{"ip":"45.194.67.8","total_events":499,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"other","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (other).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,052 bytes sent","bytes_sent":21052,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-10T09:22:35","last_seen":"2026-08-13T17:22:49","events_24h":0,"events_7d":468,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":["other"],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":1080,"proto":"tcp","label":"SOCKS","count":26},{"port":1081,"proto":"tcp","label":"","count":24},{"port":80,"proto":"tcp","label":"HTTP","count":23},{"port":9050,"proto":"tcp","label":"","count":21},{"port":10808,"proto":"tcp","label":"","count":21},{"port":1082,"proto":"tcp","label":"","count":18},{"port":5678,"proto":"tcp","label":"","count":18},{"port":4145,"proto":"tcp","label":"","count":18},{"port":8082,"proto":"tcp","label":"","count":15},{"port":9999,"proto":"tcp","label":"","count":15},{"port":8989,"proto":"tcp","label":"","count":15},{"port":4153,"proto":"tcp","label":"","count":15},{"port":8089,"proto":"tcp","label":"Splunk","count":15},{"port":443,"proto":"tcp","label":"HTTPS","count":13},{"port":7777,"proto":"tcp","label":"Oracle","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"ge11nn0400_17292dadbc7b":2848},"user_agents":["Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-07-10","count":13},{"date":"2026-07-11","count":4},{"date":"2026-07-17","count":8},{"date":"2026-08-01","count":6},{"date":"2026-08-09","count":126},{"date":"2026-08-10","count":33},{"date":"2026-08-11","count":6},{"date":"2026-08-12","count":168},{"date":"2026-08-13","count":135}],"recent_events":[{"timestamp":"2026-08-13T17:22:49","port":51549,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: prefilter\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a2070726566696c7465720d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"5d0f2b9f-e580-4a07-929d-18e388ca8fd6","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":11,"enriched":{"digest":"f2e68ed88d0fcefc","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: prefilter","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-08-13T17:22:49","port":51549,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0001\u0001\u0001\u0001\u0000","payload_hex":"040100500101010100","method":"","user_agent":"","ja3":"","session":"95aeb4da-19e6-458c-a946-a226cfba9a7e","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":11},{"timestamp":"2026-08-13T17:22:49","port":51549,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"de4539f1-ae4a-4694-8df3-34c4e51675ac","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":11,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-13T17:20:30","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: prefilter\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a2070726566696c7465720d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"ac8c97a4-697b-41b1-a754-03915b2fc0e7","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":11,"enriched":{"digest":"f2e68ed88d0fcefc","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: prefilter","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-08-13T17:20:30","port":8085,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0001\u0001\u0001\u0001\u0000","payload_hex":"040100500101010100","method":"","user_agent":"","ja3":"","session":"903b8c46-9f75-46b2-9815-dcdac991b71c","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":11},{"timestamp":"2026-08-13T17:20:29","port":8085,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"41442870-2dc9-4932-b8b7-987eb6d25777","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":11,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-13T17:12:25","port":84,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: prefilter\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a2070726566696c7465720d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d437342f-68df-4f9b-82a8-e1fb3bcb84fd","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":11,"enriched":{"digest":"f2e68ed88d0fcefc","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: prefilter","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}},{"timestamp":"2026-08-13T17:12:25","port":84,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0001\u0001\u0001\u0001\u0000","payload_hex":"040100500101010100","method":"","user_agent":"","ja3":"","session":"a29b0b22-7669-4b08-bfdb-c00a9eed0aa9","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":11},{"timestamp":"2026-08-13T17:12:25","port":84,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a4fc3f51-1a1f-4456-ac01-880391cbe28e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":11,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-13T17:10:32","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 1.1.1.1:443 HTTP/1.1\r\nHost: 1.1.1.1:443\r\nUser-Agent: prefilter\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420312e312e312e313a34343320485454502f312e310d0a486f73743a20312e312e312e313a3434330d0a557365722d4167656e743a2070726566696c7465720d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"f1af197e-1f2e-4f09-aecc-b09c39f688cc","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":11,"enriched":{"digest":"f2e68ed88d0fcefc","label":"HTTP","strings":["CONNECT 1.1.1.1:443 HTTP/1.1","Host: 1.1.1.1:443","User-Agent: prefilter","Proxy-Connection: keep-alive"],"iocs":{"ips":["1.1.1.1"]}}}],"http_methods":[{"method":"GET","count":17}],"distinct_ports_total":51,"top_paths":[{"path":"/","count":14,"ports":3},{"path":"/favicon.ico","count":3,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T07:44:12.382219+00:00"}