{"ip":"151.240.91.166","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,734 bytes sent","bytes_sent":1734,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T23:48:23","last_seen":"2026-09-26T08:22:23","events_24h":0,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Michigan","city":"Detroit","lat":42.3318,"lon":-83.0465,"asn":137409,"org":"GSL Networks Pty LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as137409","label":"Global Secure Layer","category":"isp","url":"https://www.peeringdb.com/asn/137409"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i181100_e8a523a41297_02c8e53ee398","t13i180900_e8a523a41297_78e6aca7449b"],"tls_client_hello":"16030100e1010000dd0303bdafb29d3f0bb132666313f2fee9c53f2c8252bfef5c4c0c7c3027bf9058e5ff20ac476393aa11c3ff41c299a80028d9df3b7fe488a806c6ea95a666ca7c4bc4180024130313011302c02fc02bc030c02ccca9cca8c009c013c00ac014009c009d002f0035000a0100007000170000ff01000100000a00080006001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003300260024001d0020e3188c81ded8457195bf37a1531d08eabd4ec7c20ee0ec00385a857ee54e2e03002d00020101002b000504030403","tls_ja3":["43cf532976cbdec73c21b564756fd088","7c5a42bc3e6679b3cdf9ae958f3a6f4f"],"http_akin":["b11cun040_00040013_ab9bb075","b11cuq191_001d7bff_b5e003ae_x7d4c","b11cun050_0004001b_f6ae2631"]},"fingerprint_peers":{"t13i181100_e8a523a41297_02c8e53ee398":59,"t13i180900_e8a523a41297_78e6aca7449b":82,"b11cun040_00040013_ab9bb075":60,"b11cuq191_001d7bff_b5e003ae_x7d4c":4,"b11cun050_0004001b_f6ae2631":17},"akin_families":{"b11cun040_00040013_ab9bb075":{"head":"b11cun040_00040013_ab9bb075","shapes":2,"ips":59}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"],"timeline":[{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":2},{"date":"2026-09-26","count":1}],"recent_events":[{"timestamp":"2026-09-26T08:22:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"43cf532976cbdec73c21b564756fd088","session":"edc9fd85-50ed-46b9-bf87-8140d199108f","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":79},{"timestamp":"2026-09-24T13:33:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"43cf532976cbdec73c21b564756fd088","session":"411436a1-3127-4844-82af-806159949b2d","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":79},{"timestamp":"2026-09-24T13:33:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"priority\":\"u=0, i\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"sec-ch-ua\":\"\\\"Chromium\\\";v=\\\"121\\\", \\\"Not A(Brand\\\";v=\\\"99\\\"\",\"sec-ch-ua-mobile\":\"?0\",\"sec-ch-ua-platform\":\"\\\"Windows\\\"\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"same-origin\",\"sec-fetch-user\":\"?1\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"prot=https%3A&server=<HONEYPOT>&action=getsoftware&user=guest&passwd=guest&new-passwd=&confirm-new-passwd=","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"504f5354202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a6163636570742d6c616e67756167653a20656e2d55532c656e3b713d302e390d0a63616368652d636f6e74726f6c3a206d61782d6167653d300d0a7072696f726974793a20753d302c20690d0a7365632d63682d75613a20224368726f6d69756d223b763d22313231222c20224e6f742041284272616e64223b763d223939220d0a7365632d63682d75612d6d6f62696c653a203f300d0a7365632d63682d75612d706c6174666f726d3a202257696e646f7773220d0a7365632d66657463682d646573743a20646f63756d656e740d0a7365632d66657463682d6d6f64653a206e617669676174650d0a7365632d66657463682d736974653a2073616d652d6f726967696e0d0a7365632d66657463682d757365723a203f310d0a757067726164652d696e7365637572652d72657175657374733a20310d0a72656665727265722d706f6c6963793a207374726963742d6f726967696e2d7768656e2d63726f73732d6f726967696e0d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a636f6e74656e742d6c656e6774683a203130390d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a70726f743d6874747073253341267365727665723d<HONEYPOT>26616374696f6e3d676574736f66747761726526757365723d6775657374267061737377643d6775657374266e65772d7061737377643d26636f6e6669726d2d6e65772d7061737377643d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"7c5a42bc3e6679b3cdf9ae958f3a6f4f","session":"7c79a9e7-41da-46f8-acde-e7fcbe5bbf80","seq":1,"duration_ms":100,"bytes_in":951,"bytes_out":79},{"timestamp":"2026-09-23T23:48:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-GB,en;q=0.9,en-US;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131352e302e302e30205361666172692f3533372e3336204564672f3131352e302e313930312e3230330d0a6163636570742d6c616e67756167653a20656e2d47422c656e3b713d302e392c656e2d55533b713d302e380d0a6163636570742d656e636f64696e673a20677a69702c206465666c6174652c2062720d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","ja3":"43cf532976cbdec73c21b564756fd088","session":"e18f91c6-d9c9-4222-829c-710bb54afc05","seq":1,"duration_ms":100,"bytes_in":283,"bytes_out":79}],"http_methods":[{"method":"GET","count":3},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/global-protect/login.esp","count":2,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[{"username":"guest","password":"guest","count":1}],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Content-Length","Content-Type","Host","Priority","Referrer-Policy","Sec-Ch-Ua","Sec-Ch-Ua-Mobile","Sec-Ch-Ua-Platform","Sec-Fetch-Dest","Sec-Fetch-Mode","Sec-Fetch-Site","Sec-Fetch-User","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"109","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Priority","value":"u=0, i","notable":false},{"name":"Referrer-Policy","value":"strict-origin-when-cross-origin","notable":false},{"name":"Sec-Ch-Ua","value":"\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\"","notable":false},{"name":"Sec-Ch-Ua-Mobile","value":"?0","notable":false},{"name":"Sec-Ch-Ua-Platform","value":"\"Windows\"","notable":false},{"name":"Sec-Fetch-Dest","value":"document","notable":false},{"name":"Sec-Fetch-Mode","value":"navigate","notable":false},{"name":"Sec-Fetch-Site","value":"same-origin","notable":false},{"name":"Sec-Fetch-User","value":"?1","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203","notable":false}],"distinct_sets":3,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-30T19:37:45.761156+00:00"}