{"ip":"93.152.209.11","total_events":1,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["1 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"263 bytes sent","bytes_sent":263,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T20:53:15","last_seen":"2026-09-23T20:53:15","events_24h":0,"events_7d":0,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":58215,"org":"Omniline Investment s.r.o."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1516h2_8daaf6152771_02713d6af862"],"tls_client_hello":"160301023b010002370303e224765a6cd118ba6d29e162b71ef8a27b47381f22c9bc82ac01d8370e9deb3120f0000282bd4e5ef9dd9919836dbeb2640fa84be143bc04b5c2ee74acd59db4ed00200a0a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010001cedada00000000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465fe0d00fa00000100019f0020ac8e33fe777024cfe2093f97d38ef2af57e9fdf867052ef573ca65a3c6b0651d00d016a673e294fa152bea1240e380afcc1bc1708c2df8bfb660b7cca2ff30b19dbaa1c190fcbe3515fc1a518d5b8a28abe945f3af5dba16b1fb9b3f022d34cc6341e2efd4218e850b02dee90f128a108093439790587d41011e62511cf4c33f5ff174f58aff0b1d1f5ba130b923eb89ea4f2a1f89fbe387d73dbce465d137c5fcdc685fe85712537d3f6114b5f90f68fac9897410c047e1239b343d158138edeaed766b48dcf9ab64d5fd81dc48e90aae553d4aa27bcbef1f6c9401383cd469e48a89cfa2ca22ff5afd6da35fa4634fe1c9000a000a00089a9a001d00170018000d0012001004030804040105030805050108060601ff010001000033002b00299a9a000100001d0020b811564df7e5178ef33832009274437a22d0360e838e74fadcb21bb95585583d0010000e000c02683208687474702f312e31000500050100000000001b0003020002000b00020100446900050003026832002d00020101002b0007068a8a030403030017000000120000002300009a9a0001","tls_ja3":["8e7e20c2f6bf98f82c37a1c9772f2cc7"],"http_akin":["b11cun040_0004001c_c1ec5a86"]},"fingerprint_peers":{"t13d1516h2_8daaf6152771_02713d6af862":1,"b11cun040_0004001c_c1ec5a86":1},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T20:53:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"host\":\"pihole.chicago.vpnigo.de:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64653a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"8e7e20c2f6bf98f82c37a1c9772f2cc7","session":"626ca1fc-f916-4ec9-a420-d69041c10350","seq":1,"duration_ms":101,"bytes_in":263,"bytes_out":78}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":1}],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,*/*","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de:443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-01T14:44:34.886728+00:00"}