{"ip":"80.97.124.197","total_events":228,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"28+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 28 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,566 bytes sent","bytes_sent":17566,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T14:01:47","last_seen":"2026-09-27T01:31:29","events_24h":0,"events_7d":228,"geo":{"country_code":"MD","country_name":"Moldova","region":"Chișinău Municipality","city":"Chisinau","lat":47.0042,"lon":28.8574,"asn":200019,"org":"Alexhost Srl"},"source_domain":"post1.vidieu.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as200019","label":"AlexHost","category":"enterprise","url":"https://www.peeringdb.com/asn/200019"},"cve_matches":[],"malware":[],"top_ports":[{"port":4153,"proto":"tcp","label":"","count":17},{"port":8181,"proto":"tcp","label":"","count":15},{"port":1080,"proto":"tcp","label":"SOCKS","count":14},{"port":9050,"proto":"tcp","label":"","count":11},{"port":1081,"proto":"tcp","label":"","count":11},{"port":8989,"proto":"tcp","label":"","count":10},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8082,"proto":"tcp","label":"","count":9},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8090,"proto":"tcp","label":"","count":9},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":9},{"port":10808,"proto":"tcp","label":"","count":8},{"port":10818,"proto":"tcp","label":"","count":8},{"port":8081,"proto":"tcp","label":"","count":8},{"port":1088,"proto":"tcp","label":"","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_0000004a_c91eaf54"]},"fingerprint_peers":{"a11cun030_0000004a_c91eaf54":235},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":3,"ips":235}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"timeline":[{"date":"2026-09-24","count":180},{"date":"2026-09-25","count":15},{"date":"2026-09-26","count":30},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T01:31:29","port":1081,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"c2008a94-43e7-4d1b-b1bc-c6769c866c3c","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-27T01:31:29","port":1081,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"c1cbe1fe-334a-4e7a-8884-c32b3ba82b8a","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-27T01:31:29","port":1081,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"db607b96-16f5-420c-86f7-6fb751a6add2","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-26T22:30:23","port":9050,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"8e77646b-19a3-4938-a0a1-febb33a2380a","seq":1,"duration_ms":101,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-26T22:30:22","port":9050,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"44cb46a9-d426-46f1-a869-4b2bd010cc6e","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-26T22:30:22","port":9050,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"1fb10fe1-84f8-4420-8b9a-cd1c932f85f1","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-26T19:50:58","port":4153,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"fbb6fef5-88e2-4370-ace9-50fc677f6b14","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-26T19:50:58","port":4153,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"9b0cb544-2f28-4081-afc7-1d50ca8dc2b7","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":13,"enriched":{"digest":"c9a672896fdd635e","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-26T19:50:57","port":4153,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"f598cadc-8daa-49d2-83aa-17b94d4728d9","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-26T19:50:27","port":4153,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�\u0001\u0001\u0001\u0001\u0000","payload_hex":"040101bb0101010100","method":"","user_agent":"","ja3":"","session":"2928952f-bc8f-48e0-86c8-90d5e4feecd7","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13}],"http_methods":[{"method":"GET","count":26}],"distinct_ports_total":28,"top_paths":[{"path":"http://api.ipify.org/","count":26,"ports":25}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":26}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T14:55:57.820842+00:00"}