{"ip":"204.188.254.146","data_as_of":"2026-10-26T11:44:33+00:00","observed":true,"total_events":43,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 36 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,763 bytes sent","bytes_sent":9763,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-14T22:03:32","last_seen":"2026-10-18T11:38:39","events_24h":0,"events_7d":0,"interactive_sessions":36,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":8},{"protocol":"http-proxy","sessions":5},{"protocol":"dns","sessions":3},{"protocol":"socks5","sessions":2},{"protocol":"tls","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":46844,"org":"Sharktech"},"source_domain":"pestered.accenttrip.com","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":36,"first_seen":"2026-10-18T07:01:20","last_seen":"2026-10-18T11:38:39","verdicts":[{"verdict":"scan","sessions":18},{"verdict":"unknown","sessions":18}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":8},{"persona":"proxy@squid/5.7","sessions":7},{"persona":"dns@dnsmasq 2.80","sessions":3}],"services":[{"protocol":"dns","port":53,"sessions":3},{"protocol":"socks5","port":1080,"sessions":2},{"protocol":"http","port":59060,"sessions":2},{"protocol":"http","port":443,"sessions":2},{"protocol":"tcp","port":8888,"sessions":2},{"protocol":"http-proxy","port":3128,"sessions":2},{"protocol":"tcp","port":65533,"sessions":2},{"protocol":"tcp","port":6666,"sessions":2},{"protocol":"tcp","port":12000,"sessions":2},{"protocol":"tcp","port":10005,"sessions":2},{"protocol":"tcp","port":3000,"sessions":1},{"protocol":"tcp","port":64249,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":18}]},"top_ports":[{"port":51765,"proto":"tcp","label":"","count":4,"sessions":1},{"port":1723,"proto":"tcp","label":"PPTP","count":4,"sessions":0},{"port":10005,"proto":"tcp","label":"","count":2,"sessions":2},{"port":59060,"proto":"tcp","label":"HTTP","count":0,"sessions":4},{"port":2053,"proto":"tcp","label":"","count":3,"sessions":0},{"port":12335,"proto":"tcp","label":"","count":3,"sessions":0},{"port":30755,"proto":"tcp","label":"","count":2,"sessions":1},{"port":61234,"proto":"tcp","label":"","count":1,"sessions":2},{"port":53,"proto":"tcp","label":"DNS","count":0,"sessions":3},{"port":12345,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10011,"proto":"tcp","label":"","count":2,"sessions":0},{"port":58688,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9100,"proto":"tcp","label":"Printer","count":2,"sessions":0},{"port":3120,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303c580765ee927777dd4dc1a2306075f947be11fe477b4f444b4d73b81ed8dd1f42056c557bc824f3ebda4b5584e0302ad724a2c4e1e019526f25150c4865f556d89001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c049b77624928f690277ef0297de7c2d6f00bc7edc1465911b4c0a643fb31c8ab9a731446c1f1b5194d9be796359dc10112a435399041875101fddd6664e8a4f7f534131faa4abe2a5b5e80bc5b2b70136993d0040e7a49f806a2b3b4448573c9c2b647a7f28c80a037b5c09552ef2a125b910bd69b31a1c3cf4159532e81b00232ff3ea56103aaf16cb0daa52b3a429b819961033282b158a84ad4101c141bccd0b94ae46805cc0930fcc9c0acc581b35174269509c5960eef6b0a0c9b450db608d120c792b6807cb9854c22236399cfa30aa91597288433b66db2d35494ebafb3c35ea6d67e6cdf8da35419b463a103cf19108359ca27eb34037ac1d27bc7dd23a2356e678b83748be25978c7c7bae77147aabb3755ca3a3b5794726bec9ea3313c023cf7550ba60970fc31062a6566768b52e585788b4ca2b961de9e850f731af92a56dbebb7959958a65cb4d7eb818e85cb9d5d71615a56ff7762b4d470e4be5596a45c3c9d85df119717945117168ce575733b344c5a51c40aae6ca9176967315cf47433f1dc84c80db1ba347a57d17a08cb3a822a325f355451ae28048a863b7853853f96ef7f58e945567ef53560e66aff419a93a4c3294376a6fc418dd363f2f983fe1633179e07d1eab7a4b093d0c78cbc430b64e1c7e2cc6039b6589ff62acafa66759e80e8b435c37842a8ab8808fb584d571c74575193e747ff338b01b3167eb963c6af475840233e38b49d3f888549293e389702b72bd434c5f2b3784fb5aa912e3ca29bb9724088f8b73155074cc6f2bcd0a270b00a923bbfac7f515052571a6d7b269fdf28f4ba646b2f70f1bcbc3c8297f862931524a5faf5b43164454bce4030bc4a31e580a19891fd9f85455e337b7c5aa46774b6ca8a707860649605d83a1cd89ab4877444c0eda04a6b85dbaeccde207395e53c6e1dba39d89b61bb5b8d18972874a0171e80b55c7c24da03c28b05f90756d34d6608bf8287c3a8b30a38b3f799fe3f2a36682a747177f79c6939cd9478705c7d139a6796971f7273ff5e341ff456ebd185ff4ab0ea5dca8a976138a921e1987c9ee68a6bd1829c1d5225270a33ca84124211bd0032902dbab46317d4f904a190731089123ed1aac1efa9709d68aa14399109199d4288c77aa0f9c9c08eb99c97be437850aa6755013d831471575041e0644d805c0c6a3aa35f2be3f418bbae01e2e3bb7d2437a82e981c2aa9509593e308bb3ccc06f3ab9b35d17c29f50abae6c112ea7cc2f9a95f740839f99a9b09ba285180f44d06eb113a35876494be39b37d482085954769807dd77b4abe987ec0426e37b5edd660c4d42c195571596da62ab9bba51a422edc1b7049c4c69fa0dd3a1112611632ee13442f1a31e8ac6583a77c0cc882e182b37c7cf6a490303148393069986295182e366deb71363c18e5cd495e93b9bf1a7a4c181ce4d38726a572d51279fd2b9bddf92509957722d2c0440541f6821a645e3773112705a3c2d54023ec6442f5d59448ba2a8153707cea578cc100f70d5cc1c33a1b12b202dc1c0d37120741a7d1ce0c571071d54c788e1d99f8c9ab6bdb062d0459b85eb6630f9a4961c9f0ce56a5fe54b9ab070d836abbc86aacb4e811bde578fe39a6c2f7fedfe2005554f22491a69757f1b496f6456794b845a0ad16ebddbfff4db3e32a3f9751e494b5cf044217215276e31a0e4f8eb384a001d00205a0ad16ebddbfff4db3e32a3f9751e494b5cf044217215276e31a0e4f8eb384a","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":76,"16443846184eafde36765c9bab2f4397":45,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":1,"sessions":0},{"date":"2026-10-18","count":42,"sessions":36}],"recent_events":[{"timestamp":"2026-10-18T11:38:37","port":61234,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 3e6bae4b3e99606e3a987cc2ec2733ec\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2033653662616534623365393936303665336139383763633265633237333365630d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"c68a66ac-57d7-4cc9-9047-8df517df0fdf-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"422e1f2c431a92fb","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 3e6bae4b3e99606e3a987cc2ec2733ec","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:29","port":58688,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"a7a82363bce21b884c4ead87291e53f7\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: a7a82363bce21b884c4ead87291e53f7\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2061376138323336336263653231623838346334656164383732393165353366370d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"c3e8fc98-0a3b-4474-9742-7210cc314126","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:29","port":51765,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"c767e8bd45fc9e17a21c389696f6bd9a\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: c767e8bd45fc9e17a21c389696f6bd9a\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2063373637653862643435666339653137613231633338393639366636626439610d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"abedf468-2edb-4d78-8bdd-49a69a551d1b","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:53","port":19999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"f03f5bf075ccf0d2f2eed96db0955d9d\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: f03f5bf075ccf0d2f2eed96db0955d9d\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2066303366356266303735636366306432663265656439366462303935356439640d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"f9e2913d-e877-4b05-b5dd-74da8f132274","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:48","port":12345,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"e84009fae6c8a1c3d187f48658b0c98c\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: e84009fae6c8a1c3d187f48658b0c98c\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2065383430303966616536633861316333643138376634383635386230633938630d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"163e026e-7e66-4518-be0e-c4ce02b1d681","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:47","port":12335,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"96ed3c15f975968a2f6a07b207967736\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 96ed3c15f975968a2f6a07b207967736\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2039366564336331356639373539363861326636613037623230373936373733360d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"47d7f4aa-9b9c-4739-a4a6-bf422ccfc6e3","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:28","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"51b5a07f31a03c3d5a6c8308b725d35d\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 51b5a07f31a03c3d5a6c8308b725d35d\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2035316235613037663331613033633364356136633833303862373235643335640d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"e2ae1fbf-d743-480d-8e15-f877628761d0","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:08","port":10005,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"9e47dd82fcd1e6bbaefd7561daf86e89\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 9e47dd82fcd1e6bbaefd7561daf86e89\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2039653437646438326663643165366262616566643735363164616638366538390d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"b2d240e9-7a1f-4f5b-a0fa-5c3c40d41a78","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:36:33","port":9100,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"295689ee5e922f3a7d56edde0f5f1cb5\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 295689ee5e922f3a7d56edde0f5f1cb5\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2032393536383965653565393232663361376435366564646530663566316362350d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"14ef2ef4-c119-4e41-a280-66dea0c28fe8","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:32:45","port":2053,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"b41d374221f6840c38c529bb871a85b3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: b41d374221f6840c38c529bb871a85b3\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2062343164333734323231663638343063333863353239626238373161383562330d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"a45d15f0-e44e-43c7-85aa-6727576d3104","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15}],"http_methods":[{"method":"GET","count":35},{"method":"SSTP_DUPLEX_POST","count":10}],"distinct_ports_total":39,"top_paths":[{"path":"/","count":27,"ports":15},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":10,"ports":10},{"path":"http://probe.invalid/","count":9,"ports":9}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":12}],"top_alpns":[],"banners":[{"value":"SSH-2.0-synthient","count":1}],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"a7a82363bce21b884c4ead87291e53f7","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[]}