{"ip":"45.58.168.128","data_as_of":"2026-10-26T11:43:24+00:00","observed":true,"total_events":154,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,986 bytes sent","bytes_sent":19986,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-14T21:35:16","last_seen":"2026-10-23T06:15:13","events_24h":0,"events_7d":86,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":46844,"org":"Sharktech"},"source_domain":"customer.sharktech.net","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1067,"proto":"tcp","label":"","count":7},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":6},{"port":31113,"proto":"tcp","label":"","count":5},{"port":59210,"proto":"tcp","label":"","count":5},{"port":4443,"proto":"tcp","label":"","count":5},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":5},{"port":59100,"proto":"tcp","label":"","count":5},{"port":60000,"proto":"tcp","label":"","count":4},{"port":3000,"proto":"tcp","label":"Web-alt","count":4},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":4},{"port":50100,"proto":"tcp","label":"Cassandra","count":4},{"port":12333,"proto":"tcp","label":"","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":11000,"proto":"tcp","label":"","count":4},{"port":2087,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303cd0c770344ccf09c0fc362480fba6c16d0cfce28af0a920f942fd40b91db820720dc169af16a2032af5b17cdd79d7f4ade74ae514b307625938c285c48fde38b14001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c06a54936d7b571f046e66b6402745bca060b1634ba1eb4c9ca58438bd30b8caa1c45cc5197c734adbe11fd9a0996d153f5fd613223001fc1c572a110169954a2f750350864eeda5b419748e79227f3759c774f31e90b071f933ca3bc96d0097316c7b026613c686fcb149b12399a8325d254edbe178eda5854175a0817a8a77164edaeb5bcef059cda76bed9869d27bb0c987b0f9927a7d0c713da65c0cd3b18a25225c002571a427c4ba693e822b1064a2fce78c214471fd08017a3aac9a2bcd99311a48f8372461a9c695bd63ca03ad2614434414a4fb3aa21924382263e4a94d4c645cb665ccaec23657e0a47adb52976390ff803d33e72ff4929481b8920b1867ad23426f2b0fedc44bfa65b482fa27fb87c05328ca5ca52f309a4d7cab87a97ac3e31cc154c4003b8a278393a5ef64621f070a95d43975b153af0979863a631ba64775753babfb9c58b6a9c8a94ff3f6077749ab3b76ad6280276afa5558e4ce29c327333c466cf3c007b889fe541509d5377e78a3168a992907b29ce4bc4bf06a2303c48d093c9ce945dcf52a46a4bc95f7261db113f8037b517bcb8dd4baea9c69ca69451216036c804abf332a887262793413e35930c8aaac6515c364c51e3b997e609443427115be5195b8d09c77448b74123f40d648244c1c34147e39f00713b64f47961b2c885c36d3b68c3a8d5f921bd78743c1b482f39a8abb35b878cacd95911a562b202b980b8dc3a51fe1a9f36856d02a6217c19293076bda97876ec43169968ad1daa848195bf58535500607f57726ea9833ecfc08b9b63d7adcab623a31b9b69ee2962eeebbcf05e92a308c53eb90a521819766533f813740a34a6aef5c0c493815499582f9160f4f9586848aadc77ba5ce0a4d653a6d4df4348e9a0b530bb89a85552b4455d192cb22a595ea37b4b7d2c8ed1b630bb4557cb8a2a03974d860cca2ea4abca8a998a48d5e2b29b8cc0916f839af6140d91ca68fc58f8e4b7696a249aaab7ba2c44112db86721252e759491a816b17e72df5a01bd0eb17445492dbd0261916cb95ba1831c81d89207b3e0a87099265f494c26e778c8a1c317261a5411996f2401329ec6c760b1b65e46a04b17bec4246238820af5aa10e651777e96ec80bbefdd2add6cc439bf2099d157e9f652fafb0af9d154bd4203d568cac39ba5b3d1c9830ccb8f19b9e18887b87873dc1bb74349425c300bbdd28540ba385000aab525593a28b0cbaba3eceb9088cb16bb5268f00b66f86010287843b7c80ad7bc5cec3b1c8b22b0226dc791ef0b638c467938a184924794f9535d0074508f49624ab270430335c28c98f917521f4522ce182c9c1ade9dc9b0ee781cfcc0b0357c305f94587d0b77f908a195215fdb77c155345e35155052a83a0624926a8cba94710dd7984e7e028c28110c3cc49a5ca0801ac12bd08add06cb6595c38a0354ab26798db62ad2c374c3aaa1ccf75b86f8a350ac3b8f8aa39a7e45578aacb6dd844a060b194d631f1dc19c522caf2e42f88d3786fb43bfd214e7f2a990ea18d57b821df798ebfac098ec0a42195afb278232101395c64a7d4247e42919b3bc73007f263d701038db992b2351c89f1b5e6ab8c6f371fc4b709fbad0a91f021675e96bcd036f22ff747461633b8252d7c72bae9f98c09d4d68ceb67de0274b650bf3a11b245065d7d3c058ae648afcd546c1225ff5c1d001d0020d4d68ceb67de0274b650bf3a11b245065d7d3c058ae648afcd546c1225ff5c1d","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":76,"16443846184eafde36765c9bab2f4397":45,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":3},{"date":"2026-09-18","count":1},{"date":"2026-10-04","count":2},{"date":"2026-10-08","count":1},{"date":"2026-10-18","count":16},{"date":"2026-10-19","count":84},{"date":"2026-10-20","count":34},{"date":"2026-10-22","count":6},{"date":"2026-10-23","count":7}],"recent_events":[{"timestamp":"2026-10-23T06:15:13","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"4fba76c89a61422fa91b51b8014914be\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 4fba76c89a61422fa91b51b8014914be\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2034666261373663383961363134323266613931623531623830313439313462650d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"3156dfcb-cb47-46e3-9420-13143a81cf64","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":13},{"timestamp":"2026-10-23T06:14:23","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"f4fd413259b73e6f3d3e05b7fb89cfbd\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: f4fd413259b73e6f3d3e05b7fb89cfbd\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2066346664343133323539623733653666336433653035623766623839636662640d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"5be87fad-a892-47e7-a6c1-7283ffaa453b","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":13},{"timestamp":"2026-10-23T06:13:52","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"2035e9a571fa2716f3ef85b8aa80a278\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 2035e9a571fa2716f3ef85b8aa80a278\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2032303335653961353731666132373136663365663835623861613830613237380d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"d34fe238-7df5-4758-9963-634e3074687b","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":13},{"timestamp":"2026-10-23T06:05:21","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"2ed9a8f4-19d5-4015-8f7d-6528b4e5abc7","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-10-23T05:57:39","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�)�R�4�#\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38bd29b452bd34bd230000000000","method":"","user_agent":"","ja3":"","session":"ec3648cd-1c36-41ea-b81f-8ca1a6d75046","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":13},{"timestamp":"2026-10-23T05:54:26","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8��\u0004��1�-\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38e09804d3d631e42d0000000000","method":"","user_agent":"","ja3":"","session":"1905d9dd-a368-47f3-b7b0-62b512ab279f","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":13},{"timestamp":"2026-10-23T05:27:42","port":6443,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"cfa2911e-4fab-4e3e-ba9c-9f5f3333ee75","seq":1,"duration_ms":101,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-22T17:10:59","port":10005,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"bbcd2697-9461-41a0-832a-658e64a159ac","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-22T17:08:51","port":12345,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"38b18b35-ba4b-4895-9ff3-e55cf8f98e56","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-22T17:07:11","port":59210,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P�\u0000\u0002\u0001\u0000","payload_hex":"04010050c000020100","method":"","user_agent":"","ja3":"","session":"0b4574a3-d8e6-46b1-82e4-d23970d86eea","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":13}],"http_methods":[{"method":"GET","count":79},{"method":"SSTP_DUPLEX_POST","count":37}],"distinct_ports_total":65,"top_paths":[{"path":"/","count":57,"ports":43},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":37,"ports":33},{"path":"http://probe.invalid/","count":21,"ports":20},{"path":"/metrics?collect%5B%5D=uname","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":21}],"top_alpns":[],"banners":[{"value":"SSH-2.0-synthient","count":3}],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"4fba76c89a61422fa91b51b8014914be","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[]}