{"ip":"64.227.151.38","data_as_of":"2026-10-26T10:41:31+00:00","observed":true,"total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"424 bytes sent","bytes_sent":424,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-08-10T05:15:28","last_seen":"2026-10-25T00:37:16","events_24h":0,"events_7d":1,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"IN","country_name":"India","region":"Karnataka","city":"Bengaluru","lat":12.9753,"lon":77.591,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-25T00:37:11","last_seen":"2026-10-25T00:37:11","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":1},{"port":3389,"proto":"tcp","label":"RDP","count":1,"sessions":0},{"port":3390,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105de010005da03038a890aaaa2268d2ee56117647f8cdf8773098f1405536b667d059c13dd049415200b6b8d7a540a75622129a1589bf68810a49a18d9e2d73a0fbc52c214ee6ff8690032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0b76c013efa8e3863bae5e1398c3162c1d4925d092af6787f5a94741fa33fd77183694723fba6722c86094e1146b94b8e58f57ed4d872ee18587f8c1d2af7be8f857b8f855c0e2993b375b7d36261b3d0622ac0ac2d3906fb39432be8a8cfe695f280259ca12a108181fde92e88303961948931045cafe92b6cc46d7c46a1d26c370d643de5d9adb9ea076227496f76c61244ba9d045e57089f2ee30a0d341a375a4e6562a65b63aea67489b37025d6054605675774748c2a8985cad90c939b36b755a41779c7e81abf963378c803b40b45843349af2f21895f834c85dc6da5acbd40da9337f037685372f6f6854320010f218384e952953400d2b97ae5f4688fcc3a9ba755270c74f6d2430ac9394ad532ebf2c84b5a351a1b4e73586830d93365fcb502a55989c917bda60f101b81e0c888f8222f53d89a8966683d3229aca0436c7a449106900eb8a37ce020ead8b684421c5171c1dd84293c4889451abe43763e0da1073f0a911c2c369e8295b788a52f8072fd2983d1fa5be124202fd89d873c2821718907eb4aac6c4f0c24cc6913a8951758e322b053479e111972a3d7745a309a10e06903738f43737038e1c981bcca6c865aa3072f0d5c9cb9c7a53bd2c54cb7c584b50e86a50a09367ac6f8008b48b76ef9aaac656ba617a5bd02cbf73459c058809e800d3620a7069bbd70361e2ff7b4beec8e89e152f23b07baaa21fd7024229c425dd434181864374b17e475529ba4ad5d36b26a213e75d1735aebc0be28a3a6b82f330485de70525285c2c9c1a181a4612a842f0d37aa328411b7090fdb6652d4b9599ba5cf6034367c8121a2353ba19c58c429af4dc13b0632924d309e57107c25238a221684d508cf0b05cd85c88aa54c0dc47b8c013467526452d3b4aef51acea6192eed41a560f2255d6722e213805e333896944bb6307e674a7f744488bb19a0822b58715210540c29cb740a2db0c00582c97d3a6d1d8bcdb02aabb0ba9023e1b1ac6c08a265004bd804bd4320532944be865d92575622dc937324b091d3247b5148757a1306a32514e53cd102cf2fa248f6629ea2c7aabb8a757c6465b150729310a69e754d8a9761a12c3babf88e57797f940a28a534738e46144ef00d56588c22021e0db38e92e1b25249b308f77923ba8bfea3a74c57278dc5b9db3498b4056af643578eccadb708c668e1c69d54cd54148475ba27eb73996617cc64513b523026a9b50fe98852e4eb4ba65872428c1694e913e89691d604af8032ac4a92b0ad6c73f5e298392a163779ce333a5a7ca9a22c065411e27261e5a3243994455b73d06c1d8cd7b3c0c83b2c5b2cb7304b4d7b1661e54d77a569f3198292b26bf5c1ab00e1a7922bbe99b25a6eb04b7f0025719c173835544ea0a05996942dd99e2497943702150c6c56ed312b923b28e2d10ba1255d5465c6c1c6405efa787e0ab2c985ae00e90b952334329c3a0da245afd9b0b651554c24429e3085c0cb1fca047d8f7a640a05ae264bc1f8543886d50dc62c66c4c78ddd8169039c702d7a9a551b57aa173956c28dcac5be781193ec2898f1761543025c269cb2674242282a9e46c04a0bab4d44e81a287a19230c6db6c66cc6ba6a63cafb288a6ac3de1474d379023db7c8b1ab78ac5875c09a23a8467325ab9c891fcb1b955f4e484b548c9fe01ed8b349ae3d04eec96912510e35e0276b0b0f02001d00201fcb1b955f4e484b548c9fe01ed8b349ae3d04eec96912510e35e027","tls_ja3":["11a384388ad36777e1a2e121495037fe"],"http_akin":["b11cuq031_00040800_7e369cbb_x83e1"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_ja3":["11a384388ad36777e1a2e121495037fe"]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":99,"b11cuq031_00040800_7e369cbb_x83e1":41},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-10","count":2,"sessions":0},{"date":"2026-10-25","count":1,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T00:37:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"{19730D60-90A0-4623-8C44-688D762AAA16}\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nSSTPCORRELATIONID: {19730D60-90A0-4623-8C44-688D762AAA16}\r\nContent-Length: 18446744073709551615\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"ea2319e6-21c5-4eb7-86fe-f3f1598b2606","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":13},{"timestamp":"2026-10-25T00:37:11","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a53535450434f5252454c4154494f4e49443a207b31393733304436302d393041302d343632332d384334342d3638384437363241414131367d0d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a486f73743a203c484f4e4559504f543e0d0a0d0a","method":"","user_agent":"","ja3":"11a384388ad36777e1a2e121495037fe","session":"f621e70a-2fdb-4cb5-b37c-628746382ced-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-08-10T05:15:28","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"213bccd7-e44e-4a4b-8665-9214c31c67af","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-08-10T05:15:28","port":3390,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"71b7225b-d0ab-4752-ba3c-1f08c50f7c7a","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}}],"http_methods":[{"method":"SSTP_DUPLEX_POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":1,"ports":1},{"path":"/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"{19730D60-90A0-4623-8C44-688D762AAA16}","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}