{"ip":"170.178.174.205","data_as_of":"2026-10-26T12:33:58+00:00","observed":true,"total_events":23,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 11 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,434 bytes sent","bytes_sent":3434,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-15T05:14:30","last_seen":"2026-10-18T21:12:45","events_24h":0,"events_7d":0,"interactive_sessions":11,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":6},{"protocol":"tls","sessions":3},{"protocol":"http-proxy","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0515,"lon":-118.2707,"asn":46844,"org":"Sharktech"},"source_domain":"rdns13.pepsii.com.br","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":11,"first_seen":"2026-10-17T00:19:46","last_seen":"2026-10-18T21:09:15","verdicts":[{"verdict":"scan","sessions":8},{"verdict":"unknown","sessions":3}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1},{"persona":"proxy@squid/5.7","sessions":1}],"services":[{"protocol":"http","port":8081,"sessions":3},{"protocol":"http","port":442,"sessions":2},{"protocol":"http-proxy","port":8442,"sessions":1},{"protocol":"tls","port":442,"sessions":1},{"protocol":"tls","port":8442,"sessions":1},{"protocol":"tls","port":1195,"sessions":1},{"protocol":"http","port":1195,"sessions":1},{"protocol":"tcp","port":442,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":8}]},"top_ports":[{"port":444,"proto":"tcp","label":"","count":7,"sessions":0},{"port":1195,"proto":"tcp","label":"","count":3,"sessions":2},{"port":8081,"proto":"tcp","label":"","count":2,"sessions":3},{"port":1193,"proto":"tcp","label":"","count":4,"sessions":0},{"port":442,"proto":"tcp","label":"HTTP","count":0,"sessions":4},{"port":6443,"proto":"tcp","label":"k8s API","count":3,"sessions":0},{"port":8442,"proto":"tcp","label":"TLS","count":0,"sessions":2},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0},{"port":8118,"proto":"tcp","label":"","count":1,"sessions":0},{"port":3389,"proto":"tcp","label":"RDP","count":1,"sessions":0},{"port":943,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c603036599fa036ed7274a2e9cb501bd58975ab05d30368d1f854eb4c0a70a52f6c5c420031e56b3de681db4f91dde3c7641ee83c51862021b6321b24550e06135ce602b001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0934247b61c03d02bba56517e5b2611db792c5b114cd9f4b379a1be283c40d096733b15aca71661352c468ac55e27fc1e090840d293c8c2b4424b975971486fcb465dd2bac6e95a4aa3ab0bccb200cd7936ab841d8756201a0b4cf629850008952705abded7aa44ba2dbaa3b4485471ee5a4c0270522c535552414a6fa446ea825f58cb70b8ebb13fd25ae9c2274f17bb012c769e655d33e3bdbd6723e74baf3391b67bd715ada77b1c42b5f9c6c152212acec67f4ed43312c6544d9549160066eed3b5d2516e9a558bb2897278311210129d9692a66804958e70b84891650ec21f1424cb269a60b3524429e85fa0140f366485c98866bbb21d0cdc24b300b24827b09ba5b3d0e2ce95f5a5bbb87d75726f81ba4159226c0af18ddc2500d0ea18d50c9ad080b5f972c5ef3b25ce816857234820c736df950874274c51580ae78695cb199f416b8e0947ca64e67e3c8625e74364bc772bff0cc34b5c7355854a87c0cfc43b570c102e071742020515f2dc5bf65b9da0133662460efa61ab5d96b717db027cf92a2dc906de2b5b43389753917d5a13b5cde75eaab695a100aacee16b9f65cfce4bb09d6b36a6ca7950075116d3266c950ac7622ab787a73698331f10a3bdbc0019a9a6f3cbb3a7fa95ca8b028d4a9584387646bb9c3d2a2451d4b631c35a5af0962b70a1c2bc5b57c621a8276031a7458f8a4a108cbf337a7288129768432803a6c0eb306600cb3709e49afda32550a2a9749ac99fb2070294904f45090eb20a0ef50e7fd199dda7b55fdc1bfd82c122da3b9bfa26b700551c128d1fd9113f454deea1ca1da7000ce933da4955c48c3d3b66a00f594b12499d7467b7b06a579ce6b51062840c58923430b30763799704416da374b75842233b732bbbcb8f2601978832e5985858ca5a3ad80b7250bee08089b62c0e8f06280da050b96625664ca5402c12a5e024f3848b4a544484c475d66396bf6444dbb4867bca8acad400a44445006d693a1bb9bea050aaf89a5f9502649767bb4583f88498788b2406379b57e00516784c9506900722468afca52246a66ed590c42b9ed32b195b583edcda8bf00b9e7ce8133f30615c47744b53b0d21217edb5341453b6e5f4680e34558f1c676ac02787fc8045468739366923ca37dfd95d20294c19149de61a9fda4744360ccd0d4b9061698030a1b3a6ec6354c514b451a933a625dd4c44935a53661a3f3978a0492725b0d0ce20779711249b83223250456f784b3b0d251053364cf9a9b70dc30ce840a15265a01265409cfbc6c5527c12a6886a8aac70f8ce4cba5bb2239958fac0e95b29f64461c6a8604564538685240e0b958a322fbbbcb12626b2e728021df7b68d13a3c710be7d6a28b7f80da648481c9ca3aa7b0b65ac85051894bdf4b3cde050928675ae05bf28ab7689674089903caaf34141c920c2660d8c7095f6832b3b8879a5a721e82883d097634793810ea1b6dfe4c6d49b2ca09c0d3cb49fad95a896a3952d35bdf9e6c1ae447df374bccb14707731010fbbc6d8fcb23991cce29cb85f632869d41edaa25a9b63262b1086bd9b4f6a647e9cdb8ba496595d975e8fc69f9bb258f910b3422317c0a8470e7662b1a8101730c9097d40cf32fe64dac1306a20520ccfd367fbfcf4bba24fcfa0177be60e1823a53b640266a36d24459cf86a81b2d17715b7f88f376cee05f69bb2e1c05d001d00201823a53b640266a36d24459cf86a81b2d17715b7f88f376cee05f69bb2e1c05d","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":70,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-15","count":1,"sessions":0},{"date":"2026-09-18","count":2,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-10-17","count":12,"sessions":7},{"date":"2026-10-18","count":7,"sessions":4}],"recent_events":[{"timestamp":"2026-10-18T21:12:45","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"d7318901e95a07a2c89c865cf92f3e54\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: d7318901e95a07a2c89c865cf92f3e54\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2064373331383930316539356130376132633839633836356366393266336535340d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"ee5d49d7-5fe1-46ad-854d-069f9fbba012","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":15},{"timestamp":"2026-10-18T21:11:27","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"e327615e90021d635efd6b7a13a582d5\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: e327615e90021d635efd6b7a13a582d5\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2065333237363135653930303231643633356566643662376131336135383264350d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"4d1fd318-5b66-4db9-a0af-968ecb1873eb","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":15},{"timestamp":"2026-10-18T21:09:13","port":442,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 6ff9c4c7743473f9452c93cd58ce6f94\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2036666639633463373734333437336639343532633933636435386365366639340d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"b0a28bd5-9b1f-4a47-9be9-40bc88da3d26-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"91ea91f804fa1af7","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 6ff9c4c7743473f9452c93cd58ce6f94","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T21:05:59","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"18998c5d-5dd8-4c0d-94d8-edf6bb350ec2","seq":1,"duration_ms":104,"bytes_in":102,"bytes_out":80},{"timestamp":"2026-10-18T21:03:21","port":442,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"405b4b16-7739-4af8-a3ad-799fbe84345a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T20:55:49","port":444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8uf�1/t�\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e387566b0312f74b7000000000000","method":"","user_agent":"","ja3":"","session":"6542a2f5-d635-48d2-a541-d407662dc0f2","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":15},{"timestamp":"2026-10-18T20:38:38","port":444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8&<�J\u0001��j\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38263ccc4a01e8ce6a0000000000","method":"","user_agent":"","ja3":"","session":"4aee71ae-a829-40fa-8657-515d8bf22e0a","seq":1,"duration_ms":104,"bytes_in":16,"bytes_out":15},{"timestamp":"2026-10-18T20:09:51","port":442,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�5��Ǧ\u0013�\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38e3359b85c7a613d70000000000","method":"","user_agent":"","ja3":"","session":"09d3d46a-2acb-43d7-8311-7ec326119a0a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T19:25:43","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"f5760be0-912f-4faf-8963-8fd4f1c8c882","seq":1,"duration_ms":101,"bytes_in":101,"bytes_out":80},{"timestamp":"2026-10-18T19:08:36","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"f62cd851-2d83-43e8-9b5f-57899a083ae2","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":80}],"http_methods":[{"method":"GET","count":18},{"method":"SSTP_DUPLEX_POST","count":3}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":13,"ports":6},{"path":"http://probe.invalid/","count":5,"ports":4},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":3,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":6}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"d7318901e95a07a2c89c865cf92f3e54","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[]}