{"ip":"45.87.43.194","total_events":66,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,108 bytes sent","bytes_sent":5108,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-12T13:24:07","last_seen":"2026-08-28T03:20:44","events_24h":6,"events_7d":38,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":62068,"org":"SpectraIP B.V."},"source_domain":"45-87-43-194.static.spectraip.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as62068","label":"SpectraIP B.V.","category":"isp","url":"https://www.peeringdb.com/asn/62068"},"cve_matches":[],"malware":[],"top_ports":[{"port":1256,"proto":"tcp","label":"","count":10},{"port":1080,"proto":"tcp","label":"SOCKS","count":9},{"port":8787,"proto":"tcp","label":"","count":8},{"port":808,"proto":"tcp","label":"","count":4},{"port":3127,"proto":"tcp","label":"","count":4},{"port":18888,"proto":"tcp","label":"","count":4},{"port":3129,"proto":"tcp","label":"","count":4},{"port":180,"proto":"tcp","label":"","count":4},{"port":8082,"proto":"tcp","label":"","count":4},{"port":8081,"proto":"tcp","label":"","count":3},{"port":8880,"proto":"tcp","label":"","count":3},{"port":18080,"proto":"tcp","label":"","count":3},{"port":8800,"proto":"tcp","label":"","count":3},{"port":6379,"proto":"tcp","label":"Redis","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-12","count":3},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":3},{"date":"2026-08-15","count":3},{"date":"2026-08-16","count":4},{"date":"2026-08-17","count":3},{"date":"2026-08-20","count":4},{"date":"2026-08-21","count":4},{"date":"2026-08-22","count":4},{"date":"2026-08-23","count":4},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":10},{"date":"2026-08-26","count":8},{"date":"2026-08-27","count":4},{"date":"2026-08-28","count":6}],"recent_events":[{"timestamp":"2026-08-28T03:20:44","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 8.8.8.8:80 HTTP/1.1\r\nHost: 8.8.8.8:80\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420382e382e382e383a383020485454502f312e310d0a486f73743a20382e382e382e383a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"9e47e83f-0b5a-4bb7-8d10-134ad5f82001","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":12,"enriched":{"digest":"5cc3009ddbbf82fa","label":"HTTP","strings":["CONNECT 8.8.8.8:80 HTTP/1.1","Host: 8.8.8.8:80","User-Agent: Mozilla/5.0","Proxy-Connection: Keep-Alive"],"iocs":{"ips":["8.8.8.8"]}}},{"timestamp":"2026-08-28T03:20:44","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"dde9cd6b-0eb3-4b39-abba-205318f43a8e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-28T03:01:37","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 8.8.8.8:80 HTTP/1.1\r\nHost: 8.8.8.8:80\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420382e382e382e383a383020485454502f312e310d0a486f73743a20382e382e382e383a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"19348702-04fa-4e86-8d58-f468df0e67fa","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":12,"enriched":{"digest":"5cc3009ddbbf82fa","label":"HTTP","strings":["CONNECT 8.8.8.8:80 HTTP/1.1","Host: 8.8.8.8:80","User-Agent: Mozilla/5.0","Proxy-Connection: Keep-Alive"],"iocs":{"ips":["8.8.8.8"]}}},{"timestamp":"2026-08-28T03:01:37","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"1770dab5-472a-4c49-8338-6fbabe3342c8","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-28T02:44:31","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 8.8.8.8:80 HTTP/1.1\r\nHost: 8.8.8.8:80\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420382e382e382e383a383020485454502f312e310d0a486f73743a20382e382e382e383a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"e9d1f1ae-dd29-4860-97e9-bfef356ee260","seq":1,"duration_ms":101,"bytes_in":104,"bytes_out":12,"enriched":{"digest":"5cc3009ddbbf82fa","label":"HTTP","strings":["CONNECT 8.8.8.8:80 HTTP/1.1","Host: 8.8.8.8:80","User-Agent: Mozilla/5.0","Proxy-Connection: Keep-Alive"],"iocs":{"ips":["8.8.8.8"]}}},{"timestamp":"2026-08-28T02:44:30","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"e0fa5de4-2008-4bb8-97cf-979726903d2f","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-27T01:47:39","port":8082,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"97748540-2dc9-468b-8f68-fc21f5d314fb","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-27T01:47:37","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 8.8.8.8:80 HTTP/1.1\r\nHost: 8.8.8.8:80\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420382e382e382e383a383020485454502f312e310d0a486f73743a20382e382e382e383a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"b3e728e6-c4c7-432b-89f6-9d4f47c84e2f","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":12,"enriched":{"digest":"5cc3009ddbbf82fa","label":"HTTP","strings":["CONNECT 8.8.8.8:80 HTTP/1.1","Host: 8.8.8.8:80","User-Agent: Mozilla/5.0","Proxy-Connection: Keep-Alive"],"iocs":{"ips":["8.8.8.8"]}}},{"timestamp":"2026-08-27T01:46:40","port":8082,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"6b45c0ee-ba5a-455b-9a94-0e79c283f93f","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":12,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-27T01:46:38","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT 8.8.8.8:80 HTTP/1.1\r\nHost: 8.8.8.8:80\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420382e382e382e383a383020485454502f312e310d0a486f73743a20382e382e382e383a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"7c1bfecd-fbdc-4cdf-80b8-81498eaed501","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":12,"enriched":{"digest":"5cc3009ddbbf82fa","label":"HTTP","strings":["CONNECT 8.8.8.8:80 HTTP/1.1","Host: 8.8.8.8:80","User-Agent: Mozilla/5.0","Proxy-Connection: Keep-Alive"],"iocs":{"ips":["8.8.8.8"]}}}],"http_methods":[],"distinct_ports_total":14,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-28T16:13:16.533352+00:00"}