{"ip":"94.154.43.15","total_events":176,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"25+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 25 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,213 bytes sent","bytes_sent":22213,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T13:32:08","last_seen":"2026-09-20T15:09:14","events_24h":36,"events_7d":176,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":7004,"proto":"tcp","label":"","count":15},{"port":7772,"proto":"tcp","label":"","count":14},{"port":6000,"proto":"tcp","label":"X11","count":14},{"port":7000,"proto":"tcp","label":"","count":14},{"port":7007,"proto":"tcp","label":"","count":14},{"port":4445,"proto":"tcp","label":"","count":10},{"port":8848,"proto":"tcp","label":"","count":10},{"port":1111,"proto":"tcp","label":"","count":8},{"port":1337,"proto":"tcp","label":"","count":8},{"port":7771,"proto":"tcp","label":"","count":8},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":7},{"port":8823,"proto":"tcp","label":"","count":6},{"port":1124,"proto":"tcp","label":"","count":6},{"port":3333,"proto":"tcp","label":"","count":6},{"port":1234,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":778,"ge11nn0400_9c3956fad5da":1530},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-09-15","count":23},{"date":"2026-09-16","count":61},{"date":"2026-09-17","count":20},{"date":"2026-09-18","count":24},{"date":"2026-09-19","count":24},{"date":"2026-09-20","count":24}],"recent_events":[{"timestamp":"2026-09-20T15:09:14","port":1122,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"256\u0000","payload_hex":"32353600","method":"","user_agent":"","ja3":"","session":"b596f607-faa4-4cc9-8ea8-893d1dbd21ab","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-20T15:09:14","port":1122,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�F�\u001e�\u0017�\"y��P�\fGL�ψF�V J�*[϶_ڤ\u0013�z�\u0002K�ʏ��9\u0014�᫫\u000b��Z\u0002�ڕ.\u0003�F���\fc\u0003��\u0017�-�y�\u001a�k\r\u0011K�}�\nH�N+b��ͻ2��s=a��SX�%U\bQ�\r�\u00128\u0011R$\t\u001c��6����\u0001�*��m\u0019�\u001c�R�� ;�D:Y�?1�\u0003�\u001di��N8\"7B����\b�;�\u001d0�4��������ا�\u001b\u001f}����Ŵ�$\u001a4ne�P\u0007��Be��>������Z�)s\u0003v�@�|&j#|+k'��%�\u0007i_\u001a!�\u0014��\u0018cJ����'e��","payload_hex":"f246ae1ee2179f2279849350a50c474cb3cf8846d156204ab02a5bcfb65fdaa413e87a99024be2ca8fd4d13914f5e1abab0baac15a02f2da952e03d746ba9cfc0c630389f617dd2dd579e81a816b0d114beb7dd00a48874e2b62fbf1cdbb329cea733d61fc855358ac25550851a80dc41238115224097f1cbb8b36b2aff6a101cc2af5826d19ef1cc852faeb203bf4443a59a43f31bf03a61d69d8e74e382237429ff7b9de08e23b9c1d30ec34f9c7f98ed6e7e1fdd8a7bf1b1f7dddc8c6ccc5b4fb241a346e65df500797844265879d3e9682e2e2f9895a9c29730376bc40887c266a237c2b6b2786cc259207695f1a21c014abae18634af9a1d0e72765c6f3","method":"","user_agent":"","ja3":"","session":"88de1f57-7697-4a4e-940a-e89e166d18df","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"446bb5ff37f7543a","strings":["N8\"7B","|&j#|+k'"]}},{"timestamp":"2026-09-20T13:41:48","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"256\u0000","payload_hex":"32353600","method":"","user_agent":"","ja3":"","session":"704bf653-3d7d-47c6-81a4-ef546c6cfea7","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-20T13:41:48","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�#>��/�q�eu\r;�^=%�`�g�f��3R\u001a��_�i�9�e�On\u0004��\"��z\u000e�����H{N \r�9Ɣ�\\)\"��f�1���\u001a>X�e�WA\b��\u0015WT�\u00040Fn����~c�U]9��`-U���f!9�Z�O�l�����Ҥ�c�\r���\u000b26\u001d���ۧ5�,���ДB\u00137����+BV\u0012\u001eC�%y\u0014\u0015i�\u0005&Ezh\nhlk�A��]�|*��t�Q�K���q�\r���_�.�*�`�����f91�\u0015�S_��h4q�f�3!�Qw\t��^q�(�?��LX","payload_hex":"f023ef9b8c3ef9922ff771a665750d3ba55e3d25ab609267fa6681f433521aeea7bc89f95f8769ea399065a44f6e049ffd22a4937a0ef2d6c8f8a2487b4e200dc139c694eb5c2922afcd66bf31f4b8f61a3e58d965bf57410894dd155754bf0430466eb8eef88b7e63a7555d39f6ba602d5597e885662139a65af54fe56c9af8aa9cdfd2a4ae63f50dafbee00b32361d91e8c6dba735b12cadfa92d0944213378bfadbe72b4256121e43c42579141569ce0526457a680a686c6bad41ae895da97c2abcb9748651c34bfb84c971e90d9ced9e5fec2ed42af26098cffffee7663931cf158e535f8fb0683471ab66e03321c2517709b3d35e71b028dd3f8bac4c58","method":"","user_agent":"","ja3":"","session":"a5d78610-a88b-4135-a96d-0147d59721df","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"399bca4c4fd2b65e","strings":["&Ezh"]}},{"timestamp":"2026-09-20T13:35:12","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"256\u0000","payload_hex":"32353600","method":"","user_agent":"","ja3":"","session":"83df0892-3ff7-4202-a3f1-f54b7d1b4c21","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-20T13:35:11","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0006���\u0011Sh�ة���FSr�\u0019-\\�\n��\u0002*-�D'�?��@\u0018M7\\\\��Q��?o���\n쐌Ч�^\u0013�(ж���2�,��/�oűw��Y\r����*�y��$^��\u0013��V�\u001f\u0012�0�ɫ�nS�6\u000b\t�%pb�\u000f\u000fu=%Cw�\t\u001e�6HF\t֪�o��\u001bi��|��pet���������\u0013�7�\u000f\u00069;\b�\u000b}�^�f~Y��SΟTL����A�2x\u00034APճx��Ɏ7���\u0013\n0\u0011�SO��<�Ԧ�\u0019�-\u001d3I���U�\u0011��\bŴ��/���\u000b$o��D\u0012G\u001a6","payload_hex":"c50693c9ea115368c0d8a9b384f2465372f6192d5ca20a98c5022a2ded4427883f979d40184d375c5ce7a951c0c83f6fb5e2ac0aec908cd0a7ab5e13be28d0b697a98c32b72cd0c12f9c6fc5b177f7d7590d82b1efdf2aab79a591247f5ee79b13d6ee56a61f12d930cfc9abe66e53ad360b09da257062fe0f0f753d254377c5091ee436484609d6aaa86f82c01b6991b07cd6d270657498def4eba0f1f691d013ff37840f06393b08dd0b7d8a5eeb667e59eba753ce9f544c959fbc8641da3278033441507fd5b378b0e1c98e37a9e0a9130a3011d6534f94e63cf2d4a6cd199f2d1d334994b2e6558511eaaf08c5b496822ff4baff0b246f9ba54412471a36","method":"","user_agent":"","ja3":"","session":"fd48fd85-0e64-4694-9aab-bc6d948b7974","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"2fb9682b188fffb5","strings":["M7\\\\","u=%Cw"]}},{"timestamp":"2026-09-20T12:13:10","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"256\u0000","payload_hex":"32353600","method":"","user_agent":"","ja3":"","session":"4a6d9883-0e88-48e3-9515-5ded0484f315","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-20T12:13:10","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"]>�$+�����\u001a�\u0018\u0015�v\u001f�۫\u0004��ʇt�\u001f��_G��\u0017E�!m8��Qf�\u0014�k^�]����:AyJJ)���k\u000b��\u000e&TD���)$@��Q��\u0002g\u0005���u���u\u001d�$)�1N��WA�K\u000bM����8��U>��.H�\u001e9S˔��cPQ,K(:�aEnA���\u0012�S��S(��[p�۽�F����$өX��\u001a.C$�f��ӞN\r�9�\\�S�z��\"ԟl�i�\"�� \u0004�j֠\u0002l��\u000eg\u0017Ǒ\\�F{\u000f��~55Z�BJ{m���\u0004�0\u0005����\u0012D&\u0018�o� \u001c^�","payload_hex":"5d3e91242ba9bc8289a11aac181590761fa5dbab04d1f5ca8774f31f88d65f47e3c71745a2216d38ed9d5166a014fe6b5edf5d98b48fab3a41794a4a298bf5a36b0bb6f70e265444948d8029244094ff51f5af026705afede775f1b6d6751db82429d8314ef9ee57419d4b0b4dc09c90f638abf9553e9fc12e48ce1e3953cb9481e86350512c4b283ad861456e41d2eabe1299539eb253289fa35b70cddbbde54690c1e7e924d3a958aed81a2e4324b566a8e6d39e4e0dcf39fe5ce353917afbbb22d49f6c9e69fb22b6d52004cc6ad6a0026cbfc50e6717c7915c92467b0fd1e47e35355ab0424a7b6d92c6ce04e130059dc7cdf4124426188f6fa1201c5ee3","method":"","user_agent":"","ja3":"","session":"67999bf5-7144-417e-a99d-8b32117dd595","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"4f83c99142d2e489","strings":[":AyJJ)","cPQ,K(:","aEnA","~55Z","BJ{m"]}},{"timestamp":"2026-09-20T09:19:23","port":8848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"256\u0000","payload_hex":"32353600","method":"","user_agent":"","ja3":"","session":"dde27165-3708-4076-8adc-64669fd04f56","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-20T09:19:23","port":8848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���eiG\u0017s�a\u0003R�A���5�‹�\u001b�\u0010�J�J�#�\u001b\u001b�\t\u0005���g�%kZuJ�\\�d\u001eL��� �צ���\u001b�O�5��\"w�@e�\u0006\u001d��.6\u001ef���ܒ-�:N\n��ۀ�4�O\\������\u0004kw�]F͒�1�A.���lL\u0001\u0017|\u000eE\u0003��\u0015��\u0013H�\\�MB����n�\u001c}ސLSuH)۾s`�w�H�V����O\\>+h\u001cA�|�(�\u001a\u0019���2�TP�\u0015�g�'�_��#\u001f\tG���\u001a��\u001cM�-��瘚\u000f��e\u0012\u0010��X�\u0005�ݥm�Ijx�5�E��^����N\u001c","payload_hex":"a38d806569471773ee610352ae41a0e1c035ebc28b971b9310f14ac24af123c31b1bf3090584f0f467b0256b5a754a865cb1641e4cf0ece220e9d7a6b8b0d01bb94fdb35e4822277f44065c2061dbb982e361e66c6e693dc922db63a4e0a9489db80d734864f5c8ebacdebe0cb046b77dc5d46cd92d131d6412ebea4ed6c4c01177c0e45039ce415f6cb1348b05caf4d42f8d7ceec6efa1c7dde904c53754829dbbe7360a477b148f756a0a6b7c54f5c3e2b681c41907ce528df1a1990d4e832b354508115cd67bd27e45f8ae7231f0947c1a7921ac7e31c4dbb2deee6e7989a0f99ff651210d9c2588f05bedda56d97496a78ae35814586fe5eb8abbeb04e1c","method":"","user_agent":"","ja3":"","session":"67ea43b3-e333-42a9-b951-cd6f91d51762","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":12,"enriched":{"digest":"5bb90bf39a118a38","strings":["%kZuJ","LSuH)","O\\>+h"]}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":25,"top_paths":[{"path":"http://ifconfig.me/ip","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"ifconfig.me","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-20T16:24:55.805132+00:00"}