{"ip":"204.188.254.145","data_as_of":"2026-10-26T12:35:15+00:00","observed":true,"total_events":64,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 48 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,095 bytes sent","bytes_sent":9095,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-14T21:15:36","last_seen":"2026-10-18T11:38:37","events_24h":0,"events_7d":0,"interactive_sessions":48,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":10},{"protocol":"http-proxy","sessions":4},{"protocol":"tls","sessions":3},{"protocol":"ssh","sessions":1},{"protocol":"socks5","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":46844,"org":"Sharktech"},"source_domain":"brouter-better.accenttrip.com","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":1194,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-08T13:06:59","last_seen":"2026-10-08T13:06:59","recent":[{"timestamp":"2026-10-08T13:06:59","port":1194,"src_port":44683,"proto":"udp","app_proto":"","app_protocol":"","summary":"8���\u0014�8��\u0000\u0000\u0000\u0000\u0000","payload_hex":"38e49bf714c438c6e50000000000","sni":"","session":"8fc0e06f-c18e-459a-868c-f71d3b231e92","bytes_in":14,"source_verified":false}]},"interaction":{"window_days":90,"sessions":48,"first_seen":"2026-10-18T06:56:02","last_seen":"2026-10-18T11:38:32","verdicts":[{"verdict":"unknown","sessions":28},{"verdict":"scan","sessions":20}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":8},{"persona":"proxy@squid/5.7","sessions":5},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":2},{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"tcp","port":10000,"sessions":3},{"protocol":"tcp","port":3000,"sessions":2},{"protocol":"tcp","port":12345,"sessions":2},{"protocol":"tcp","port":1180,"sessions":2},{"protocol":"tcp","port":11000,"sessions":2},{"protocol":"tcp","port":20008,"sessions":2},{"protocol":"http","port":443,"sessions":2},{"protocol":"tcp","port":44444,"sessions":2},{"protocol":"http","port":8080,"sessions":2},{"protocol":"tcp","port":50100,"sessions":2},{"protocol":"tcp","port":2087,"sessions":2},{"protocol":"tcp","port":59100,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":20}]},"top_ports":[{"port":943,"proto":"tcp","label":"","count":5,"sessions":2},{"port":5000,"proto":"tcp","label":"Web-alt","count":5,"sessions":0},{"port":32233,"proto":"tcp","label":"","count":4,"sessions":1},{"port":59100,"proto":"tcp","label":"","count":2,"sessions":3},{"port":61234,"proto":"tcp","label":"","count":4,"sessions":0},{"port":64249,"proto":"tcp","label":"","count":3,"sessions":1},{"port":4443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":9443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":9100,"proto":"tcp","label":"Printer","count":3,"sessions":0},{"port":10000,"proto":"tcp","label":"Webmin","count":0,"sessions":3},{"port":1194,"proto":"tcp","label":"OpenVPN","count":2,"sessions":0},{"port":1723,"proto":"tcp","label":"PPTP","count":2,"sessions":0},{"port":2053,"proto":"tcp","label":"","count":2,"sessions":0},{"port":29842,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10443,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303eefd600a11f547a1ae85bb162fc312cc0cae3f1dcfcfb8431792f0ef9839629e20a5cd948aec3443a3a206ee29a8af57566daebb51b195593f23f37f762da7afdf001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c009ca09ca19ae762494b8983963f4cb9fda4cd48a77a4a18f4ae284e4a10aa3406720e0c1a807b84a948a0512023adc5c801660fae3462f0a3735d1ab9c94b395733351ba3c09d48029b6b0251bbec92156f8454975047ef2f7b1fcfa8448a55473826bd7d421a89b9501514995a71c8365b1cd594fd8c4bb16c766c8425715693752752001f2aa5e1ac93ff2a04626204456950d146f99d5799b2437edc71d3a63133af418aa66305d08c93c93ad95b96b21970d61db44e6f0bf5794a6bb19a97ed384fa879b0ac48bfdb02ac264a1c5f90c65089c1d381eedfa58f934bf43e6cb3a52c31b858af1705e5eebc1c01a0d4ad36e2b30aa380aaba1c43124548033a53a95f3ba92d85aed7ac63761a9a7987e58bc193506086e4c422ce9b782940e70c7b66c8100838583b5b605f6a3ae55987e35235951099744f44727da33ba901dbbb3c5548870cf3c0c186546f4072abd0b7e1084cd49304442c320ec951f30b81f9677cb52405a4889225b2172e0910c71f54729836a17a848f13986a508a9f46c89edd57f00fc9a7106b488080cdafc73d4c851a03802daf2c7f8db0e38509ad434b180b20e542177d0652232e8797877cb0f4a395edb9fe1e3b87ab10691e18b7556cbe88c5eb4c2611dca779f41cfda11703b383828123771e6686dd59420ea6ec9708cee673b5d824fc582c9c1e78ccfe104d7d43c4a5b0362d31bcd5aaa25a7c47debb527ca1e1ab6408d168722d24066873b4673152be82d3585a34a18b7e67482c6e6ce0443baef1a1b8c09bfb4ab188fbc12562060c431b0fe512ad8d1c91d7716fbc04a5e7462d1231cfc274c060a129b5486deb701aad10045c7501e22c9d509a5f90541a8b7c2c71a1b14e4afc039211cf20de7742f0e830c3c878b704116b4e7b200d2a60e67394c3cb369b75cd9f0bffa5ca2c263296ad83d730b8a72e30e438715562792abc777bc75b63f4b7258db02f8540138c04a5b9b6c63b341d481a54f903fdab73ab4d58ca6058d8138c7ee9b5af4ccbc9674421d74aedd384249ac14ca1304609b78318342d2f55f85e67157c94af51255fc575121b8c7e7172efb6755458237c1b51e48bc222e2274d46660878c154c58a211953dc87304fdd48d5ef386cec678bdcc6bf2b255139b7661320c64a91f19c95eaec8a5534b2c921ac12238b17ba0b64f64314db26c10a64a18815bebe85da7aa3158e049698457a37c4f0d3004f2b3b5df072dc2e8355c9331e6d3bbc02b9cfbc9a788059deec1b532c544c6502ce3bc5cd346317fd0a932596e5a847a8a5b66eb3aac74d0c181e97a9c190ef4b958a0498c1280435f43beda66bc9aac00b7f17843e335fd17180bcb663964175064694b955a22725b9e0900dbaa2440503f8f2c7f91b4c66dcc2384cb434cd9a37861b33311a7aeec366ef9084c4c8e19305c753961923aba05bcccf9ea0d2b37b323f18ac753711e591c9ff50826516631659e7250601e051b265a01f99348108806738b4a89db501a57461b29625c857675cca6128bb22ab314ad70788ac48a63181532051b7919721d6abce3e22529ba7f7b4360c4498d40f586029c3cfaec022973b4a42b15e92a8cd25b19146b205449437008dbbfe1859c171abd5d826624182a89fbfaf9042ae297f1cf5fa337b138d4e3232f5ea6cedd2a3f4e1ef42b417ceef6271d0b2cf9d09c1e5d2c7ceb79e66a001d0020e3232f5ea6cedd2a3f4e1ef42b417ceef6271d0b2cf9d09c1e5d2c7ceb79e66a","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":70,"16443846184eafde36765c9bab2f4397":45,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":2,"sessions":0},{"date":"2026-10-08","count":3,"sessions":0},{"date":"2026-10-09","count":3,"sessions":0},{"date":"2026-10-18","count":56,"sessions":48}],"recent_events":[{"timestamp":"2026-10-18T11:38:37","port":61234,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"03f16ea6c77da446a8f7395d6ddf5cdb\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 03f16ea6c77da446a8f7395d6ddf5cdb\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2030336631366561366337376461343436613866373339356436646466356364620d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"f2f7ab3f-e951-4269-9edc-fc9cbc92b66a","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:30","port":59100,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"bb37d0f9892f5d0afd27df4f82ce4552\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: bb37d0f9892f5d0afd27df4f82ce4552\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2062623337643066393839326635643061666432376466346638326365343535320d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"6bf117eb-ef56-4963-bf44-e65be2ef8390","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:30","port":59100,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: adf1ab78c2512b38a1ac2058f40b96d6\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2061646631616237386332353132623338613161633230353866343062393664360d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"86f548b6-9dce-4dde-95ca-7fe75483d25d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6d2dab9c2c3961d6","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: adf1ab78c2512b38a1ac2058f40b96d6","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:15","port":32233,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"580a39f9845dd506f8a0b99fbaaea052\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 580a39f9845dd506f8a0b99fbaaea052\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2035383061333966393834356464353036663861306239396662616165613035320d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"b4806820-b7e7-4e86-90ef-349c5ebd182e","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:14","port":31113,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"f20fbdeab3c3a063eb283f4290aa911a\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: f20fbdeab3c3a063eb283f4290aa911a\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2066323066626465616233633361303633656232383366343239306161393131610d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"db85b73b-f72b-413f-87fc-c743e51bfd2c","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:11","port":30755,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"b79138c8596a4663c016830b2cbfa218\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: b79138c8596a4663c016830b2cbfa218\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2062373931333863383539366134363633633031363833306232636266613231380d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"20f6494d-92a9-44fe-a5e4-0454095221df","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:10","port":29842,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"db9fd45edeab3aea5074e284bfd4e52b\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: db9fd45edeab3aea5074e284bfd4e52b\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2064623966643435656465616233616561353037346532383462666434653532620d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"237d026d-b289-4a76-b458-aa075cb3a191","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:38","port":11288,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: a1202a96f9b608f6732a10131a85741a\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2061313230326139366639623630386636373332613130313331613835373431610d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"a03b1866-5494-44ac-ad4b-9fac661a306d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3e0954213b871200","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: a1202a96f9b608f6732a10131a85741a","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:36:00","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"6bb5acdb1601227e2906a9d735dcf339\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 6bb5acdb1601227e2906a9d735dcf339\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2036626235616364623136303132323765323930366139643733356463663333390d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"2c6a62c5-926c-4ccd-8588-01fa07e98401","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:33:13","port":2677,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"4ee2f8f63dbd7e7b6c4c2aee1997a90a\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 4ee2f8f63dbd7e7b6c4c2aee1997a90a\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2034656532663866363364626437653762366334633261656531393937613930610d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"8eec8b0c-6e29-4926-be14-a7f60144248b","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15}],"http_methods":[{"method":"GET","count":49},{"method":"SSTP_DUPLEX_POST","count":9}],"distinct_ports_total":53,"top_paths":[{"path":"/","count":36,"ports":19},{"path":"http://probe.invalid/","count":12,"ports":12},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":9,"ports":9},{"path":"/server-info","count":1,"ports":1},{"path":"/metrics?collect%5B%5D=uname","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":16}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"03f16ea6c77da446a8f7395d6ddf5cdb","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[]}