{"ip":"94.228.213.11","total_events":4151,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"4,151 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["4,151 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"369,439 bytes sent","bytes_sent":369439,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-22T15:26:58","last_seen":"2026-08-22T18:43:48","events_24h":0,"events_7d":4151,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":6206,"org":"Netrouting B.V."},"source_domain":"ip4-94-228-213-11.rdns.netrouting.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as6206","label":"Netrouting","category":"isp","url":"https://www.peeringdb.com/asn/6206"},"cve_matches":[],"malware":[],"top_ports":[{"port":7928,"proto":"tcp","label":"","count":4151}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-22","count":4151}],"recent_events":[{"timestamp":"2026-08-22T18:43:48","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"f00f865a-9f7b-48c6-abed-e7eb3a371b03","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:48","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d93fe728-ef9a-4f8a-8614-365a3929235a","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:47","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"dfbf2a1a-7db6-4c99-8a39-09f2010a64ab","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:45","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"438cf5e3-5398-429b-bbcf-30132933ce09","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:45","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"d7fce241-aca5-4f77-b97f-ba47f3762b13","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:41","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"ed54fbb2-0ee3-431e-9947-005cedf9ac31","seq":1,"duration_ms":101,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:40","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"6ca1a9ca-a927-482e-a47c-9f182d5f8250","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:39","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"47016b75-6369-4186-a4d5-df4e8539ed65","seq":1,"duration_ms":101,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:38","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"5341c2a9-e412-4d58-a69c-f3ea74c8dc59","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}},{"timestamp":"2026-08-22T18:43:36","port":7928,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT l.9crbbb.cc:999 HTTP/1.1\r\nHost: l.9crbbb.cc:999\r\nProxy-Connection: Keep-Alive\r\n\r\n","payload_hex":"434f4e4e454354206c2e3963726262622e63633a39393920485454502f312e310d0a486f73743a206c2e3963726262622e63633a3939390d0a50726f78792d436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"e5c85962-887a-4f7e-b69f-7a8dd0c3cafc","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":13,"enriched":{"digest":"6fbbd6bb2a311987","label":"HTTP","strings":["CONNECT l.9crbbb.cc:999 HTTP/1.1","Host: l.9crbbb.cc:999","Proxy-Connection: Keep-Alive"],"iocs":{"domains":["l.9crbbb.cc"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-24T11:05:34.706317+00:00"}