{"ip":"67.21.68.237","data_as_of":"2026-10-26T12:34:19+00:00","observed":true,"total_events":32,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"synthient","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (synthient).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 7 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,149 bytes sent","bytes_sent":4149,"session_seconds":2,"persistent":false},"basis":"combined"},"first_seen":"2026-09-15T05:15:22","last_seen":"2026-10-19T03:16:34","events_24h":0,"events_7d":0,"interactive_sessions":7,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":3},{"protocol":"tls","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0515,"lon":-118.2707,"asn":46844,"org":"Sharktech"},"source_domain":"nice6.pwctracker.com","known_scanners":["synthient"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":7,"first_seen":"2026-10-18T17:38:52","last_seen":"2026-10-19T03:16:34","verdicts":[{"verdict":"scan","sessions":6},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":3}],"services":[{"protocol":"http","port":3443,"sessions":2},{"protocol":"tcp","port":3443,"sessions":1},{"protocol":"http","port":444,"sessions":1},{"protocol":"tls","port":444,"sessions":1},{"protocol":"tls","port":3443,"sessions":1},{"protocol":"tcp","port":444,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":6}]},"top_ports":[{"port":8442,"proto":"tcp","label":"","count":7,"sessions":0},{"port":1195,"proto":"tcp","label":"","count":6,"sessions":0},{"port":1193,"proto":"tcp","label":"","count":6,"sessions":0},{"port":6443,"proto":"tcp","label":"k8s API","count":5,"sessions":0},{"port":444,"proto":"tcp","label":"","count":1,"sessions":3},{"port":3443,"proto":"tcp","label":"HTTP","count":0,"sessions":4},{"port":442,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8081,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1194,"proto":"tcp","label":"OpenVPN","count":1,"sessions":0},{"port":3389,"proto":"tcp","label":"RDP","count":1,"sessions":0},{"port":3129,"proto":"tcp","label":"","count":1,"sessions":0},{"port":943,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105ca010005c60303729f0631b4bafd27488d41bced759fa3ccf1a2b8441d784bda3ec9d5d5e1d84520f111ecf496029f688edafb69b34a328686145e17e8a20c0138bc0a54b7e3d8a5001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c08a56911faa1f3ed8701803666645325c14583ce1a01a198128599a6a4a6f323a2964cb827444918593568d91ba7d78896fb6150c6c3a07f1a4c33ac9656173151c7d2d5c3af7a570ae385a20782eea816faec7a8309563bad12c1f27b8fe75270f501fb5b6b0cdc387661c3a2cbc219e58a7aaa39922a80818fb5772a83269bb5a91307437f82ad4f0074618529ce8556cc04116718bce93bbdcf5b4f6d0c23c116979f35a6c5850e5abc0b4f67b9b1b8851b6422769afad41c675025b05688b8187bd2e19965054c282d63b249505f25905b6a9c8275c7324189f7ac9c42974c66aa384935938bb6b69ce74bdfe42196b294e918456e2d177c9d0b1bb915ed9d2c3e7e10ac9bbb60ed52f4198382472c59db776efeba637b7b25778b628c3c314e94ef4b46b221b9ac6e2189bb7b9e9ca05693320a80a7380e05d0bf0c8b8c9096d49bf0abc538efc6975cb3f492369e7ba8da9c9583789c635d359819859546a1ea2e41a31792163e576d9e078e9826807ca520fd99293553a5ee14af1052e5583af58aa49d0a71ca4e10f0561b9d4509b7a17518412620edc690eb5079a0a4828f39701743a3391268e9306d8ea5c523098ae96b66bcc58aca49b168356a2685a740a28f87c3805a683642004857a1495b51e19445043ec946d6434f8980e6cc258d1e9a679728ecbd240ea2291fe443cda53794772429fbab48432cd75e05e314a945bc07cded0c1e82620329a29056351db1c8b80f467e887a482d07c2c25570d2424ec76a984c951eef77db8e73918b828aba11e583baa7b799d7a5835515b4d53a441d6bc00d73067df01a104977acebbad5a8a0d49876c738b89d5c0996816a31f342bfa445b4998529056a790a1849eca5c49409a8c6846b1f950fa23388a708f508631d0f54bb0e9b64f356301465dbf5270b67629c4f17d3a709f4a6a1da9e590e5f6871de1b796844dc81a34eff4ab2ceb9960cb22a7c04afc170aea01442622896540141a098e795804b26c9e8de2935525377492359c7c916b842cf5745da1e84d70d353c1617c33353a2ae3c0caa78304db36b42366aaea1d03d346829b480a3423fab73cf9960371901a2aec33c4699b0f82248e7682cae7692bb0c36a1708456a4ebec4337a33165b9c836540cdde193fb9a72652371820c0067bd70fca8b4343eb4f23b1c87334490ee7299bc9a675e7576f703e67d4546d17244e50b1121218c0946c57a8ae43b8c7f1c8740440aede46338fd20f1e96c155d3cf6efcbba1e20f4e30682257275e467b939cb653c522cd8369b741bb9a245d1d01212165466d8b059a383111e6cef29aba9e61984a296bc9e4c44b209ca7e72a098bcdf8455b1d3b6070082a49f8929eb93badab3fbd12aa365245d61573fb1605680ca560037681c246d0138d1d4b1331309aec266ca7c691b8a1230bd26cdc431c9ed78ccef78500418f0e0aa994ac57891850f03055e37b19a276086b11532248141280930ff52dd71b371f7c8a3cc26526909e972ccc2a9517e2b5c0bcf1502fa93e0469a76fc55be332a90db2c20b3397f45ab67f235151dcadcb2503e3696830c9923356a809d3111cb73779a20fa8c84a1583bb234062732666414929f853f1a327652a50994e90672cd99d40bd5078c9170473c69b5555f1434f375bebdd62cca4cc942cb62f6ee5a4875ee7f8d1e94a17031691622f79b758001d00204f375bebdd62cca4cc942cb62f6ee5a4875ee7f8d1e94a17031691622f79b758","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq041_00040801_6f214d87_x83e1","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":70,"b11cuq041_00040801_6f214d87_x83e1":15,"b11cun030_00040011_c91eaf54":976},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":976}},"user_agents":["Synthient-Research-Scanner/1.0"],"timeline":[{"date":"2026-09-15","count":2,"sessions":0},{"date":"2026-09-18","count":1,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-10-17","count":25,"sessions":0},{"date":"2026-10-18","count":3,"sessions":3},{"date":"2026-10-19","count":0,"sessions":4}],"recent_events":[{"timestamp":"2026-10-19T03:16:33","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 745b6707cd5cc52d872666c7f7f3db91\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2037343562363730376364356363353264383732363636633766376633646239310d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"9e9256a5-80a2-4577-bacf-82a27a7126c3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"84355b02c77b8872","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 745b6707cd5cc52d872666c7f7f3db91","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-19T03:13:29","port":3443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"d5220507-fb56-497a-b293-d3f31dc2b662-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-19T02:56:11","port":3443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8~�\u0003�\r>&�\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e387ea6039b0d3e26b70000000000","method":"","user_agent":"","ja3":"","session":"7ab88ebd-d8c5-4e18-9670-1fb64aa5fdc3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-19T02:16:46","port":3443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"c81518fd-fcb1-4112-8021-131089773e8b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T21:11:49","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: 81c52041622dbef2933bfadb7d2423f5\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a53535450434f5252454c4154494f4e49443a2038316335323034313632326462656632393333626661646237643234323366350d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"c366f941-b2ab-47f3-97dd-3898cd63acde-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0625db481bed8abf","strings":["SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1","Host: <HONEYPOT>","SSTPCORRELATIONID: 81c52041622dbef2933bfadb7d2423f5","Content-Length: 18446744073709551615","Connection: close"]},"interactive":true},{"timestamp":"2026-10-18T21:06:21","port":444,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"ee9a9c93-7b5c-47f7-8a28-e20f098c55ac-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T20:09:52","port":442,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000e8*\u0002�[\u0006&\u0014h\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e382a02d75b062614680000000000","method":"","user_agent":"","ja3":"","session":"51fbe16a-50b1-4106-a3f1-61e7682f135a","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":12},{"timestamp":"2026-10-18T18:40:01","port":442,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"88f61e33-0fdf-4f47-a8af-246d320a1dd0","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":77},{"timestamp":"2026-10-18T17:49:06","port":444,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"probe.invalid","headers":"{\"connection\":\"close\",\"host\":\"probe.invalid\",\"user-agent\":\"Synthient-Research-Scanner/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://probe.invalid/","summary":"","payload_hex":"47455420687474703a2f2f70726f62652e696e76616c69642f20485454502f312e310d0a486f73743a2070726f62652e696e76616c69640d0a557365722d4167656e743a2053796e746869656e742d52657365617263682d5363616e6e65722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Synthient-Research-Scanner/1.0","ja3":"","session":"4532dd58-2c22-4997-b9ae-b05f3f65c818","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":77},{"timestamp":"2026-10-17T18:13:02","port":8442,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"18446744073709551615\",\"host\":\"<HONEYPOT>\",\"sstpcorrelationid\":\"faf9bf48c1dc3949b6bfbf1de71af67d\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","summary":"SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1\r\nHost: <HONEYPOT>\r\nSSTPCORRELATIONID: faf9bf48c1dc3949b6bfbf1de71af67d\r\nContent-Length: 18446744073709551615\r\nConnection: close\r\n\r\n","payload_hex":"535354505f4455504c45585f504f5354202f7372615f7b42413139353938302d434434392d343538622d394532332d4338344545304144434437357d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a53535450434f5252454c4154494f4e49443a2066616639626634386331646333393439623662666266316465373161663637640d0a436f6e74656e742d4c656e6774683a2031383434363734343037333730393535313631350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"SSTP_DUPLEX_POST","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"f37a56c4-da7c-4d7a-a345-0d79f0d3edfb","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":12}],"http_methods":[{"method":"GET","count":22},{"method":"SSTP_DUPLEX_POST","count":6}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":15,"ports":6},{"path":"http://probe.invalid/","count":7,"ports":7},{"path":"/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/","count":6,"ports":4}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"probe.invalid","count":7}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Host","Sstpcorrelationid"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"18446744073709551615","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sstpcorrelationid","value":"faf9bf48c1dc3949b6bfbf1de71af67d","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[]}