{"ip":"45.148.10.175","total_events":208,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"24+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 24 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"18,555 bytes sent","bytes_sent":18555,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T02:25:58","last_seen":"2026-09-20T17:19:41","events_24h":72,"events_7d":208,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2021-36260","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage"}],"malware":[],"top_ports":[{"port":3129,"proto":"tcp","label":"","count":20},{"port":8098,"proto":"tcp","label":"","count":12},{"port":8087,"proto":"tcp","label":"","count":12},{"port":8097,"proto":"tcp","label":"","count":12},{"port":3130,"proto":"tcp","label":"","count":12},{"port":8094,"proto":"tcp","label":"","count":12},{"port":8014,"proto":"tcp","label":"","count":12},{"port":8084,"proto":"tcp","label":"","count":12},{"port":8092,"proto":"tcp","label":"","count":12},{"port":8091,"proto":"tcp","label":"","count":12},{"port":8083,"proto":"tcp","label":"","count":8},{"port":8095,"proto":"tcp","label":"","count":8},{"port":8086,"proto":"tcp","label":"InfluxDB","count":8},{"port":8099,"proto":"tcp","label":"","count":8},{"port":8093,"proto":"tcp","label":"","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["pu11nn0800_0ce79bb8b53b","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"pu11nn0800_0ce79bb8b53b":1,"ge11nn0400_9c3956fad5da":1530},"user_agents":["Go-http-client/1.1","Mozilla/5.0"],"timeline":[{"date":"2026-09-16","count":16},{"date":"2026-09-18","count":40},{"date":"2026-09-19","count":92},{"date":"2026-09-20","count":60}],"recent_events":[{"timestamp":"2026-09-20T17:19:41","port":8016,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"38ca5d7f-255c-4b2b-bb8b-effa4f2375c2","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-20T17:19:41","port":8016,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"bcfb3fdb-d326-436a-b4de-fc4bde758825","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-09-20T17:19:40","port":8016,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ac06a05d-b89d-49b3-a395-05cf001d4e83","seq":1,"duration_ms":102,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-20T17:19:40","port":8016,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"5bae9db6-fded-4866-af77-e61d47ea1e6c","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-09-20T14:38:17","port":8013,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"7a11b200-4c17-4209-bb4d-3b2bb2aebdb8","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-09-20T14:38:17","port":8013,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ed607338-cab5-4e66-8221-d9bedd428a94","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-20T14:38:17","port":8013,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"5f83ec54-b943-44e2-bdc7-786522a352ce","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-20T14:38:17","port":8013,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"eb0a1d1b-9e69-4921-97c0-688a1ec504af","seq":1,"duration_ms":101,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-09-20T14:29:54","port":8014,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"proxy.flarevpn.digital","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://proxy.flarevpn.digital:8080/judge","summary":"","payload_hex":"47455420687474703a2f2f70726f78792e666c61726576706e2e6469676974616c3a383038302f6a7564676520485454502f312e310d0a486f73743a2070726f78792e666c61726576706e2e6469676974616c3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"88107aac-27df-4748-ad3b-a8d596198bad","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-09-20T14:29:54","port":8014,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"7bbf25f7-e0ca-48ac-81d4-442a0bea1345","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}}],"http_methods":[{"method":"GET","count":102},{"method":"PUT","count":4}],"distinct_ports_total":24,"top_paths":[{"path":"http://proxy.flarevpn.digital:8080/judge","count":102,"ports":22},{"path":"/SDK/webLanguage","count":4,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"proxy.flarevpn.digital","count":102}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"proxy.flarevpn.digital:8080","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[{"tag_id":"CVE-2021-36260","tag_type":"cve","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","reference_urls":["https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html","https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/","https://nvd.nist.gov/vuln/detail/CVE-2021-36260","https://github.com/Aiminsun/CVE-2021-36260","https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/"]}],"data_as_of":"2026-09-20T18:31:31.522372+00:00"}