{"ip":"159.89.237.48","data_as_of":"2026-10-26T10:41:10+00:00","observed":true,"total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"217 bytes sent","bytes_sent":217,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-17T11:05:50","last_seen":"2026-10-18T14:21:10","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":4444,"proto":"tcp","label":"","count":2},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105de010005da0303583971bcacbaa3208beb1e4e195411cda147b5feb0f03bdc9b2504f9dc93595e20dcaad78226a0cb0b3bf4f2d695b00fb79b7920431e8e0a0a951835a70ab4dada0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0a53a8ea5f335f0ab1e8fe23cf2344c65f602d4dbc8559b81648046aed18bd1192c85857c70f63976529523a4adbd0877abf36825d84d078288be705f6cfb40a2e2b5b7e779ed9463b0333085063b1d992b86e03013aa8ffb38a75a01bce4402f7aea0f31a6aa141b6a635946f699505a97047a904025f8b0ae22301887325e57a48a542572eb59075cad19c0baf55c0b189382b20c5a6e72a0aadba8fdc21b8b5129ea76ce219020d06746fee84fcff78f4142293e5577a237b969296ceb628f381693c5377a9b884cf55b703e56879dd808b2715714cb2fcd99501a5c1272d0b5dc50621309c1fc12afca087565a0cd7e01bbd783b70a687a171a213b707be2675c7cfc9fa8147a3c90819560c806f37505812deb7c9eeec21b461ab921747380cc0ee7f99c4b32070dc779962c9b501bb1e0fb74deb7484471b2ac3583bba1ba3d772c0e65214dc2837f150a9f278bd706ac035237e0a1c9d299866f16af8750802fe6044e551aa4fb4940f717c19234cf05a9bf42a85d8c435eecad12cc54166001a5e695a0115d6b0b059e2a306e1638eac94eff09570888855aeb11d0b0a8d952a7008c1dd330c298c49ed0841a81d2773d7c7a4dc35b5f2c267cc43c688a7eda241d08bca491e34df434c3e31093e9dc59843c58a03aa77f31a31d4a26a14183c25a71bc399908850afdd43da7042ffabb714f925ddd37a1a6d27fc1095d1d42ca5cf9710b7085b8c733b2e25bea8a3fe51a7c68403d0c263d03177a253c79a5a80131b457b1936087fbcd4b08acc15b0bfcf66047500dd1c117e7c26191f17ced6210f14c4e2b7265871ab37d74002c51b2add21adf8970b356cb6d3527a0f0a824199a76da837b9b29e1365e8895029feb85170740f519ccf2da1aa4815f37a79ca48bb40cb5a773e883f9e12fdf1b92cd6b712aa6371e8c36cd244e9822782b56c8b416aa51871e8bc968b7faae02dcabaf94b412b9646399c2078b1f9e3b4868f86d76c6cadf8084779b914941840f2b58e9c2c9e3b904b6910cd9b6afc99b77eb03ab952c239008af6da7004249baeadc19758a8d39aa307d1cb7e6766399982afc87c1dc51c7d2e17d8b83662d59534372b241010bbae3af67c5c06de20d8d590924b57812fb2ec5f7151acac54e961b21326ac7110e8a13991a5a9e48b21f01c17969c20c9b47b6e89b3d34793ea4ab4b03e0167241446fe19bea936a7d05504da41848974e2025311677a1fe608a202b4bde6acf4955830cd50cd7c597c1457c1d838013327298227764530fcad0999d9163217c9f6fb60d4741ca3ab97053e5c5f0b4577507bb582890d4c2b4cf4c3b7dc287c7ac8369d4792539b18257817970932c9826391ba702e29b25b0b518b7cea6e89d6ec6b687e0699b703b625b9813f33ba0a06e9f190048c6339ab9005cec1cd329671858c3ddf82786e260192963583b16cfb912b216815f6651e78b0ba055791315a07d31796b300a491c72deec4379213d3e0264e689767118c3f32a3b4d4863a34182232cbcc095177cb70f1ce3105cf2b46f99c63cc0bec0709f8c0abd103a3d7cb7a737f8c08de1b68e72b9d14cb74ed82896713f35bb448602c24d117fdcf286f7d2ae0e63a51f54900f6fcd14f68d8cc9b743c731e91f8df2128bddc551388ef247f5bb2aaacea169a6a0a5074a22463805e166fe252717ac5e000f2e5e266913f453001d0020bb2aaacea169a6a0a5074a22463805e166fe252717ac5e000f2e5e26","tls_ja3":["11a384388ad36777e1a2e121495037fe"],"http_akin":["b11cuq031_00040800_7e369cbb_x83e1"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq031_00040800_7e369cbb_x83e1":41,"t13i251000_b78ed14e2fd0_ab7e3b40a677":99},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-17","count":2},{"date":"2026-10-18","count":2}],"recent_events":[{"timestamp":"2026-10-18T14:21:10","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"9ccc3f9f-182a-455b-b81d-0dde6d29e72c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-18T00:38:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"{19730D60-90A0-4623-8C44-688D762AAA16}\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nSSTPCORRELATIONID: {19730D60-90A0-4623-8C44-688D762AAA16}\r\nContent-Length: 18446744073709551615\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"380c91b8-8783-4a82-b90d-67fbe14240b0","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":13},{"timestamp":"2026-10-17T11:05:55","port":4444,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"57ac4288-0ccb-42bd-a5c7-d2ed7fb7caed","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-10-17T11:05:50","port":4444,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"ec6e33a9-908b-4556-8a01-9b64bec7a934","seq":1,"duration_ms":101,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}}],"http_methods":[{"method":"SSTP_DUPLEX_POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"{19730D60-90A0-4623-8C44-688D762AAA16}","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}