{"ip":"5.255.97.75","total_events":252,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"32+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 32 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,332 bytes sent","bytes_sent":10332,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-08T19:16:36","last_seen":"2026-08-12T00:06:28","events_24h":0,"events_7d":252,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Flevoland","city":"Dronten","lat":52.5378,"lon":5.6966,"asn":60404,"org":"The Infrastructure Group B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as60404","label":"LiteServer","category":"isp","url":"https://www.peeringdb.com/asn/60404"},"cve_matches":[],"malware":[],"top_ports":[{"port":1080,"proto":"tcp","label":"SOCKS","count":8},{"port":8899,"proto":"tcp","label":"","count":8},{"port":1082,"proto":"tcp","label":"","count":8},{"port":888,"proto":"tcp","label":"","count":8},{"port":1081,"proto":"tcp","label":"","count":8},{"port":3333,"proto":"tcp","label":"","count":8},{"port":10001,"proto":"tcp","label":"","count":8},{"port":7777,"proto":"tcp","label":"Oracle","count":8},{"port":18888,"proto":"tcp","label":"","count":8},{"port":9999,"proto":"tcp","label":"","count":8},{"port":1111,"proto":"tcp","label":"","count":8},{"port":8082,"proto":"tcp","label":"","count":8},{"port":10808,"proto":"tcp","label":"","count":8},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":8},{"port":8889,"proto":"tcp","label":"","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-08","count":126},{"date":"2026-08-11","count":62},{"date":"2026-08-12","count":64}],"recent_events":[{"timestamp":"2026-08-12T00:06:28","port":18888,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"2f4008bf-492f-4932-a771-74aae9765053","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":11,"enriched":{"digest":"7118bc77c8c0bfa6","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","Connection: close"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-12T00:06:28","port":18888,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"40f35c18-d1d2-4ade-851c-a40f0976ba26","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":11,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-12T00:06:26","port":20000,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"a245bc43-c9ee-432b-932c-91db5eb32742","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":11,"enriched":{"digest":"7118bc77c8c0bfa6","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","Connection: close"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-12T00:06:26","port":20000,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"4ac2780a-d66c-4c32-9951-53ea4cf2292b","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":11,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-12T00:06:26","port":12345,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"cb8ae960-44d1-4476-b078-fb9f66a5f916","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":11,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-12T00:06:26","port":12345,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"e9e54223-6424-417c-86be-c511b374f847","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":11,"enriched":{"digest":"7118bc77c8c0bfa6","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","Connection: close"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-12T00:06:26","port":10809,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"668f905e-aa1c-4ce6-b3b5-89afe25cd2f8","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":11,"enriched":{"digest":"7118bc77c8c0bfa6","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","Connection: close"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-12T00:06:26","port":10809,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"e09c30ae-2883-413c-86ca-175092725c46","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":11,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}},{"timestamp":"2026-08-12T00:06:26","port":10808,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\nConnection: close\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"5b2cf869-fe0c-40c7-aaf1-cf639549befb","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":11,"enriched":{"digest":"7118bc77c8c0bfa6","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443","Connection: close"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-12T00:06:26","port":10808,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"a1529b30-7dd2-48a1-9435-99d45f976611","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":11,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}}],"http_methods":[],"distinct_ports_total":32,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T11:40:17.871142+00:00"}