{"ip":"45.58.168.195","data_as_of":"2026-10-26T11:43:31+00:00","observed":true,"total_events":178,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,651 bytes sent","bytes_sent":20651,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-14T22:26:42","last_seen":"2026-10-23T06:17:31","events_24h":0,"events_7d":87,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":46844,"org":"Sharktech"},"source_domain":"dKe.fe73Pnd.globalgroovefitness.com","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":7},{"port":3129,"proto":"tcp","label":"","count":6},{"port":8886,"proto":"tcp","label":"","count":6},{"port":9050,"proto":"tcp","label":"","count":6},{"port":10801,"proto":"tcp","label":"","count":5},{"port":12345,"proto":"tcp","label":"","count":5},{"port":63260,"proto":"tcp","label":"","count":4},{"port":59060,"proto":"tcp","label":"","count":4},{"port":2000,"proto":"tcp","label":"","count":4},{"port":12323,"proto":"tcp","label":"","count":4},{"port":65534,"proto":"tcp","label":"","count":4},{"port":64249,"proto":"tcp","label":"","count":4},{"port":60000,"proto":"tcp","label":"","count":4},{"port":51765,"proto":"tcp","label":"","count":4},{"port":20007,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c603038e76e22e56114ae3dff2e97a69bfaf23fc6b9d127d15a594ba2f6a7f91318a7e20f4de85de2f811a9aaa973d2e85c2eceb24a5f26021ba6a31e8ab90ccde0c394f001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0e508484f9286d11b122f7a3afc442eef208b74d10cbfe344c599cbd78504a8eaa03554c684b9504d394a2db2992bf7c4b7c45247d830f7b77253e764d230915f4174bfc9c172e49e2cc9936983a1795ba5991b7f6584690a1624c47b273f962a39d0c961a43f3f13a5a854943eaa858480799716c57e1241161586c6175b34258da6a5755873506c504d12b3906b8ba995239eacf619ec4098fff29bbf0b7257ab3068db566c682cffb5004c98880c94980ae983c1560a71cb012f8ace74e817d25b1c7bf1b5a4d39a7fd190cfacb45fd70d9d8410d535000eab239e51a529fc7569bb195331189eaa0c6e99684faba275521c3670662cfb321e3483d69818f5d3160a1b2260d83279c45831935dcb54060e49683da381cfe3ba2860c818b05492476ded2610d9f1ccf1205effa4abc9c5ca47eac677d657d9c8c92f6084289c63ecd2cd36b6a2e830102c6399ac21bb7ff7c03f16b4ee31cd7b5075e7166b95462f7445c58a502f1285c7e76972707731fc14c1d7b3c39a515c357848ed5ab678e48843a84faf80340e7291cb69b4476062bdd73261355b7051cfa263c945dacd74d89c6c2961f4b35fc0719d4797bcb96242c10b5ef13029ca2554f2e958e24a8843456d43dc72dc3ac2b4642cf9ac9387c7ca004142ed18b5abcbc016c8aa85d9446f71100fd10fda8b2e69d4cf7ac00101b523c9dcc13b8917cfa30b17492b7ab25b1ed7b0de3c2506425b7af75c15fa7904a38955931bfe114017329d2c615667182882452f6a742a64ea53a658979e64a78f746a068282b3d3083f43a8b595cd5065785b0c483c34c261f4073f2cb46bfc5659b141f4ab1f9e516781c63f5eb00baae609174b67aac62ac18069adb3c060d71238fa649d6ac24fd617e0b1bcdbe253e816a9d0c4384ccca97570457a3a65c5a23401a6a54ab6c25e855a506733125b9226b7261ba729b7172dd95c1242c78e1e14b5e0c9771f153077411a8785b5e87496de4263906bbde8665b302023c6322b40a048e5314c6409b548b2b084158e4c6423b759c1f7c2ad4062b520305a366b1f847746d6085a4a400d5425602f911cb1e73ab7721895681fdd6496c9e794a8cc00cb12316512aac2091d35e6373bc6cfde208bca45177a14192b410a18c79a533c00f5d07736736810f2cca115aad5e961f2796419fb1954a7739cb58766806842e0751ad29b007036a9e6c9a957aabd25b8d3924fe210bb37496161a04526282cc513016f2b44255bcc28e59bbc45b9f5d4c2b125babf21b741024460a45cb1bc647b1ca3bca11b445312ece596d70412f5a65287339d4e172e3a9c3ab2fc39fb629dff7c60eb4c6235c53ba5879e12d338af61a1854789264cc395e760561308177c2d809392f68374e8956f13599839279cd0d25af229768094b0d4e5669b562889bba072109b7d9028095a340da19246777c416495c89cc7f1c19ef8a59582c5192f4601201b9699c5ca32f2400a9a1fe738ad74a05fde08606b793df8064715335d43c3118cb50345888706717203b4b857d455228c4e7ef65d23f05c0cc511642cb70460551937cd0120ab1ec64c3605b76e54b7a121c8e9698741d86d336a7574513087a32d38e95319a56dc3750cb76c3e7616b54212e40c1816e6486b0b99120aa0371561e37e1a0f78e946411500e3529c948104f92deb48f95c405acbe2d3fde7d5143d001d0020e37e1a0f78e946411500e3529c948104f92deb48f95c405acbe2d3fde7d5143d","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":76,"16443846184eafde36765c9bab2f4397":45,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-14","count":2},{"date":"2026-09-18","count":2},{"date":"2026-10-04","count":2},{"date":"2026-10-08","count":4},{"date":"2026-10-09","count":3},{"date":"2026-10-18","count":33},{"date":"2026-10-19","count":84},{"date":"2026-10-20","count":38},{"date":"2026-10-22","count":2},{"date":"2026-10-23","count":8}],"recent_events":[{"timestamp":"2026-10-23T06:17:31","port":10801,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"de662bcd8f13864de0d1f2be4a668713\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: de662bcd8f13864de0d1f2be4a668713\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2064653636326263643866313338363464653064316632626534613636383731330d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"6351b76e-14b6-4959-b78d-a7c2144f737e","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":13},{"timestamp":"2026-10-23T06:16:55","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"c5e79bb38494e289e4c5dd8c97fd5a03\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: c5e79bb38494e289e4c5dd8c97fd5a03\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2063356537396262333834393465323839653463356464386339376664356130330d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"b0342444-7ef2-43cd-ac8b-b55ccc593d40","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":13},{"timestamp":"2026-10-23T06:08:45","port":19999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"abf41a2f-59a6-4c00-ae07-abe027072861","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-10-23T05:53:34","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8օ�E�\u0000a�\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38d685d745d40061c30000000000","method":"","user_agent":"","ja3":"","session":"adee20e1-0f89-4892-be9d-dd06d1a47396","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":13},{"timestamp":"2026-10-23T05:48:01","port":10801,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"8425a010-35eb-4fdb-9046-7bccba0e7fbd","seq":1,"duration_ms":100,"bytes_in":102,"bytes_out":78},{"timestamp":"2026-10-23T05:28:23","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"5dd261f0-97dd-4fbc-b7cb-8cc87022f566","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-23T05:28:22","port":10801,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"55d66e4e-203c-4977-876a-74675f24d4a7","seq":1,"duration_ms":101,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-23T05:28:21","port":1337,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"6f8ce604-249d-4b08-9a43-e037ef794059","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-22T17:06:52","port":12323,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"70a96b47-09a7-4307-9758-674356be2a9f","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-22T17:05:48","port":9050,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"05732160-0d8a-459f-a0f5-ae69320711aa","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}}],"http_methods":[{"method":"GET","count":101},{"method":"SSTP_DUPLEX_POST","count":35}],"distinct_ports_total":68,"top_paths":[{"path":"/","count":65,"ports":47},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":35,"ports":30},{"path":"http://probe.invalid/","count":34,"ports":28},{"path":"/server-info","count":1,"ports":1},{"path":"/metrics?collect%5B%5D=uname","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":34}],"top_alpns":[],"banners":[{"value":"SSH-2.0-synthient","count":1}],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"de662bcd8f13864de0d1f2be4a668713","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[]}