{"ip":"165.245.227.87","data_as_of":"2026-10-26T10:42:33+00:00","observed":true,"total_events":1,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"386 bytes sent","bytes_sent":386,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-18T00:27:16","last_seen":"2026-10-18T00:27:17","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"CA","country_name":"Canada","region":"Ontario","city":"Toronto","lat":43.709,"lon":-79.4057,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-18T00:27:17","last_seen":"2026-10-18T00:27:17","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105de010005da03030c8265f28f66d7b7e90fa50927821b59af80fbbf4fc13141011f69b9033db8082002319703a435eaab41da4457ac6d83f055bce9e63806d0b681e9e4cb8afaf0700032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c00de734e5a31d5f18c03261554656c1c25035b3264830a60524e27e24c3b8be308c1cacc183785bcbf3bf154c13aa0b13a3a62b8c242d666a25c05aa6c591c0c4279a61171c7c92bbc0f95cdfd88f57315f9fa0593242626026cfc98a2ba8ab622df8a29eaa970e7ac8b6719848480327c1c1664b2199b657038b160832748360b509c4aef60846622c048489a13f113ef8c84ca2f8001b589ad71bbfd6f6687c1a1f7764ba5c9275c020835b1b527c864429517785d76cb986744282052593762920733fcb4bf3c62da79b423170c4e8aa5c9e891434503692c39ab1db00284893f220408c6b076906b0c389a1f7185cf8e376a3822066006124852f75d2b601381bd6a506d95a88e79121af493181abcd7985c2c7b282dfc9b6d65174c82cb7a4c51d03d96d106a0849aaac1a98adf6e8c24c31bed71c8c31645c7097b059367bb5c0a8b5cc96721c763cc594bdd1653b860496140be2d68c8bc744fd82143c6a679bc18ea946ac8b7705c9e8c738ba73a7cba6de117576c118f7425ed65c77bac825b5043cdb773256012ed5618a853509c3b90d8a799a26f0982c895dbc628f612523eb4581efe8035682b35d5871ba961605b2577af8b853021c179b2e6eb019c8165111a0152ee6147bbb7aca7b8d73457a75f09d6d1c745b220fd788cad57a78145836471c475fe267cba970c57a7d115a2e7dbb26158787c0f92184871180d885f664a8526abceb3b015b3434f2732420668dd831c40c32969b8cb2b5715c9b297581f10c29c207e63810ef40794a3b34d8c0ceef6b8d0ed14065eb65ff573a1513867f9158a70b35c7635f72115bfcd08ad3743552500afc6bac9098bdddd447b1f55c4454a212487ffce351b18b6a3f82ce4234c2e262716f3bb95de840e03c5383ab3bfb09129f789558f12b824307931b4652785803f635fe5ac826d2ca8b2b32729c729b23328cba8a411b91823005b88b16c0f2380dda68449c6eafa0b42c97a73bfa0228d3bfd0b364172c192d1778fda1c0b756a8c82a2856d878ce73199f84c89bd472ea4842d5c7a62d36ce9ffcceadcc3654452f453566bc0a0e19f694790a8d778c8daf67bbb49a155b277d4a583455e27aefb002ba00a7c844b5491297feec583db55233c003a44219f3f275ae494291e5a6d3b9976bd4727c728c4e6578af55565f1401102c2ec2114aeb6a3dff249b0fbba2df4b6db89802340082f13cb158e1206d6b8bf1c2a1def437d20209cb277e045ac17b4c25e305b91bf1066fa7c506e89269da0480927dcc8558c8039f16a889be450c70dc601244c2047521e48573cb0550c7f77173147d11122a0701840544575cd5c1195b9f4e6609385a9347bc47cfa8564d05abed71b9e54c99e0434c3f4a6912a56a5d7a7692a92e281b7401783123f95dce06b407c9aa7167002de3aee203cff875c4e7b5085ea4a2273746acb7a1e7304725c18775603b468125bfb83c29dace700a04b3632721f5bab2154756250da7201aabc45546457cdc2b15356c7a35173d2909af8e22a2b3ecc0bc6a607bbab1d7150bb244bde227b67de540e4c9a545573c0756b595d77b3e290174a5c5b02458a762b555640799493db443cb13071229722ef0c0a4811085969c9f469dfdcbc09d1f3a4fb7ab216d92ebbf5eeaa83de59af5a16b81792e69573d0647b669fbbb429ccf7401d7ebe7de239a496cb83d001d0020e59af5a16b81792e69573d0647b669fbbb429ccf7401d7ebe7de239a","tls_ja3":["11a384388ad36777e1a2e121495037fe"],"http_akin":["b11cuq031_00040800_7e369cbb_x83e1"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_ja3":["11a384388ad36777e1a2e121495037fe"]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":99,"b11cuq031_00040800_7e369cbb_x83e1":41},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":1,"sessions":1}],"recent_events":[{"timestamp":"2026-10-18T00:27:17","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a203c484f4e4559504f543e0d0a0d0a","method":"","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"cc64043c-485a-45c0-8517-6d0efd4fb218-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T00:27:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"{19730D60-90A0-4623-8C44-688D762AAA16}\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nSSTPCORRELATIONID: {19730D60-90A0-4623-8C44-688D762AAA16}\r\nContent-Length: 18446744073709551615\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"e08d54a8-6cc1-4aec-86e1-49b1b9581a3b","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":14}],"http_methods":[{"method":"SSTP_DUPLEX_POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":1,"ports":1},{"path":"/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"{19730D60-90A0-4623-8C44-688D762AAA16}","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}