{"ip":"143.198.238.185","data_as_of":"2026-10-26T10:42:28+00:00","observed":true,"total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["12 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 2 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"884 bytes sent","bytes_sent":884,"session_seconds":8,"persistent":false},"basis":"combined"},"first_seen":"2026-08-12T15:39:17","last_seen":"2026-10-25T00:37:42","events_24h":0,"events_7d":1,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"rdp","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3931,"lon":-121.962,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-18T06:44:45","last_seen":"2026-10-18T06:44:53","verdicts":[{"verdict":"scan","sessions":1},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"rdp@Windows Server 2019","sessions":2}],"services":[{"protocol":"rdp","port":3389,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":3390,"proto":"tcp","label":"","count":3,"sessions":0},{"port":3389,"proto":"tcp","label":"RDP","count":1,"sessions":2},{"port":22249,"proto":"tcp","label":"","count":1,"sessions":0},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":0},{"port":29840,"proto":"tcp","label":"","count":1,"sessions":0},{"port":29842,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105de010005da0303689e163e593303a3f7200a2fa0abe9ab028bc286cee185e161c03092be33ade5207a8e05108aa43643ec7847e68e74fe506c8ca02993b5ee7c160e89ef55aa37ec0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c088a578263c60202a648205522543bbc00a9e011c1925a03a81901e5933bd91843b5929225a33b15a4c99f10a1b38929b84b79864090ca8fb5646430e8a75c87711a0bf1014479400305714ef368825d9828b102ea73cc90c522db5073190808633706b18abb36a99117d05b2df860787365ce719c5c3f9bdd406b4f262cafa84332bf8a38be0cdcaac81a85c5ffc2a331d013c0ad9091d76c0ec4a2c050102f343ca897486469ca0f940197c6398c9f5958ed22d4be859736c24ce144c414a308ae22c489c9c2d404e6b373e5e602629ea6ec74b7000aa26227415d918c412a679b6f8a89e4369f0b730844069f57b64b72a61d9a29d9f27c98860030fd6163e42025a3a33f6b03a4013bc2c4c53d99079606baf1d0792025a4a07474861cc159925a6f5f26b18c82f743b4337961c5a273716c5423d78aff6aa1be07302421765cf9a77741217b5bca2457818dd5b1805939016719cb1a752b0e482cc349d5aa247ae2390f4ccccc1ca0032976611e18186d28b7a69cbce6a1f73c1759b378427f92d457c464bd0620b48b4cdd676c3b32ecf75bbbca8040e694e542a9f93d31b848088539bc26446af537528aff8bdac1b616b8cc272174e01b7068228018d67cce7705b66f299dba33b235ca830b021d43982898c4043b462ef040d94554aa94a8dc67144ae336cb30201c5bc5a9e17016866097a1c5b12529c7aa21e0a5869e8eb8dfc60524bccc30008c762cc1e9312b1196c8e142370b7f172c6a6204dd32340ca577399bb15bb29c462c52775a35d89caefa120483b9f19c7cea159b1957400242015d162c200d2b34e0311096caa9390c17481c026dbc9d463be4dc2c32a307441c55f8f2c22c9192ca1f46cd7c07eb2138f0bb82b7561c19f4b58fbd94824d721c680017f2b420ed83ae11996019087f9391d26c749ed1750b88b9a83531a23019463504661586d2496c4cd0399717ab622307122b6ca23661ea0b605d4ba3bbcf5291ff1b598abaf45c51aa2bb51e6256ba55a9f8946bf5ddcc6764b97de85af668594662a94bd451869766ed8ac58b95c922e3382c6b54e78935501d4961e05c4cc4380a8f9c5f8d3551469bd4849c389eb2a6a97b268952411650a8ec5979284a461da0e37db30ca23801472c3d18c61e365b187896444dba26b565519aa685197204eb12e7c268923c837dc9b9d6a03bb96d45c2f413f0a23af76a499c995c565d459d09ba2d0fa6064c802fa402b15b05c835711a8c4511f2922b813bfca2069c74114ea42a8d910595b289b50a213b6b8ae2702125a7323d99260b275752014097731cabb8b466eb4089f34822f85c978835b5f489bb867caaa310b5cf3c58c7165e25869ed7063ecb72322bb658da95f7590c10c496696e1a481a96a4e9c19fdd5a51ab78fb4ab66d1a9122de15abe64a07725323021851b1ac188246162ea884bf30986b00588f69f63651476a8b299756d3468ba7c48224df6276a820cc848b0c357abe2679b9304c3a520a6d9865ce9a51e933701ab32c1ec9b1fedd05b0146a2417940dbd85ea2d9930ca33bc596b0d43caec3da15f6928adbcc5dacd7b105b01f2e636549398b6ebb16b168c19cc1958b88c9c6016aef5f52468ac9c26a44bccab15f4d4a57cade06bbe2cf795448660a53ae38e34e6ba1a8c393b606c4c751faf7e8080260309b539d11693b991ed87a46c8b24142001d00206ba1a8c393b606c4c751faf7e8080260309b539d11693b991ed87a46","tls_ja3":["11a384388ad36777e1a2e121495037fe"],"http_akin":["b11cuq031_00040800_7e369cbb_x83e1"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":99,"b11cuq031_00040800_7e369cbb_x83e1":41},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-12","count":2,"sessions":0},{"date":"2026-08-19","count":5,"sessions":0},{"date":"2026-08-30","count":1,"sessions":0},{"date":"2026-10-18","count":1,"sessions":2},{"date":"2026-10-25","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-25T00:37:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"{19730D60-90A0-4623-8C44-688D762AAA16}\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nSSTPCORRELATIONID: {19730D60-90A0-4623-8C44-688D762AAA16}\r\nContent-Length: 18446744073709551615\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"876801fc-57cb-49f4-95b0-d67405e94fd1","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":15},{"timestamp":"2026-10-18T06:44:45","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"081d942b-998d-4463-8c2b-0d51b9bff407-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"},"interactive":true},{"timestamp":"2026-10-18T06:44:44","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"8aaa6b81-5464-4fba-a34a-053e968ff26b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-08-30T01:14:31","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"0df687b5-a429-44f7-8053-d6e5b5bb2cf6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-08-19T18:15:59","port":29840,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT / HTTP/1.1\r\nHost: <HONEYPOT>:29840\r\nUser-Agent: Mozilla/5.0 zgrab/0.x\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"434f4e4e454354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393834300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"ef19f893-6557-4af2-b97d-d03b78e99629","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":15,"enriched":{"digest":"d66419ca57b40a15","label":"HTTP","strings":["CONNECT / HTTP/1.1","Host: <HONEYPOT>:29840","User-Agent: Mozilla/5.0 zgrab/0.x","Accept: */*","Accept-Encoding: gzip"]}},{"timestamp":"2026-08-19T18:15:48","port":29842,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT / HTTP/1.1\r\nHost: <HONEYPOT>:29842\r\nUser-Agent: Mozilla/5.0 zgrab/0.x\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"434f4e4e454354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393834320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"98854856-fcc4-4dd9-8525-865705e8a435","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":15,"enriched":{"digest":"fe0a12517f74b259","label":"HTTP","strings":["CONNECT / HTTP/1.1","Host: <HONEYPOT>:29842","User-Agent: Mozilla/5.0 zgrab/0.x","Accept: */*","Accept-Encoding: gzip"]}},{"timestamp":"2026-08-19T18:15:31","port":22249,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT / HTTP/1.1\r\nHost: <HONEYPOT>:22249\r\nUser-Agent: Mozilla/5.0 zgrab/0.x\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"434f4e4e454354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32323234390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"88617639-7ebd-47b6-842a-fdbcc3e513be","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":15,"enriched":{"digest":"799306d8c4ff56c4","label":"HTTP","strings":["CONNECT / HTTP/1.1","Host: <HONEYPOT>:22249","User-Agent: Mozilla/5.0 zgrab/0.x","Accept: */*","Accept-Encoding: gzip"]}},{"timestamp":"2026-08-19T18:15:15","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT / HTTP/1.1\r\nHost: <HONEYPOT>:8080\r\nUser-Agent: Mozilla/5.0 zgrab/0.x\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"434f4e4e454354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"61bcee8f-ce06-40a0-912d-8e4780f59ab4","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":15,"enriched":{"digest":"ec1841674376d5ac","label":"HTTP","strings":["CONNECT / HTTP/1.1","Host: <HONEYPOT>:8080","User-Agent: Mozilla/5.0 zgrab/0.x","Accept: */*","Accept-Encoding: gzip"]}},{"timestamp":"2026-08-19T18:14:59","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT / HTTP/1.1\r\nHost: <HONEYPOT>:3128\r\nUser-Agent: Mozilla/5.0 zgrab/0.x\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"434f4e4e454354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"84ef3c72-f10e-452b-b692-2d8ecdac47d7","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":15,"enriched":{"digest":"e248f4f69c051ecd","label":"HTTP","strings":["CONNECT / HTTP/1.1","Host: <HONEYPOT>:3128","User-Agent: Mozilla/5.0 zgrab/0.x","Accept: */*","Accept-Encoding: gzip"]}},{"timestamp":"2026-08-12T15:39:21","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"f1ff71e5-0239-493a-b17b-425568208a13","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}}],"http_methods":[{"method":"SSTP_DUPLEX_POST","count":1}],"distinct_ports_total":8,"top_paths":[{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"{19730D60-90A0-4623-8C44-688D762AAA16}","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}