{"ip":"139.162.88.198","total_events":237,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["237 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 24,290 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"24,290 bytes sent","bytes_sent":24290,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-07T20:05:20","last_seen":"2026-09-18T13:35:11","events_24h":0,"events_7d":11,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"li1568-198.members.linode.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":237}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i141000_cbb2034c60b8_e5728521abd4"],"tls_ja3":["2079bcc000c9a54e0784733c0142d140"],"ja4h":[]},"fingerprint_peers":{"t13i141000_cbb2034c60b8_e5728521abd4":10},"user_agents":[],"timeline":[{"date":"2026-07-07","count":3},{"date":"2026-07-08","count":13},{"date":"2026-07-09","count":9},{"date":"2026-07-10","count":9},{"date":"2026-07-11","count":9},{"date":"2026-07-12","count":8},{"date":"2026-07-13","count":5},{"date":"2026-07-14","count":11},{"date":"2026-07-15","count":8},{"date":"2026-07-16","count":8},{"date":"2026-07-17","count":7},{"date":"2026-07-18","count":8},{"date":"2026-07-22","count":3},{"date":"2026-07-23","count":1},{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":8},{"date":"2026-07-28","count":8},{"date":"2026-07-29","count":5},{"date":"2026-07-30","count":4},{"date":"2026-07-31","count":1},{"date":"2026-08-01","count":5},{"date":"2026-08-02","count":7},{"date":"2026-08-03","count":7},{"date":"2026-08-04","count":8},{"date":"2026-08-05","count":9},{"date":"2026-08-06","count":10},{"date":"2026-08-11","count":7},{"date":"2026-08-13","count":1},{"date":"2026-08-14","count":2},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":2},{"date":"2026-08-17","count":2},{"date":"2026-08-19","count":2},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":4},{"date":"2026-08-22","count":1},{"date":"2026-08-24","count":3},{"date":"2026-08-25","count":1},{"date":"2026-08-27","count":4},{"date":"2026-08-29","count":3},{"date":"2026-09-06","count":3},{"date":"2026-09-07","count":4},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":4},{"date":"2026-09-12","count":1},{"date":"2026-09-14","count":2},{"date":"2026-09-16","count":3},{"date":"2026-09-17","count":4},{"date":"2026-09-18","count":2}],"recent_events":[{"timestamp":"2026-09-18T13:35:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}\r\nContent-Length: 18446744073709551615\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a207b35613433333233382d383738312d313165332d623265342d346536643631373032317d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a0d0a","method":"","user_agent":"","ja3":"2079bcc000c9a54e0784733c0142d140","session":"939ebb0e-4312-4875-aeca-e2bd8ed4f27a","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":14,"enriched":{"digest":"75edd61f60ec3a8a","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}","Content-Length: 18446744073709551615"]}},{"timestamp":"2026-09-18T13:35:11","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8M<\u0017{{��I\u0000\u0000\u0000\u0001\u0000","payload_hex":"000e384d3c177b7b96c2490000000100","method":"","user_agent":"","ja3":"","session":"0d36ec85-d3d3-4806-97e0-e0719d897f1c","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14},{"timestamp":"2026-09-17T10:52:25","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}\r\nContent-Length: 18446744073709551615\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a207b35613433333233382d383738312d313165332d623265342d346536643631373032317d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a0d0a","method":"","user_agent":"","ja3":"2079bcc000c9a54e0784733c0142d140","session":"8cdf8a9d-c458-43e1-9372-7034786b175d","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":14,"enriched":{"digest":"75edd61f60ec3a8a","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}","Content-Length: 18446744073709551615"]}},{"timestamp":"2026-09-17T10:52:24","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�\u000e��V߈E\u0000\u0000\u0000\u0001\u0000","payload_hex":"000e38970e809856df88450000000100","method":"","user_agent":"","ja3":"","session":"00e5d6c4-0d2e-49cc-9400-eae3cd070730","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14},{"timestamp":"2026-09-17T02:45:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}\r\nContent-Length: 18446744073709551615\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a207b35613433333233382d383738312d313165332d623265342d346536643631373032317d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a0d0a","method":"","user_agent":"","ja3":"2079bcc000c9a54e0784733c0142d140","session":"c629ab4c-d1d1-43b4-b174-0af51ef9876b","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":14,"enriched":{"digest":"75edd61f60ec3a8a","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}","Content-Length: 18446744073709551615"]}},{"timestamp":"2026-09-17T02:45:08","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8/{�\u0002q�Э\u0000\u0000\u0000\u0001\u0000","payload_hex":"000e382f7bfb0271a6d0ad0000000100","method":"","user_agent":"","ja3":"","session":"bb85dfaf-8f95-4778-b349-9f1d59870cea","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14},{"timestamp":"2026-09-16T21:48:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}\r\nContent-Length: 18446744073709551615\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a207b35613433333233382d383738312d313165332d623265342d346536643631373032317d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a0d0a","method":"","user_agent":"","ja3":"2079bcc000c9a54e0784733c0142d140","session":"156e0027-ba11-4071-be28-e206f180c012","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":14,"enriched":{"digest":"75edd61f60ec3a8a","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}","Content-Length: 18446744073709551615"]}},{"timestamp":"2026-09-16T21:48:38","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8����#'�Z\u0000\u0000\u0000\u0001\u0000","payload_hex":"000e38c0a5f9ed2327fa5a0000000100","method":"","user_agent":"","ja3":"","session":"e45b33b0-ba3c-495c-90bf-e8ed97e57d4d","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14},{"timestamp":"2026-09-16T14:03:11","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�l\u0012\\M�SL\u0000\u0000\u0000\u0001\u0000","payload_hex":"000e38e66c125c4dd5534c0000000100","method":"","user_agent":"","ja3":"","session":"056ece9d-a452-42d2-b3ce-b5f407dfeb71","seq":1,"duration_ms":101,"bytes_in":16,"bytes_out":14},{"timestamp":"2026-09-14T00:24:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}\r\nContent-Length: 18446744073709551615\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a207b35613433333233382d383738312d313165332d623265342d346536643631373032317d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a0d0a","method":"","user_agent":"","ja3":"2079bcc000c9a54e0784733c0142d140","session":"611a2a69-3bf4-400b-ab5d-de8780630b2a","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":14,"enriched":{"digest":"75edd61f60ec3a8a","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: {5a433238-8781-11e3-b2e4-4e6d617021}","Content-Length: 18446744073709551615"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-19T15:17:22.768503+00:00"}