[
  {"source_ip": "185.100.87.136", "asn": 200651, "asn_org": "FlokiNET ehf", "country_code": "RO", "tor_exit": true,
   "window": "2026-08-17..2026-08-24", "event_count": 11,
   "behaviors": [
     {"method": "POST", "path": "/api/checkin", "port": 8443, "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "ja4h": "po11nn0500_e4a47a99f1ac", "count": 3, "note": "JSON body 26 bytes, cache-control no-cache"},
     {"method": "GET", "path": "/images/transparentpix.gif", "port": 443, "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", "ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "ja4h": "ge11nn0400_88d30a62b7ad", "count": 3, "note": "tracking-pixel style beacon over TLS 1.3 ChaCha20"},
     {"method": "GET", "path": "/", "port": 444, "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0", "count": 1},
     {"method": "raw", "path": "", "port": 443, "payload": "\\u0010 \\u0000\\u0000BBBB...DAAA", "count": 3, "note": "16-byte binary probes, no app protocol"},
     {"method": "raw", "path": "", "port": 443, "payload": "93-byte binary", "count": 1}
   ],
   "timestamps": {"first": "2026-08-18T07:43:51", "last": "2026-08-23T21:14:50"}}
]