{"ip":"151.240.109.187","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,679 bytes sent","bytes_sent":2679,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T12:38:31","last_seen":"2026-09-26T12:38:32","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Delaware","city":"Wilmington","lat":39.7503,"lon":-75.5453,"asn":137409,"org":"GSL Networks Pty LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as137409","label":"Global Secure Layer","category":"isp","url":"https://www.peeringdb.com/asn/137409"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i181100_e8a523a41297_02c8e53ee398","t13i180900_e8a523a41297_78e6aca7449b"],"tls_client_hello":"1603010200010001fc03031c874525352cd3a7000d27263b4b94ae83d04a9cb546d711dc53943b287d92ed2008403ece243de41b303f2ee05553ee0f160e934c47849674ec2505ddbb7c3d3b0024130313011302c02fc02bc030c02ccca9cca8c009c013c00ac014009c009d002f0035000a0100018f00170000ff01000100000a00080006001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003300260024001d002041c0a15b0b80c0bb562656ec9ef750d3e39e5f2c4667dba4bb61194b04edb817002d00020101002b0005040304030300150083000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000290094006f006980c6f5d6b49b12cd535eb15675cbc851d1a777d0f78c722f3c3bb2c0972ee5bddd65b067e34e687bc840ea939442ea3d7356568feae9ca6277720701cc3f93ed6bc936875c8c8b00e5404a57ac156028e8c1f0ecf1df21744411414815ca300f8f976bdea6b2421cb915febb190021202593487bdc55ae888eb2c39b794016ac406a6bfddf33db75a21287bd3da16f34","tls_ja3":["43cf532976cbdec73c21b564756fd088","7c5a42bc3e6679b3cdf9ae958f3a6f4f"],"http_akin":["b11cun101_0015003f_b575bc6f_x7d4c","b11cuq181_00157bff_29aa9edd_x7d4c","b11cun073_00040013_33fea7fc_x20d25858e64b"]},"fingerprint_peers":{"t13i181100_e8a523a41297_02c8e53ee398":59,"t13i180900_e8a523a41297_78e6aca7449b":82,"b11cun101_0015003f_b575bc6f_x7d4c":4,"b11cuq181_00157bff_29aa9edd_x7d4c":4,"b11cun073_00040013_33fea7fc_x20d25858e64b":4},"akin_families":{"b11cun073_00040013_33fea7fc_x20d25858e64b":{"head":"b11cun040_00040013_ab9bb075","shapes":2,"ips":59}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"],"timeline":[{"date":"2026-09-26","count":3}],"recent_events":[{"timestamp":"2026-09-26T12:38:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"ru,en;q=0.9,en-GB;q=0.8,en-US;q=0.7\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-length\":\"53\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"sec-ch-ua\":\"\\\"Not/A)Brand\\\";v=\\\"99\\\", \\\"Microsoft Edge\\\";v=\\\"115\\\", \\\"Chromium\\\";v=\\\"115\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"dummy_username=&dummy_pass1=&login=guest&passwd=guest","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cgi/login","summary":"","payload_hex":"504f5354202f6367692f6c6f67696e20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a6163636570742d6c616e67756167653a2072752c656e3b713d302e392c656e2d47423b713d302e382c656e2d55533b713d302e370d0a63616368652d636f6e74726f6c3a206d61782d6167653d300d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a7365632d63682d75613a20224e6f742f41294272616e64223b763d223939222c20224d6963726f736f66742045646765223b763d22313135222c20224368726f6d69756d223b763d22313135220d0a7365632d63682d75612d6d6f62696c653a203f300d0a7365632d63682d75612d706c6174666f726d3a202257696e646f7773220d0a7365632d66657463682d646573743a20646f63756d656e740d0a7365632d66657463682d6d6f64653a206e617669676174650d0a7365632d66657463682d736974653a2073616d652d6f726967696e0d0a7365632d66657463682d757365723a203f310d0a757067726164652d696e7365637572652d72657175657374733a20310d0a72656665727265722d706f6c6963793a207374726963742d6f726967696e2d7768656e2d63726f73732d6f726967696e0d0a636f6e74656e742d6c656e6774683a2035330d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a64756d6d795f757365726e616d653d2664756d6d795f70617373313d266c6f67696e3d6775657374267061737377643d6775657374","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"7c5a42bc3e6679b3cdf9ae958f3a6f4f","session":"62e9afec-f442-4eb3-9f29-503aba8a8bd6","seq":1,"duration_ms":100,"bytes_in":897,"bytes_out":80},{"timestamp":"2026-09-26T12:38:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\",\"x-citrix-am-credentialtypes\":\"none, username, domain, password, newpassword, passcode, savecredentials, textcredential, webview, nsg-epa, nsg-x1, nsg-setclient, nsg-eula, nsg-tlogin, nsg-fullvpn, nsg-hidden, nsg-auth-failure, nsg-auth-success, nsg-epa-success, nsg-l20n, GoBack, nf-recaptcha, ns-dialogue, nf-gw-test, nf-poll, nsg_qrcode, nsg_manageotp, negotiate, nsg_push, nsg_push_otp, nf_sspr_rem\",\"x-citrix-am-labeltypes\":\"none, plain, heading, information, warning, error, confirmation, image, nsg-epa, nsg-epa-failure, nsg-login-label, tlogin-failure-msg, nsg-tlogin-heading, nsg-tlogin-single-res, nsg-tlogin-multi-res, nsg-tlogin, nsg-login-heading, nsg-fullvpn, nsg-l20n, nsg-l20n-error, certauth-failure-msg, dialogue-label, nsg-change-pass-assistive-text, nsg_confirmation, nsg_kba_registration_heading, nsg_email_registration_heading, nsg_kba_validation_question, nsg_sspr_success, nf-manage-otp\",\"x-citrix-isusinghttps\":\"Yes\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/vpn/index.html","summary":"","payload_hex":"474554202f76706e2f696e6465782e68746d6c20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a782d6369747269782d616d2d63726564656e7469616c74797065733a206e6f6e652c20757365726e616d652c20646f6d61696e2c2070617373776f72642c206e657770617373776f72642c2070617373636f64652c207361766563726564656e7469616c732c207465787463726564656e7469616c2c20776562766965772c206e73672d6570612c206e73672d78312c206e73672d736574636c69656e742c206e73672d65756c612c206e73672d746c6f67696e2c206e73672d66756c6c76706e2c206e73672d68696464656e2c206e73672d617574682d6661696c7572652c206e73672d617574682d737563636573732c206e73672d6570612d737563636573732c206e73672d6c32306e2c20476f4261636b2c206e662d7265636170746368612c206e732d6469616c6f6775652c206e662d67772d746573742c206e662d706f6c6c2c206e73675f7172636f64652c206e73675f6d616e6167656f74702c206e65676f74696174652c206e73675f707573682c206e73675f707573685f6f74702c206e665f737370725f72656d0d0a782d6369747269782d616d2d6c6162656c74797065733a206e6f6e652c20706c61696e2c2068656164696e672c20696e666f726d6174696f6e2c207761726e696e672c206572726f722c20636f6e6669726d6174696f6e2c20696d6167652c206e73672d6570612c206e73672d6570612d6661696c7572652c206e73672d6c6f67696e2d6c6162656c2c20746c6f67696e2d6661696c7572652d6d73672c206e73672d746c6f67696e2d68656164696e672c206e73672d746c6f67696e2d73696e676c652d7265732c206e73672d746c6f67696e2d6d756c74692d7265732c206e73672d746c6f67696e2c206e73672d6c6f67696e2d68656164696e672c206e73672d66756c6c76706e2c206e73672d6c32306e2c206e73672d6c32306e2d6572726f722c2063657274617574682d6661696c7572652d6d73672c206469616c6f6775652d6c6162656c2c206e73672d6368616e67652d706173732d6173736973746976652d746578742c206e73675f636f6e6669726d6174696f6e2c206e73675f6b62615f726567697374726174696f6e5f68656164696e672c206e73675f656d61696c5f726567697374726174696f6e5f68656164696e672c206e73675f6b62615f76616c69646174696f6e5f7175657374696f6e2c206e73675f737370725f737563636573732c206e662d6d616e6167652d6f74700d0a782d6369747269782d69737573696e6768747470733a205965730d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"7c5a42bc3e6679b3cdf9ae958f3a6f4f","session":"a1eb9bdb-4eb6-4ee6-af28-94e512327bf6","seq":1,"duration_ms":100,"bytes_in":1187,"bytes_out":80},{"timestamp":"2026-09-26T12:38:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"ru,en;q=0.9,en-GB;q=0.8,en-US;q=0.7\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/vpn/index.html","summary":"","payload_hex":"474554202f76706e2f696e6465782e68746d6c20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a6163636570742d6c616e67756167653a2072752c656e3b713d302e392c656e2d47423b713d302e382c656e2d55533b713d302e370d0a63616368652d636f6e74726f6c3a206d61782d6167653d300d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a757067726164652d696e7365637572652d72657175657374733a20310d0a72656665727265722d706f6c6963793a207374726963742d6f726967696e2d7768656e2d63726f73732d6f726967696e0d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"43cf532976cbdec73c21b564756fd088","session":"2285a194-4dd8-41a9-bbee-dbabc369705a","seq":1,"duration_ms":100,"bytes_in":595,"bytes_out":80}],"http_methods":[{"method":"GET","count":2},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/vpn/index.html","count":2,"ports":1},{"path":"/cgi/login","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[{"username":"guest","password":"guest","count":1}],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Content-Length","Content-Type","Host","Referrer-Policy","Sec-Ch-Ua","Sec-Ch-Ua-Mobile","Sec-Ch-Ua-Platform","Sec-Fetch-Dest","Sec-Fetch-Mode","Sec-Fetch-Site","Sec-Fetch-User","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Accept-Language","value":"ru,en;q=0.9,en-GB;q=0.8,en-US;q=0.7","notable":false},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"53","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Referrer-Policy","value":"strict-origin-when-cross-origin","notable":false},{"name":"Sec-Ch-Ua","value":"\"Not/A)Brand\";v=\"99\", \"Microsoft Edge\";v=\"115\", \"Chromium\";v=\"115\"","notable":false},{"name":"Sec-Ch-Ua-Mobile","value":"?0","notable":false},{"name":"Sec-Ch-Ua-Platform","value":"\"Windows\"","notable":false},{"name":"Sec-Fetch-Dest","value":"document","notable":false},{"name":"Sec-Fetch-Mode","value":"navigate","notable":false},{"name":"Sec-Fetch-Site","value":"same-origin","notable":false},{"name":"Sec-Fetch-User","value":"?1","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","notable":false}],"distinct_sets":3,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T19:38:19.457119+00:00"}