{"ip":"165.227.16.208","data_as_of":"2026-10-26T10:42:17+00:00","observed":true,"total_events":17,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["17 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,002 bytes sent","bytes_sent":2002,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-08-30T22:41:16","last_seen":"2026-10-25T00:34:20","events_24h":0,"events_7d":3,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":3389,"proto":"tcp","label":"RDP","count":2},{"port":3390,"proto":"tcp","label":"","count":2},{"port":8800,"proto":"tcp","label":"","count":2},{"port":52951,"proto":"tcp","label":"","count":2},{"port":52931,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105de010005da03032897fbe008594affbc4c709bb67aa987fc2f42eef4db7a02e14014d3bf84878820fbc82ffdb1f11a89789790a79097114210221a73c4ffc54bb689dbe46185cf600032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0a8c30703b25cfc12cbe2e96a4c1a5e4329265c3255d09a68f161c337e30bcb96b4caebb3710014724169ac465532c8657a976449c1b7a67865154b21a65608852282dc281f026c71ed8c74fdc59e31898a2ab89d0821276d27167d888dbc5b5b375a4344b52e97c0794afc388520608dd59c9a1483a5a38d4f162a22d08740d0a9a264bb876c517baac84a08904a9a8028424699cca06ed4a6992ca83d8a3da6d33cec80c644c20684f476fba41fa9f59ed75051e09a05af77a747c3c1af988557abcea46c027188193ecc6793e33d86f724056c890a5774efe95ec6e250e91ab62c4579d6334faffa8ba71870cce57408413d724b97d3a685f36aaa33454938dc2f9d699df2c04cfe22863bba868438acaff40635558c161243e1e63b74c843b4e9b37d35304561735fa821f2f45ad09a3abca6c6ba822c5ee31fd6f6ac7e515d3f373b339605e3b9b768b89c99f600f491bb9fa7680e098ea81a9515c9a6d8d58670fb24a4e4059d3813c25b8071826845e83bbc8676b7c7cb920a82a4f8b11b494af9994de31648c7c4991bb52c86e8c279e297425915fc90ad8488292bb315557c5b508559d4d86810719419f0210266b63d31731f9308fb732cc0140245420884cc7d867c489cd53f26157dc25179dcba1d34b099c7d19ca950a921269afbf91bc8c795ae676976fa8f1006c266d45f2945832cf55bf274ca54f80c1e3228b4a0b6b3a03f536476044bc9d6c3b40f607862fc00093b88c58c8e7e39772702b83278916d530515d121de92aab3f8bd9786c201f43e58e729d94c4a1586043761c90e36653a7a79bc008be0487f66f247d448ba27a741530703f531140dab1c869511c587cc0d337155838c84c7b60c50006e84cf5c38c2c8c760f3b646c1973066f1b69ef314cce90a6700b76b4b0ecb220ecbe023a06caf52c75af218ac1847a551c7a06494932216064526b206033359804965c69a7e36b6cde0bb8e4033eab059086c63acd761e9ea8276a571c7066690576bf2e20543f786debc8083c23634227d312b044e685881519bb5731f33d2376de828af43af95b2c50d0b1372740d9613419d0097960b9cd8d47185f787dcda0a41312640c6be3a61851f8aca86ecc2a42187b6269b909737d402721d92254955958fe17f2c864329141cb8368ef695828bb72fbeda0fbdf4444fe12d8b13681f139548ab0cd0fa3afa64108a518ef8eb4baa0a3d43c3aa88d3379242cd25275ec06199ce90acd43bbe67f3938a6ac714d64d6590036632766e723acc1a98d83424dd87a20582515b489e4ff3540c36607da759d8b65958da36d3b2c65ad2ccd13aaca51875be93b74228ba334c6c8689842f3b9b48c10c46bb48a8000ce1e87aae92679c0971d0157ae02126279b34364337914a030ff7653527390b689d1c292577634fc2fa07dbb7012f76540e73b767442b57368bafe2a8f24123180646a8db2c1632c0e154435ff534207987d7d6b09da785d46ca626e108efb046bc7b7be401b0c8f25817c9b06c0a304d8111407505d4661c24405029352ea54974c60196ca9aade369afe6151a4715cd17b8c8cf0739e0834dfd5a633b2344d7d9ce9cdb34e749979b32438e23bab9d9d4ed8ad7dde43fa3d6e55e73052010014aba6bc97b1e5415555e8121ccfb5a45969c73a0dd69fac41245bdb4db893ed69cb70255aab1154324a5275d203b001d00205a45969c73a0dd69fac41245bdb4db893ed69cb70255aab1154324a5","tls_ja3":["11a384388ad36777e1a2e121495037fe"],"http_akin":["b11cuq031_00040800_7e369cbb_x83e1","b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":99,"b11cuq031_00040800_7e369cbb_x83e1":41,"b11cun040_00040016_aa48e2c8":5564},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-30","count":2},{"date":"2026-09-01","count":12},{"date":"2026-10-24","count":2},{"date":"2026-10-25","count":1}],"recent_events":[{"timestamp":"2026-10-25T00:34:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"{19730D60-90A0-4623-8C44-688D762AAA16}\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nSSTPCORRELATIONID: {19730D60-90A0-4623-8C44-688D762AAA16}\r\nContent-Length: 18446744073709551615\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"afd438c0-8b5b-44cb-b134-42d71e10accf","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":14},{"timestamp":"2026-10-24T03:58:45","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"31bad368-e696-4c40-9108-010f035fc1a4","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-24T03:58:45","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"c09173e7-d5a1-4776-8e2f-1bc5d195b7a6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-09-01T11:51:10","port":3128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3128\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"e9f2da8d-41dc-4617-a891-7055e0e5609c","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-09-01T11:25:17","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"337f7a08-c89d-4247-95ab-74e951c804e9","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-09-01T11:24:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"25d3b191-561d-404a-82a9-7d0e63cb6481","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":79},{"timestamp":"2026-09-01T11:12:23","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"b2264060-cd91-4734-a518-b93156addc17","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-09-01T10:36:44","port":8800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8800\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383830300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"31772660-7200-4a0b-b4d9-42a604c857a5","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-09-01T10:24:51","port":52931,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:52931\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a35323933310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"a618fd95-1761-4c6b-b818-0c5e7e327efb","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":79},{"timestamp":"2026-09-01T09:14:56","port":52931,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:52931\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/squid-internal-mgr/cachemgr.cgi","summary":"","payload_hex":"474554202f73717569642d696e7465726e616c2d6d67722f63616368656d67722e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a35323933310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"2be190b8-42be-46df-95db-c2e61439609c","seq":1,"duration_ms":101,"bytes_in":146,"bytes_out":79}],"http_methods":[{"method":"GET","count":12},{"method":"SSTP_DUPLEX_POST","count":1}],"distinct_ports_total":9,"top_paths":[{"path":"/squid-internal-mgr/cachemgr.cgi","count":12,"ports":6},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:3128","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[]}