{"ip":"42.119.26.249","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,334 bytes sent","bytes_sent":2334,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-24T06:07:19","last_seen":"2026-09-04T08:35:46","events_24h":0,"events_7d":0,"geo":{"country_code":"VN","country_name":"Vietnam","region":"Hanoi","city":"Hanoi","lat":21.0184,"lon":105.8461,"asn":18403,"org":"FPT Telecom Company"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as18403","label":"FPT Telecom","category":"isp","url":"https://www.peeringdb.com/asn/18403"},"cve_matches":[],"malware":[],"top_ports":[{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":18},{"port":1080,"proto":"tcp","label":"SOCKS","count":15},{"port":1081,"proto":"tcp","label":"","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"user_agents":["curl/8.14.1"],"timeline":[{"date":"2026-08-24","count":15},{"date":"2026-08-25","count":3},{"date":"2026-08-26","count":3},{"date":"2026-08-27","count":3},{"date":"2026-08-28","count":3},{"date":"2026-08-29","count":3},{"date":"2026-08-30","count":3},{"date":"2026-08-31","count":3},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":3},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":3}],"recent_events":[{"timestamp":"2026-09-04T08:35:46","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"ifconfig.co","headers":"{\"accept\":\"*/*\",\"host\":\"ifconfig.co\",\"proxy-connection\":\"Keep-Alive\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://ifconfig.co/","summary":"","payload_hex":"47455420687474703a2f2f6966636f6e6669672e636f2f20485454502f312e310d0a486f73743a206966636f6e6669672e636f0d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"8eec91bf-2568-4d11-b7c3-ce4156ac54a0","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-04T08:35:45","port":1081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"5bae75e0-1e1e-4d60-8357-a6afc7e2bacf","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-04T08:35:44","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"c69fea55-28f6-43a3-9f15-af99f3cdd92d","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-03T08:34:32","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"ifconfig.co","headers":"{\"accept\":\"*/*\",\"host\":\"ifconfig.co\",\"proxy-connection\":\"Keep-Alive\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://ifconfig.co/","summary":"","payload_hex":"47455420687474703a2f2f6966636f6e6669672e636f2f20485454502f312e310d0a486f73743a206966636f6e6669672e636f0d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"06a8da62-dd57-4381-a799-7898319b52e3","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T08:34:30","port":1081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"99e3fe2a-c57d-43a8-a7a9-1c267f3f20f0","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-03T08:34:29","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"93833df4-6ffd-4689-b821-2059d7c576c7","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-02T08:34:40","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"ifconfig.co","headers":"{\"accept\":\"*/*\",\"host\":\"ifconfig.co\",\"proxy-connection\":\"Keep-Alive\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://ifconfig.co/","summary":"","payload_hex":"47455420687474703a2f2f6966636f6e6669672e636f2f20485454502f312e310d0a486f73743a206966636f6e6669672e636f0d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"51596be0-a6a0-4026-ba9d-428e7aa61501","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-02T08:34:39","port":1081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"c3a75c01-fb12-4892-8120-3fb21e7f8446","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-02T08:34:37","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0001","payload_hex":"05020001","method":"","user_agent":"","ja3":"","session":"e6fc82c3-1ade-43ea-aa58-7801c0571c8a","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"f12c06571879e3ce","label":"SOCKS5"}},{"timestamp":"2026-09-01T08:34:45","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"ifconfig.co","headers":"{\"accept\":\"*/*\",\"host\":\"ifconfig.co\",\"proxy-connection\":\"Keep-Alive\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://ifconfig.co/","summary":"","payload_hex":"47455420687474703a2f2f6966636f6e6669672e636f2f20485454502f312e310d0a486f73743a206966636f6e6669672e636f0d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"78033b65-30c3-4ae8-bfd1-4ffaa5153f89","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78}],"http_methods":[{"method":"GET","count":18}],"distinct_ports_total":3,"top_paths":[{"path":"http://ifconfig.co/","count":18,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"ifconfig.co","count":18}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","Proxy-Connection","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"ifconfig.co","notable":false},{"name":"Proxy-Connection","value":"Keep-Alive","notable":false},{"name":"User-Agent","value":"curl/8.14.1","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-22T22:29:44.741977+00:00"}