{"ip":"204.188.254.228","data_as_of":"2026-10-26T12:35:33+00:00","observed":true,"total_events":45,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 36 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,185 bytes sent","bytes_sent":11185,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-14T21:24:14","last_seen":"2026-10-18T11:38:37","events_24h":0,"events_7d":0,"interactive_sessions":36,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":11},{"protocol":"tls","sessions":6},{"protocol":"http-proxy","sessions":4},{"protocol":"sccp","sessions":2},{"protocol":"postgres","sessions":1},{"protocol":"ssh","sessions":1},{"protocol":"socks5","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":46844,"org":"Sharktech"},"source_domain":"ref-embedded.accenttrip.com","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":36,"first_seen":"2026-10-18T06:56:27","last_seen":"2026-10-18T11:38:31","verdicts":[{"verdict":"scan","sessions":28},{"verdict":"unknown","sessions":8}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":11},{"persona":"proxy@squid/5.7","sessions":4},{"persona":"sccp@CUCM 11.5","sessions":2},{"persona":"postgres@12.18","sessions":1},{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"sccp","port":2000,"sessions":2},{"protocol":"tcp","port":10011,"sessions":2},{"protocol":"http-proxy","port":3128,"sessions":1},{"protocol":"tls","port":12333,"sessions":1},{"protocol":"http","port":443,"sessions":1},{"protocol":"http","port":30755,"sessions":1},{"protocol":"tls","port":3120,"sessions":1},{"protocol":"tls","port":30755,"sessions":1},{"protocol":"postgres","port":5432,"sessions":1},{"protocol":"http-proxy","port":51765,"sessions":1},{"protocol":"http","port":61234,"sessions":1},{"protocol":"tcp","port":59210,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":28}]},"top_ports":[{"port":30755,"proto":"tcp","label":"","count":2,"sessions":3},{"port":8886,"proto":"tcp","label":"","count":3,"sessions":1},{"port":2083,"proto":"tcp","label":"","count":3,"sessions":1},{"port":29842,"proto":"tcp","label":"","count":3,"sessions":0},{"port":62345,"proto":"tcp","label":"","count":3,"sessions":0},{"port":19999,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10011,"proto":"tcp","label":"","count":1,"sessions":2},{"port":3129,"proto":"tcp","label":"","count":2,"sessions":0},{"port":20007,"proto":"tcp","label":"","count":2,"sessions":0},{"port":53,"proto":"tcp","label":"DNS","count":2,"sessions":0},{"port":2100,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10005,"proto":"tcp","label":"","count":2,"sessions":0},{"port":64249,"proto":"tcp","label":"SSH","count":0,"sessions":2},{"port":992,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":2000,"proto":"tcp","label":"SCCP","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303f18ea01b7580fd9e98efeb3a607c0783b0de5ed32c54c5ac46d5ca9d0a6d91f32091c2f0e00a22cf4f5c4fa23af154fb719e7af8b66cee62c23d617954277becb5001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0c00c2e7b0c7d2786504fa81414836f69000ed218ccd4dbb3eea40d9ea451a40003454626769a0b52863175664930d838b40293512695817b385bd7235062a5df71cfb465805a660fb205cdfb5a067d932ca00125e5b80203a31f7f712badaa4d3b8a6cf46b764caca878a273d0397dde873c94aa872eb317a6192dcca5aecf108a8ca6623df17b0f360a2f38068f41cd7f4222f4c52d28b856daaa539f7499ffc1732c0b8510e287f6fa0cf035526c1ca5b09887ab7a73f23c4a8fd34b9f7238e3922635b826fe9573f0042181146bf5065390f026a00975604a9f0185b789e083b6a5901f33bb0f734602661f3bcb9cf004cd4ae9bea8a06bc3fb8877f9a62cb3ce89d23aba598a185b936200a7a3506a422b52bee0c202b11d35473b752a9e61a30e88c14174368b26f567186415e8743be2593321aa0e97549300c468b3d92d61a824c6e8ba1aac7291d48a76f02a87c9ab58779a28c12bb43536e0c273c8367a1df8b4b4759c77d565da0ca73893472c129ccad54cd5759e939abf552019d78575f7689d1f581ea0b08da0b81ed13b9f8a74ad01d34445c070e48ac09d179f1debc4adb61caa578f5798939235ba64e83b3fdc9a56d14b5ab9b12e644bfd2525acb0bb9ef62cb16a6221925e8d2a1a0d6b8a02e388ddc3547d485fc58279f13caa72e127cb3c72ae7541bc596bb33c61868169c71c2c63e384d82b0abd1220efc85928105a93b4cc981a524c52602255bd60409ebd52b0ca196978525191174ed4d0c03dd5304b47aee0819d625cb4569229a54571d09897d3ab2804754a56962be170667b55a0304b997558228b31ca4540a2046302ec076f18b50291bbcedcfcb7ccc263e2ab5061a255b6e6061ff5bef04951d973cc7d06caf719512e3012e85a22f12cce02582b6ba52392f756faa46820cbafa002b8278142bcfc32f13c8c9d430d4809cf9133b6e7939c3b311cacec3fc6d335660c9e1ed28ae0888d5cbb60e4f2a45d318fea26aa287423f206cc0d72610b41a48f033591e0afb124c5a15cca6781b89fdba71b52a0bdac228ea1bd7a1abe03064a393c9d4c8b0d42e854e2e3489d140e143796786b9a6c0a9b2b2851b9b16988db90237a47289979d89759dd75452e46695c8211d3cc675b7958918bbfea8867dd60bd428338a251a9ec432d3d005adb0c9221241db82a859153b582432d8f73cebd6856b3b6c209d99149538754a1c85e331db077517e6a3a3715cf4bbbace7bb7574a0a9a90151653148ded64a69046ed874c4355a5b00fb8bb284538dc5557998cf9f3333f4310b82d4c20b78668c4304912b4769eba15e173222a208862703dc07774e199d5578c7c61a24ee1c68e2297d62f76ede77917ec6a0636a4f1ddb6a61209f6c4837b35280be795c489c6eab37ae6b9c1f03d64bf0a0294499bb972973db52c74677788b0c54c7fa0f84a45f024b9e98a686f3e9b411a32f838157ba623a449cb43cea2549a48240e772b96a8afea45eff06b464684ee387a0b2c4acf337b7db671d2d206e2f969835595adf20a4f8987f77f2794c430d5d1b174fe9c1a9d58b37d385a9a9b073436996db792433077bdb97bcc08c78fcc23d9b79b8e6bc49085c418780a40535370fa58092758b6888b6925bb5f0c470c1f86ecbdf0f332db61c16d10a88bad1a01931bc35db5f1b418e8dcdbc51d8f48d98837f41cf605d6b2c001d002016d10a88bad1a01931bc35db5f1b418e8dcdbc51d8f48d98837f41cf605d6b2c","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":70,"16443846184eafde36765c9bab2f4397":45,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":2,"sessions":0},{"date":"2026-09-18","count":1,"sessions":0},{"date":"2026-10-18","count":42,"sessions":36}],"recent_events":[{"timestamp":"2026-10-18T11:38:37","port":63260,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"a09e1611e3299fa180ffffd0727ebec2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: a09e1611e3299fa180ffffd0727ebec2\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2061303965313631316533323939666131383066666666643037323765626563320d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"7280d221-cf78-4191-a4d1-ce58a1506034","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:37","port":62345,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"54037a70228e9a448ad637328627ad88\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 54037a70228e9a448ad637328627ad88\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2035343033376137303232386539613434386164363337333238363237616438380d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"2c6ed887-2efb-496e-ab4d-9be4d62789b0","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:29","port":51765,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 9bf5c92a54a0257fb84b05cfc2b6ef7e\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2039626635633932613534613032353766623834623035636663326236656637650d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"d929b368-e680-4f49-b522-debb3ea3ca05-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"040542842ccf9958","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 9bf5c92a54a0257fb84b05cfc2b6ef7e","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:16","port":32325,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"b5da335084743f1e94709cc77bc20f55\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: b5da335084743f1e94709cc77bc20f55\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2062356461333335303834373433663165393437303963633737626332306635350d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"a521dbea-3703-43b2-beee-fc3d608cad10","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:38:15","port":31113,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: f3e486f09b0b8c3a366bd5045504253f\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2066336534383666303962306238633361333636626435303435353034323533660d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"5a09dbea-b718-427b-8945-f2834a30ac2e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8de1457a18b8b078","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: f3e486f09b0b8c3a366bd5045504253f","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:11","port":30755,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 988c888e2969b35ee010a2886a0faccb\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2039383863383838653239363962333565653031306132383836613066616363620d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"57a63fb4-ff9e-48c7-b034-040a4ad243c6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4a1fbf07696283b0","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 988c888e2969b35ee010a2886a0faccb","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:38:08","port":20013,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"a5bffdbc9f37a7721954be4a7f6c35c1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: a5bffdbc9f37a7721954be4a7f6c35c1\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2061356266666462633966333761373732313935346265346137663663333563310d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"fdb14551-2473-411b-a3a4-ae8ae3c4795b","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:37:47","port":12333,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 2fe6fd9ba3a26d3c45ce1ae046212596\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2032666536666439626133613236643363343563653161653034363231323539360d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"06781c68-56ce-45be-a50b-bd8e2c18ee8a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"12243f144a341ea7","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 2fe6fd9ba3a26d3c45ce1ae046212596","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T11:37:38","port":11288,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"c4548eb0f679aee0483bb975261da9c3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: c4548eb0f679aee0483bb975261da9c3\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2063343534386562306636373961656530343833626239373532363164613963330d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"a0d730b7-f3b9-48f8-8697-d3ea1563e33f","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15},{"timestamp":"2026-10-18T11:36:13","port":8886,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"89446d3e62cb83130fecfe1c8d93f965\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 89446d3e62cb83130fecfe1c8d93f965\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2038393434366433653632636238333133306665636665316338643933663936350d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"7ad9bb50-5722-4f4f-85b2-2f8ac9fb5891","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":15}],"http_methods":[{"method":"GET","count":35},{"method":"SSTP_DUPLEX_POST","count":13}],"distinct_ports_total":42,"top_paths":[{"path":"/","count":30,"ports":15},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":13,"ports":13},{"path":"http://probe.invalid/","count":5,"ports":5}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":8}],"top_alpns":[],"banners":[{"value":"SSH-2.0-synthient","count":1}],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"a09e1611e3299fa180ffffd0727ebec2","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[]}