352e332e300d0a0d0a","method":"GET","user_agent":"okhttp/5.3.0","ja3":"0a80f68631b6e8b4634dbc261e8ba60b","session":"4432c6f5-b47a-4b61-85bf-ce68961ad7f8","seq":3,"duration_ms":380,"bytes_in":391,"bytes_out":231}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/favicon.png","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":3}],"top_alpns":[{"value":"h2, http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"okhttp/5.3.0","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-24T14:28:14.148610+00:00"}