{"ip":"67.21.68.20","data_as_of":"2026-10-26T11:43:51+00:00","observed":true,"total_events":26,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 10 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,314 bytes sent","bytes_sent":3314,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-15T05:15:10","last_seen":"2026-10-19T03:02:51","events_24h":0,"events_7d":0,"interactive_sessions":10,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":4},{"protocol":"http-proxy","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0515,"lon":-118.2707,"asn":46844,"org":"Sharktech"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":10,"first_seen":"2026-10-17T14:54:37","last_seen":"2026-10-18T20:55:47","verdicts":[{"verdict":"scan","sessions":9},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":1},{"persona":"proxy@squid/5.7","sessions":1}],"services":[{"protocol":"tcp","port":444,"sessions":2},{"protocol":"tcp","port":8442,"sessions":1},{"protocol":"tcp","port":1195,"sessions":1},{"protocol":"http","port":1193,"sessions":1},{"protocol":"http","port":444,"sessions":1},{"protocol":"http","port":8442,"sessions":1},{"protocol":"http","port":1195,"sessions":1},{"protocol":"tcp","port":1193,"sessions":1},{"protocol":"http-proxy","port":442,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":9}]},"top_ports":[{"port":1193,"proto":"tcp","label":"","count":3,"sessions":2},{"port":8442,"proto":"tcp","label":"","count":3,"sessions":2},{"port":6443,"proto":"tcp","label":"k8s API","count":4,"sessions":0},{"port":1195,"proto":"tcp","label":"","count":2,"sessions":2},{"port":444,"proto":"tcp","label":"","count":1,"sessions":3},{"port":3443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":442,"proto":"tcp","label":"","count":2,"sessions":1},{"port":8081,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2,"sessions":0},{"port":50100,"proto":"tcp","label":"Cassandra","count":1,"sessions":0},{"port":1194,"proto":"tcp","label":"OpenVPN","count":1,"sessions":0},{"port":1080,"proto":"tcp","label":"SOCKS","count":1,"sessions":0},{"port":61234,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c6030354ac934624782263161efd30ad6ca23700b47b1feb17562920663bf51ec51ba9207d7a4c45d601a6b505350f9910404369a9f432b9cca0f7e1f95eb50e907896ce001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c044ec3f32b86654b4693ee8b0727a666985019ed523a9c42f39265c659b7b8017790cc8a10d9c9b12b148ae3849276a5ed1233cbd4b4c79a940ab8b21e6306139ca3336496f3c11b18b565f2828ca1d5649423927f4041040f10677371b35d04540717655842cfe5a1608b06bcb7b53f81c1da2b4160ef55a26f289d80a9fc102643b1c5d1d1a835f431733f28c055a747788b22581b6ea5c2e52c300c8998e9864c6347424f36a1540e40ac7c73ba3e5a7fc021f03dcc8f55c20a1020ad22ca0d6d04d7d4cb4107c72123cb020936b3ef37cb5bb65bce22f1f8a4726e04f25051c27b8a1d6c887cc9069ae8325e4bc011a947329ab9d8493ce02e486c9b5ad74890f312612e82163c826cb28c09c033cc2679c138954902f37cd2d64a532865a044a9d65905338779151626e5f47ab32c90fcde9197ea71d7c0c9c646088cc10086fd78b1cb85ba17a19638c509b21153ce2a428a22cb9b0bf18044367888d99c4ca5a469df47043140aca12907ea3f07d9fb40e152c9f641c66d08362bfc6366abc8a9b478702673e7be48e22f7bbf7b5b094904df58651915943e848113923a80d8caa12ab1a63886c63633eb013cdf4335fbab290055415f46975b35789959232582839df44a4bbe40b982c1e30e28c7a284e12ba2f530bb3a393bb4e0058e2e4b6717b7e2036a5050a909c9ba3ac9cab71b572c81667a4a08b57e2bf1ecb21124c2bcf0b346daab8ee1395215816a0564766d6cf026ace5f18abd3bc5fca0602a586747fd77481449266b9c3de64b39ca830d3378e2f64212e00acb2d861a083237adc8a9bbaaaee21552e06c9a5b7211a998f4b059ffcba5df2b7ba9933139ec9b4af7205e6f22021b3a3482a164b78756ebb5633b152beb71aecf438cc2b3608691421e42b83459cae0101a3524bb752a58b39c136f8bce1d520b7f9294866c973290e2700ccbeea633f70c48823a6c212b5153b7ba1c614ee0aac2a5ba4e0998be28c04cdf81ebe77660a6c34cbd88a2f7005cfb851c332b4ef182830f317d1c88d2551bc8f96962ce3b9902765a1e2785525c4d853c0fbdc6c501c22aec6ba71118819c132313b2a16b99d18b296f54c5684c60147f736dbd57af3accf0d888ef5573ef57cbfdc13896488aa0c937543916ce945cccfc05ea9b0601db49846437cff13535367a644c6868a1c56276cc1fd80330d3656bbf9cf2b477a846bad04a6379c400e04503daca34de6834ce5b3022612b7ca7c83afb85ede887ffe1513a1629ea81a69e01b7cf86a40050c96181a32298a279ea2b35f9803d8089e1464c3b3f16628ac75ae4870fc592d65124d91169f9e612655980054b23740392f0aa12c9829c2a2a596c6f481e1c747a352357ab1c240846b0384c6809b7a91d87af81a1e06151e43e476a0441d1f2203b5f01ec4d38e9888afeafb36afb31bb165cf30bc069be81df9c54e1c44313c339efd1a16cbf24020f4037d08868d00747711be4159730c08a798a13f85f20942150508f5a77ab9b908e1915807a9bbca3158c182d3f714a813cc59b079a93252a0813d305545c6b8ac18e7a5156c6bc3961276404cd41b990bb8a76f6070b6a30b7ee49f27e03c3945ce1ed317ec9c48d5a4d155c4c4b9d7eab2a7bee3e8dd19a54259c3bc914675cdf2874909363c8266ee10a402518e8381a29621876298e1c01b7f66050cce41b7e8091a40001d0020363c8266ee10a402518e8381a29621876298e1c01b7f66050cce41b7e8091a40","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":76,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-15","count":1,"sessions":0},{"date":"2026-09-18","count":2,"sessions":0},{"date":"2026-09-27","count":3,"sessions":0},{"date":"2026-10-17","count":14,"sessions":6},{"date":"2026-10-18","count":3,"sessions":4},{"date":"2026-10-19","count":3,"sessions":0}],"recent_events":[{"timestamp":"2026-10-19T03:02:51","port":3443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�=8\u0006�;q�\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38a43d3806ea3b71870000000000","method":"","user_agent":"","ja3":"","session":"1907de01-5c1b-4bf7-94f9-b3f7f3615682","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":11},{"timestamp":"2026-10-19T01:41:00","port":3443,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"8ff90a28-3bc8-4fe5-9c76-d3dd61cfdeae","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":76},{"timestamp":"2026-10-19T01:39:16","port":3443,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"02af8e1b-4a7f-4ab2-8871-227078d39b60","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":76},{"timestamp":"2026-10-18T21:09:13","port":442,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"88f29af2cd1329ca581d575e384084c0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 88f29af2cd1329ca581d575e384084c0\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2038386632396166326364313332396361353831643537356533383430383463300d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"f21ae68e-9cd6-4e9b-85b1-b5fded95ee4b","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":11},{"timestamp":"2026-10-18T20:43:26","port":444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8�.ʢ(\u000f��\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38c32ecaa2280f8ab30000000000","method":"","user_agent":"","ja3":"","session":"7705370d-c81a-4ca3-a2f1-8e017a2fbe2e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T19:13:23","port":444,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"8fcfb788-34e0-4335-b4cf-cbc587aa1a7a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T17:48:21","port":442,"proto":"tcp","app_proto":"http-proxy","app_protocol":"http_proxy","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"GET http://probe.invalid/ HTTP/1.1\r\nHost: probe.invalid\r\nUser-Agent: Synthient-Research-Scanner/1.0\r\nConnection: close\r\n\r\n","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"","session":"2844f054-f13a-400c-bae9-dac3fa61558a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7b4635e6569945a2","label":"HTTP","strings":["GET http://probe.invalid/ HTTP/1.1","Host: probe.invalid","User-Agent: Synthient-Research-Scanner/1.0","Connection: close"],"iocs":{"urls":["http://probe.invalid/"],"domains":["probe.invalid"]}},"interactive":true},{"timestamp":"2026-10-18T17:48:21","port":442,"proto":"tcp","app_proto":"http-proxy","app_protocol":"http","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\",\"via\":\"1.1 proxy (squid/5.7)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a5669613a20312e312070726f7879202873717569642f352e37290d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"2844f054-f13a-400c-bae9-dac3fa61558a-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T17:41:33","port":444,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"08bf710f-0a50-4d19-b91a-07fcde517fc3","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":76},{"timestamp":"2026-10-18T17:37:44","port":442,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"2ad8bbe8-0e2b-4ec3-a7ac-a25401a8fb6b","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":76}],"http_methods":[{"method":"GET","count":21},{"method":"SSTP_DUPLEX_POST","count":3}],"distinct_ports_total":13,"top_paths":[{"path":"http://probe.invalid/","count":12,"ports":10},{"path":"/","count":9,"ports":5},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":3,"ports":3}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":13}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"88f29af2cd1329ca581d575e384084c0","notable":false}],"distinct_sets":3,"events_with_headers":7},"tags":[]}