{"ip":"93.152.213.10","total_events":18,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["18 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 19,770 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,770 bytes sent","bytes_sent":19770,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-30T15:21:14","last_seen":"2026-09-30T18:50:28","events_24h":18,"events_7d":18,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[{"cve_id":"CVE-2022-3236","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller"}],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":6},{"port":443,"proto":"tcp","label":"HTTPS","count":6},{"port":943,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ca010005c60303707c5461f8284de7f10b29bc3392383e57b4aa94296f8c5930ed31747ddaf8cc20f41ec991b11ef8ecb3841447165de4b7f0b71382770762bc9abe2b9a9b64405c001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0aad2431866cc52698236fb29d628731fe45ff2f7ba39bc8de2f768814259f4412774e245247b73bdb04e25a8b33cb22993a0b718017dcb8985d4078ba40856afcc71c2c7ca7e722e568733f4b1430154cd1a74b163a39037425a9e452230f69af0a7a595abc71a261427a0c2b9ac84d33c003700c9e49635149c5a68393a001d0974c22f0273ac001947447312ec947194abcb14d01860118649c84d6ecb58aa27693d019480c67b58545b76571508c78dea209701a70da0729987c0839379843c4479ce967e4f53242b370078e1835b40a58fb470908b28c9a54d63d13792f97ed0935b27b7253f1b1f9011648ce7a8bf689d1f0b3b6cd6241d59c31fc97fee21b5b523890507598d563959843983aac901dac2b5b36b498a7c3d964c6ba94e7902029082876abcadbaeac0cf633360a59b31155bd17b7a559a8b4fb2218058039ad4cef1a74f0d4bbcb17a9347d365392163bae361ee935f6ca393519bbd60313ee81ca5b91b2e95430b22037f11873244f8c9fec9082ee3046cc427fd5449d132c29b829733fc584e55403774c0ab908d8dd7bf19055665f8a741dc33b1a64cb5a7c31d87966bc89cea575dd5711d34e3a25c7b1cdf07581e48a12eb98f6112601fe7c19f3b6950899707744e4e951d534573a9706de69cbad4f8757a2a09bc26a83e20bda55352e7f224ccc4bc6956635925b2f10670be62720661bfbc205fb17048df8b71ff384a8bb48510714affd192a37b3b4515917fecbf8d173713c78395f464a0590cb9b2a6c015bda6111d9334bde252b5222c5ae26c91ceba1650e37538c5258e4756cf891cb844ad2148bf9173cae2f67ac9c876c9d0a735c8cecc8161ee778f69a2971968487900705e2b45197c49e18580eed3228b96591b5c6879339757b96414f37778973e372322527a983c99780eecc92d089848d053ef95a2ccc5876f3063b410472cf3b216ec503a97a83a531b5fc313000972b28671b9c47a67012ffef70e8e7046fed78ebc2aa385fc57801a5459400e0f7c822993c413263e2e2c435fe9437ba6a09025307d5949057a12d4b9072391698db3a9c5d265bbdc9699aa9bc6a2ceca1acce196bce77202ea87870dea72e09502d036b368115e3327243d32abbca79bccb97ec5f831ae08cd4821287dac8f9d64ab43a520ed90c0c50b62036c466705c59868a9fdc5b449f685ebe00a6f638227e55b11a2a47f978c02a54ddfe2b5e56253a720039b2c899623786a0844a226456217471c709ea82c81fadb64c97a0e8852532cfb1db6cba596868864d57705e8b880b71ab00471387774d38c1debfa61c2514dca5bac7ab208076965d418441dc878ca201d8bd4778f317d5d35cd8f028fb0a48fcbe953c64695e123a286acbb14d2449e550eaaa553b80c94ec344b8ca55f65e892c4f3ae4d191c6c5cc7572c2938d5c2d6a65aa3b3b54961a21fe3cfb4cba1f04962f2c6642210327357b8e7d1525946c8e9144acff5758866b60d704166a46feb933cbcd803966a2db0dc0ef9f802412b118f34192fe24874db2ffad421b65705ee19a78c479bd7a0b93ce011a61920cf947ae571a1cc9363755959d13a47ef8a031c253488022fbe0c2e2888c02bfab3a684f3ceff51a93f9b368a379e2d7d868da6d82b0aa554e272427dfa1356bdfc4b651b255f197b530662b36b4bfb86d53fddf9b2ec133d5ff58a21fb5c001d002056bdfc4b651b255f197b530662b36b4bfb86d53fddf9b2ec133d5ff58a21fb5c","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun070_0014001f_e9d96a03","b11cuq070_00150816_d7eb4f05"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4820,"b11cun070_0014001f_e9d96a03":1,"b11cuq070_00150816_d7eb4f05":1},"akin_families":{},"user_agents":["TRAC/9900","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":18}],"recent_events":[{"timestamp":"2026-09-30T18:50:28","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":6,"duration_ms":1081,"bytes_in":1936,"bytes_out":468},{"timestamp":"2026-09-30T18:50:28","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":5,"duration_ms":885,"bytes_in":1626,"bytes_out":390},{"timestamp":"2026-09-30T18:50:28","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":4,"duration_ms":689,"bytes_in":1215,"bytes_out":312},{"timestamp":"2026-09-30T18:50:27","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":3,"duration_ms":493,"bytes_in":908,"bytes_out":234},{"timestamp":"2026-09-30T18:50:27","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":1,"duration_ms":100,"bytes_in":289,"bytes_out":78},{"timestamp":"2026-09-30T18:50:27","port":943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:943\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a3934330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"93bc0ede-7813-4da0-98ff-bd8fdc961693","seq":2,"duration_ms":297,"bytes_in":602,"bytes_out":156},{"timestamp":"2026-09-30T18:50:21","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"14648f7e-460c-4aaf-9f0b-681267f055c0","seq":6,"duration_ms":1075,"bytes_in":1942,"bytes_out":468},{"timestamp":"2026-09-30T18:50:20","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"14648f7e-460c-4aaf-9f0b-681267f055c0","seq":3,"duration_ms":490,"bytes_in":911,"bytes_out":234},{"timestamp":"2026-09-30T18:50:20","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"14648f7e-460c-4aaf-9f0b-681267f055c0","seq":4,"duration_ms":685,"bytes_in":1219,"bytes_out":312},{"timestamp":"2026-09-30T18:50:20","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"14648f7e-460c-4aaf-9f0b-681267f055c0","seq":2,"duration_ms":295,"bytes_in":604,"bytes_out":156}],"http_methods":[{"method":"GET","count":15},{"method":"POST","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/clients/","count":3,"ports":3},{"path":"/ssl-vpn/login.esp","count":3,"ports":3},{"path":"/userportal/Controller","count":3,"ports":3},{"path":"/sslvpn/Login/Login","count":3,"ports":3},{"path":"/global-protect/login.esp","count":3,"ports":3}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:943","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-3236","tag_type":"cve","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller","reference_urls":["https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection","https://nvd.nist.gov/vuln/detail/cve-2022-3236"]}],"data_as_of":"2026-09-30T19:10:20.798704+00:00"}