{"ip":"37.27.223.28","total_events":37144,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"37,144 events across 5 port(s)","confidence":"high","network_type":"CDN","why":["37,144 requests against only 5 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"29,239,573 bytes sent","bytes_sent":29239573,"session_seconds":55,"persistent":false}},"first_seen":"2026-09-11T16:10:03","last_seen":"2026-09-11T16:12:37","events_24h":0,"events_7d":37144,"geo":{"country_code":"FI","country_name":"Finland","region":"Uusimaa","city":"Helsinki","lat":60.1719,"lon":24.9347,"asn":24940,"org":"Hetzner Online GmbH"},"source_domain":"static.28.223.27.37.clients.your-server.de","known_scanners":[],"scanner_tag":{"key":"hetzner","label":"Hetzner","category":"hosting_provider","url":"https://www.hetzner.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":9099,"proto":"tcp","label":"","count":26249},{"port":10507,"proto":"tcp","label":"","count":10892},{"port":28534,"proto":"tcp","label":"","count":1},{"port":41344,"proto":"tcp","label":"","count":1},{"port":17890,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0500_6e86fa5f9965"]},"fingerprint_peers":{"ge11nn0500_6e86fa5f9965":1},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-09-11","count":37144}],"recent_events":[{"timestamp":"2026-09-11T16:12:37","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"ed8da0e9-b68c-4cc7-ba90-5658c31c0b01","seq":1,"duration_ms":101,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:37","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"c7cecf7a-d567-4188-bb6d-bedd3706ef23","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:36","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"8770033d-41df-45ef-bd6d-9b96c49cec22","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:36","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 128.116.97.3:443 HTTP/1.1\r\nHost: 128.116.97.3:443\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLUFSLXNlc3Npb24tMzQ3Nzc1MDcxLXNlc3NUaW1lLTMtc2Vzc0F1dG8tMTptdWtjN3I1MGc1eg==\r\n\r\n","payload_hex":"434f4e4e454354203132382e3131362e39372e333a34343320485454502f312e310d0a486f73743a203132382e3131362e39372e333a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e3062323074636d566e615739754c5546534c584e6c63334e70623234744d7a51334e7a63314d4463784c584e6c63334e556157316c4c544d746332567a63304631644738744d5470746457746a4e3349314d47633165673d3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b16569c4-5d71-44af-9a43-5fb005296a3f","seq":1,"duration_ms":101,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"009ab8d9dea493d0","label":"HTTP","strings":["CONNECT 128.116.97.3:443 HTTP/1.1","Host: 128.116.97.3:443","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLUFSLXNlc3Npb24tM…"],"iocs":{"ips":["128.116.97.3"]}}},{"timestamp":"2026-09-11T16:12:35","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"0463562b-162e-42c9-9e2e-907140ee43e7","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:35","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"557d9e06-a039-43e0-9c26-49490ce999b5","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:34","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b314cc78-944c-407c-9abe-09f96ba6c4cc","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}},{"timestamp":"2026-09-11T16:12:33","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 128.116.5.3:443 HTTP/1.1\r\nHost: 128.116.5.3:443\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLUdCLXNlc3Npb24tMzQxNjQ2MzMyLXNlc3NUaW1lLTUtc2Vzc0F1dG8tMTptdWtjN3I1MGc1eg==\r\n\r\n","payload_hex":"434f4e4e454354203132382e3131362e352e333a34343320485454502f312e310d0a486f73743a203132382e3131362e352e333a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e3062323074636d566e615739754c5564434c584e6c63334e70623234744d7a51784e6a51324d7a4d794c584e6c63334e556157316c4c5455746332567a63304631644738744d5470746457746a4e3349314d47633165673d3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"53d2c748-577d-4740-83cc-10609481a978","seq":1,"duration_ms":100,"bytes_in":254,"bytes_out":12,"enriched":{"digest":"b3a22c9269d82e94","label":"HTTP","strings":["CONNECT 128.116.5.3:443 HTTP/1.1","Host: 128.116.5.3:443","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLUdCLXNlc3Npb24tM…"],"iocs":{"ips":["128.116.5.3"]}}},{"timestamp":"2026-09-11T16:12:33","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 91.108.56.182:443 HTTP/1.1\r\nHost: 91.108.56.182:443\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLU1FOm11a2M3cjUwZzV6\r\n\r\n","payload_hex":"434f4e4e4543542039312e3130382e35362e3138323a34343320485454502f312e310d0a486f73743a2039312e3130382e35362e3138323a3434330d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e3062323074636d566e615739754c5531464f6d313161324d33636a55775a7a56360d0a0d0a","method":"","user_agent":"","ja3":"","session":"6946a19e-1784-46d6-9c5f-c01c6c66a11c","seq":1,"duration_ms":100,"bytes_in":202,"bytes_out":12,"enriched":{"digest":"f9bb4a7600d7aa5a","label":"HTTP","strings":["CONNECT 91.108.56.182:443 HTTP/1.1","Host: 91.108.56.182:443","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b20tcmVnaW9uLU1FOm11a2M3cjUwZ…"],"iocs":{"ips":["91.108.56.182"]}}},{"timestamp":"2026-09-11T16:12:33","port":10507,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 15.204.122.200:80 HTTP/1.1\r\nHost: 15.204.122.200:80\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nProxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo=\r\n\r\n","payload_hex":"434f4e4e4543542031352e3230342e3132322e3230303a383020485454502f312e310d0a486f73743a2031352e3230342e3132322e3230303a38300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a50726f78792d417574686f72697a6174696f6e3a204261736963206247316e4d585a7963325974656d39755a53316a64584e306232303662585672597a64794e54426e4e586f3d0d0a0d0a","method":"","user_agent":"","ja3":"","session":"ed358c39-186a-4caa-89d4-e1eda340a8a9","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":12,"enriched":{"digest":"e4be380dbf200ca6","label":"HTTP","strings":["CONNECT 15.204.122.200:80 HTTP/1.1","Host: 15.204.122.200:80","Proxy-Connection: keep-alive","Connection: keep-alive","Proxy-Authorization: Basic bG1nMXZyc2Ytem9uZS1jdXN0b206bXVrYzdyNTBnNXo="],"iocs":{"ips":["15.204.122.200"]}}}],"http_methods":[{"method":"GET","count":3964}],"distinct_ports_total":5,"top_paths":[{"path":"http://35.223.193.241/claim/femboy.cat","count":3964,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"35.223.193.241","count":3964}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-13T23:13:01.545872+00:00"}