{"ip":"94.154.43.126","total_events":146,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["146 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 19,233 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,233 bytes sent","bytes_sent":19233,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-24T22:47:34","last_seen":"2026-09-18T17:25:20","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":41},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":38},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":16},{"port":7681,"proto":"tcp","label":"","count":16},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":12},{"port":1080,"proto":"tcp","label":"SOCKS","count":12},{"port":60001,"proto":"tcp","label":"","count":8},{"port":10554,"proto":"tcp","label":"","count":2},{"port":81,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun030_00040410_e62b6d85","b11cun103_50340011_f5d02f95_x9f62a4acfdb1"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":657,"b11cun030_00040012_13ee3d34":5053,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":22,"b11cun030_00040410_e62b6d85":20},"akin_families":{"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":{"head":"b11cun103_50340011_f5d02f95_x9f62a4acfdb1","shapes":2,"ips":22}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":41},{"date":"2026-08-26","count":28},{"date":"2026-08-27","count":4},{"date":"2026-08-31","count":4},{"date":"2026-09-01","count":6},{"date":"2026-09-08","count":17},{"date":"2026-09-09","count":14},{"date":"2026-09-10","count":1},{"date":"2026-09-11","count":13},{"date":"2026-09-12","count":2},{"date":"2026-09-16","count":2},{"date":"2026-09-18","count":12}],"recent_events":[{"timestamp":"2026-09-18T17:25:20","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"9e548f9f-6cee-4678-bf28-73116457a410","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T17:25:20","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"8907a47c-53d5-4e4c-a240-e51d6eed487a","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T17:00:32","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"4d871e08-b802-4f9e-aeb6-c12f92e1ff69","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T17:00:32","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"38f5aca1-c2ab-4f57-acbe-d8caa361228c","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T16:21:28","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"ba65116d-3bc0-4eb1-bb20-a577c92f316a","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T16:21:28","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d57b1963-361f-413b-9dab-4aaf51c0c2e3","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T16:06:20","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"a8d4dfac-7a98-4fd8-9351-6b849d4c36d2","seq":1,"duration_ms":101,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T16:06:19","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d9269a84-8446-448c-80a6-e8757ad27f39","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T15:52:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"9863f889-f72c-4b98-b08e-cfd993643f40","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}},{"timestamp":"2026-09-18T15:52:36","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT cloudflare.com:443 HTTP/1.1\r\nHost: cloudflare.com:443\r\nConnection: keep-alive\r\n\r\n","payload_hex":"434f4e4e45435420636c6f7564666c6172652e636f6d3a34343320485454502f312e310d0a486f73743a20636c6f7564666c6172652e636f6d3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"03e7b358-cfc6-48a6-b2d9-ef60b023c1ea","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"b814b5c6e09ae894","label":"HTTP","strings":["CONNECT cloudflare.com:443 HTTP/1.1","Host: cloudflare.com:443","Connection: keep-alive"],"iocs":{"domains":["cloudflare.com"]}}}],"http_methods":[{"method":"GET","count":38}],"distinct_ports_total":9,"top_paths":[{"path":"/ws","count":16,"ports":1},{"path":"/","count":11,"ports":3},{"path":"/login","count":11,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-01T19:35:25.151755+00:00"}