{"ip":"204.188.219.9","data_as_of":"2026-10-26T12:34:46+00:00","observed":true,"total_events":44,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 47 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,433 bytes sent","bytes_sent":11433,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-14T21:24:25","last_seen":"2026-10-18T11:38:39","events_24h":0,"events_7d":0,"interactive_sessions":47,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":10},{"protocol":"tls","sessions":5},{"protocol":"pop3","sessions":3},{"protocol":"postgres","sessions":2},{"protocol":"pjl","sessions":2},{"protocol":"http-proxy","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":46844,"org":"Sharktech"},"source_domain":null,"known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":161,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-10T07:22:22","last_seen":"2026-10-10T07:22:22","recent":[{"timestamp":"2026-10-10T07:22:22","port":161,"src_port":47253,"proto":"udp","app_proto":"","app_protocol":"snmp","summary":"0:\u0002\u0001\u00030\u000f\u0002\u0002Ji\u0002\u0003\u0000��\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0012\u0004\u0000\u0004\u0000�\f\u0002\u00027�\u0002\u0001\u0000\u0002\u0001\u00000\u0000","payload_hex":"303a020103300f02024a69020300ffe30401040201030410300e0400020100020100040004000400301204000400a00c020237f00201000201003000","sni":"","session":"b4ae2764-e7ea-4721-9094-8cb783a4391a","bytes_in":60,"source_verified":false}]},"interaction":{"window_days":90,"sessions":47,"first_seen":"2026-10-18T06:56:17","last_seen":"2026-10-18T11:38:39","verdicts":[{"verdict":"scan","sessions":29},{"verdict":"unknown","sessions":18}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":10},{"persona":"dovecot@2.3.7","sessions":3},{"persona":"printer@HP LaserJet 400 M401dn","sessions":2},{"persona":"postgres@12.18","sessions":2},{"persona":"proxy@squid/5.7","sessions":1}],"services":[{"protocol":"tcp","port":40000,"sessions":4},{"protocol":"tcp","port":65534,"sessions":3},{"protocol":"pop3","port":110,"sessions":3},{"protocol":"tcp","port":24,"sessions":2},{"protocol":"tcp","port":8000,"sessions":2},{"protocol":"tcp","port":2053,"sessions":2},{"protocol":"tcp","port":50100,"sessions":2},{"protocol":"postgres","port":5432,"sessions":2},{"protocol":"tcp","port":1194,"sessions":2},{"protocol":"http","port":49233,"sessions":2},{"protocol":"pjl","port":9100,"sessions":2},{"protocol":"tcp","port":32233,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"236a788e32d001c59fc843c1aa3846d85ffd7ae4889b2f47f1b62ef4fb81ad39","name":"job-1","size":16,"mime_type":"application/octet-stream","kind":"print-job","times":1,"first_seen":"2026-10-18T09:44:27","last_seen":"2026-10-18T09:44:27","virustotal":null},{"sha256":"889eecb4321314206bcb8e54736dea9e394cfba206a897911e51b8b77cd5d6d9","name":"job-1","size":1487,"mime_type":"application/octet-stream","kind":"print-job","times":1,"first_seen":"2026-10-18T08:23:39","last_seen":"2026-10-18T08:23:39","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":29}]},"top_ports":[{"port":3129,"proto":"tcp","label":"","count":4,"sessions":3},{"port":49233,"proto":"tcp","label":"","count":3,"sessions":3},{"port":7778,"proto":"tcp","label":"","count":4,"sessions":0},{"port":63260,"proto":"tcp","label":"","count":4,"sessions":0},{"port":31113,"proto":"tcp","label":"","count":2,"sessions":2},{"port":5432,"proto":"tcp","label":"Postgres","count":2,"sessions":2},{"port":40000,"proto":"tcp","label":"","count":0,"sessions":4},{"port":11288,"proto":"tcp","label":"","count":3,"sessions":0},{"port":1180,"proto":"tcp","label":"","count":3,"sessions":0},{"port":110,"proto":"tcp","label":"POP3","count":0,"sessions":3},{"port":65534,"proto":"tcp","label":"","count":0,"sessions":3},{"port":12333,"proto":"tcp","label":"","count":2,"sessions":0},{"port":32345,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9050,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8886,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303ca8d43cdd89896c6c44b97e565ac78c7775fd6ff2e51e82c7bf257f03ce5f06820f43bd5afdd66bb1a0e9ad7a04769c4f4dbafde7e34565f1dde922575e18c2fa8001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0162a91ee7788223c12afe1834fb05799a09167fc68651c36497161ade7946a2c1fd06639ec096d853bb931f8516e2b4eb74137404a436463b8dec56757274582c8633f543c63723514330e000dcd849254af988fece8c3b38c8785cacdeb9664bc3782641b40608b88fd478fbb1ab12a59521759cd044c015f4334dc0566c5b80323eb66697044ed948d87537edaca8d8a5aa076127660811c3b9226fe840ce4425656d6a1234117a6321ee5c4553e58653762bc632ab617916d5eca9684eb5dd801c66f9bbad5736fb9cb30a4c3765378c76c680a4a8682a1786e10fa41a7dc8344b15b3ad24baab9849d7c2593c79bf81c933a88492fa7428310078ea5667e4850309c876ae9a2c3f9708f9c4d2724b5aeb299020c8bf0816a655c15ac1316c657852e444fb451554fb1805de46997bca83d4bb0b3053d7a1047994743d919aee16b94972c4c8b4baa1896c2002d82a130cbd124504562628b3ccb85023041193d70fbade59c774a5c6de5a2522bd8b4c3b49845c74e0079a024f75da408b6421501bba6c17128a06c2aa1d35a17f3a94ee43328006595a8d54b93a7484eabaa3e293f72e4cef8e0017632365dca0fc1d9ae8eaa6a9f74c2108919c3e94f2d02bb51923c0c6494f8435aba03524371a3dfb179343888660088cf67a472b398c16c9663003805a922888a299f73b536f7c0abcba0f5552562c353bfc83c609a6053715e9c09ae75599ed5a502d6db5d82870e6ac95c3138a2df8975d1517680887f9793b9637b498695767aa1cb1fe317ca05a0c2998d01b73d06347807d4bc2de2b02ae9128395bec0c3b9ba4464173a361e737f9a41999e081d224b3e7c9aab11cc6d90a74f9d02a2ba825cf190a5867688dadc5f60a12df201c2c73c5486d85370fc1a9d7a782ec94fa1daad13215d21b35cf2b2030a7a533a47309717a209982627103dc4f437426c35d74c9b4d0c7395114acefc2fc09a2858a2939eda0a6c259c2a56ca8856c11259969991c5fc4a767e21c14a1619b56a2333f472a0648bb99927f2729bb4b37d4725013b66c5d7e446ab9abc16988ebd45533ae039bd4b8cd546c65455cd30e92c3a567b42290cb4750b979bc915442963629e66506f972b378b9b021c1a3858e19502c59b77735016314fd48b439fa8683962af6bd5763b5a0a4ae2542f5a4edab45e009b6c5338b30df25c6626334c7b1c68f686d314b37d1856bef9ca72c7886a045a6bccbf3e472ed6397d5435c0477c5721a34ac16053ade4b9d136a412f098b3541a14d39806027649122ee02c625602493a689c28b6624776caf7096314b49155a709e4d22a3a014ddb0698be947a0193414c9252a343719933535454c3ae058c8d320a27403fb5009825f4c827aaa36f470832b9225910687135ba46a770378c79fbe0c31fd7563b6cb0ef14c9fad737befc9ab894b63b327ecaa6b99c2793d38c5cf202222626a99847b233f49768758c13ca2b22cbce2b9710835930b83b5448f664724809c36ac941f890016c4d890792dd9c8e7a137832b8a81013b642ca20cb2a88c0e0b7c1f4a18d16bde419637c883e2cabae8942478f9103c0169b2d3006cba07b1135110509051457aff9a975f0ef88bf60b7a9e2de1803dff9e456805ed9b6db8daee01e8cb97a204e780fb4de2a2a0f9ce14854b231170101e031388bd8639b27db284513ca74ac1de0ab65001d0020de2a2a0f9ce14854b231170101e031388bd8639b27db284513ca74ac1de0ab65","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":70,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":1,"sessions":0},{"date":"2026-10-18","count":43,"sessions":47}],"recent_events":[{"timestamp":"2026-10-18T11:38:37","port":62345,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 3611b34dc5af6b9b793dbfd0fc8e6c70\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2033363131623334646335616636623962373933646266643066633865366337300d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"93621251-391d-40f3-be62-62bb85fa5401-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8a082db966bc599d","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 3611b34dc5af6b9b793dbfd0fc8e6c70","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:31","port":59210,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 94a2983ec2dce61b948666d1ec83d3f0\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2039346132393833656332646365363162393438363636643165633833643366300d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"b4299c31-5b91-4191-9a12-0cdcd9bcd930-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"da140ae3d5a2143d","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 94a2983ec2dce61b948666d1ec83d3f0","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:30","port":59210,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"0067d076ec255f1e2ef58212944a93a0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 0067d076ec255f1e2ef58212944a93a0\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2030303637643037366563323535663165326566353832313239343461393361300d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"4f13ff3c-fb31-452f-b419-f731aa20b2f4","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":13},{"timestamp":"2026-10-18T11:38:16","port":32325,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 72de971e18582232bb4a8f0b9270199d\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2037326465393731653138353832323332626234613866306239323730313939640d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"a070c59b-db99-45ef-a553-2ecfe12dad95-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e959e1b9ec3bb382","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 72de971e18582232bb4a8f0b9270199d","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:37:47","port":12333,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"e152a966f60d8d90b3fa7620cb2897ec\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: e152a966f60d8d90b3fa7620cb2897ec\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2065313532613936366636306438643930623366613736323063623238393765630d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"9afbf793-ae70-4324-82b0-ba65a8d9c80f","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":13},{"timestamp":"2026-10-18T11:34:44","port":7778,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"bf51746eb261c1b5b0f40d0761b80a18\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: bf51746eb261c1b5b0f40d0761b80a18\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2062663531373436656232363163316235623066343064303736316238306131380d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"84d622e1-c7ca-48c3-af77-61a64637a053","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":13},{"timestamp":"2026-10-18T11:34:29","port":6688,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"0d971b3b716dc667003530031b6b7846\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 0d971b3b716dc667003530031b6b7846\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2030643937316233623731366463363637303033353330303331623662373834360d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"9f41d821-64a7-456d-8f62-3863c1cc6802","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":13},{"timestamp":"2026-10-18T11:34:29","port":6688,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 21a8f5874ed32b83ed2a3d5d83500d8e\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2032316138663538373465643332623833656432613364356438333530306438650d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"c3086c45-0b8e-45d9-8419-1361e93def48-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ba821bbf5d0ab479","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 21a8f5874ed32b83ed2a3d5d83500d8e","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:34:19","port":5432,"proto":"tcp","app_proto":"tls","app_protocol":"postgresql","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"d30d13c19e7c889407b2bc0d07afa591\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: d30d13c19e7c889407b2bc0d07afa591\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2064333064313363313965376338383934303762326263306430376166613539310d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"85940fd5-ca78-407d-9f5d-34d7b00daa9e","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":13},{"timestamp":"2026-10-18T11:34:05","port":5000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"255bb8fc541ab888c2a67ce9c958308e\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 255bb8fc541ab888c2a67ce9c958308e\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2032353562623866633534316162383838633261363763653963393538333038650d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"cf04f08b-5cde-4ddf-b5fa-4ca71408670f","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":13}],"http_methods":[{"method":"GET","count":39},{"method":"SSTP_DUPLEX_POST","count":6}],"distinct_ports_total":37,"top_paths":[{"path":"/","count":33,"ports":16},{"path":"http://probe.invalid/","count":6,"ports":6},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":6,"ports":6}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":7}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"0067d076ec255f1e2ef58212944a93a0","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[]}