{"ip":"93.152.213.11","total_events":66,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["66 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 72,861 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"72,861 bytes sent","bytes_sent":72861,"session_seconds":1,"persistent":false}},"first_seen":"2026-10-04T11:12:15","last_seen":"2026-10-06T17:03:49","events_24h":6,"events_7d":66,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[{"cve_id":"CVE-2022-3236","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller"}],"malware":[],"udp":null,"top_ports":[{"port":2443,"proto":"tcp","label":"","count":12},{"port":10403,"proto":"tcp","label":"","count":12},{"port":9443,"proto":"tcp","label":"","count":12},{"port":20443,"proto":"tcp","label":"","count":12},{"port":4433,"proto":"tcp","label":"","count":12},{"port":7443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ca010005c60303d1ab81ac848271b730e30101e563dfae092915296441b55c0be5b23b035ab7af2070b71791bc603b788ab095e2a2234dad663c74bb1a5a2ab8ea00d6ba33671afe001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0b5257998a9ab6e2924bde2c25d322935d7a159acb4fbb084d485605ea227a208424d4b768f776e327440b2fc0d1171b410f324be919066f362193c5e50d016aa9006980c43dc176e40882cb7c60d38d70a99187621b39898002b0911bb3a8b6b1ed84004ec05df219d6f1542b516bb947b52f47c73d56534f3fc2ca293668a767b7fd56f82bb3d88915698b582db434bdd5954130745a337380aa4151356c87af14a5406ae64fb3685a05d50e97a79f673a21a13c5743585b2782d6a9cbe407c14a0252d647b49e57a69d82fa6ba4d63d511aa780f8e073ba07b55e35c12a121091a442289a0c9c1e7653275c86b314b85186c5db685bbb221deac9be298940f7605c2729558c8403f402ad6d74e17c74c2d3408abea00ddeb1c5d700c4977cd18eac454ab8b20618db3e560a8946e008645d4604b779959f8801a43f256bdec540f0128e4b71ae1928a12f014c15a9c1839cf365b4de5e09e8ec194ffe5c61b825b1bb7298ad93c386870b0e62c71f59ebd227ee19143fa7a7051f5a9e0a79c88681986d990f29707fa50b13050825e81cda957202317a641031695bb586550208da89361e94e038476f787275c16a9f5ab05123229c9eb467a5306945a8c7ab011c4b80ae8ebb8fcc0191d0218fd117798946561aa45c4175980a85f0f56b8b374bef91023de6775f91bab45636340018ed2ab5fdc0b6a08ab5258d9793db873f1f6aeb8b36fba56bbb4b0723cb9a75235516ccc908ce5763fb53e614782afe8674d5a853f9488bef06a6acbcc5276930eea026d37c78dc71140f17154aac6472610232c6399b36ba6fc36d992246479073389bb7fb6b3836580763b7f7c876eda4c99913650b4218ba84a6352b44196b81ca343abab1aab488038988658dc860fc8c9cc862787e7444dc587caceeb30cd6516e837b50574a28152c7f6d0041de59b332159ea92231594415b0441dc11940dc42c6d00bc39b5a72beac109860ffb8770eb143d5a9cc4ca477c8803cbecb89e56986586559b201c8a16381168c8add9c2cc96e2cac4316442b9996e8870b562591ee0c05c239a3358885b835c27c971cc9296578a11fd1755d4b99bb710ad9ad30780202d5591333d9b3891ca1cc5dc31254c26cb67454b76bcd46a017a6c7bca83a403c645e3c99cca97a3011324a9a64be3fcc04e7206cd426b0c15ad0156168cf4ca0526bb3320c5d2c57501813988b1bb5c806418504a53a8aa1ad392dc0247d0db15130843b6d246e5737c18d9a3826caefba72aba9709a38c567a749ae3c0c765e31d8278c1c937c9fb1807d736a8f9dba51d7ab054d388be23cd360b5e1b3c4265089f8be1694f688baf7ac3d0517c63b33b47a94ab1cc620b0c2eb695ae1c671b5c23451a656f6be301e474beba0984441b985be47f622762c9dcb03dcca6aa3b190056a32f0211c86bcccd1625de19c8a5746bac0c99e98a1f70e5ac9790853e5399e78a1a90379f8b664cd7877cdbb964cfd448ac5b617de98126a8098883992510ac96057fa88a039379a8f0b008f973b666c93af6f51fb938c0bfa6cd0e437e6b8895034a72b87bbf75220f1a8c84b65aae3563914a0ac2b4952d892a7232119a5026c7e6a532dd3119f8ef99828525f2a7cd019f8f036d8774ffce433b79e069a3b81a0df14060fd74f3b631651b4150235a2a1f9a6a48d4f98459d76a6729752374ff823a31001d002060fd74f3b631651b4150235a2a1f9a6a48d4f98459d76a6729752374ff823a31","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun070_0014001f_e9d96a03","b11cuq070_00150816_d7eb4f05"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3751,"b11cun070_0014001f_e9d96a03":10,"b11cuq070_00150816_d7eb4f05":10},"akin_families":{},"user_agents":["TRAC/9900","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-04","count":30},{"date":"2026-10-05","count":30},{"date":"2026-10-06","count":6}],"recent_events":[{"timestamp":"2026-10-06T17:03:49","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":4,"duration_ms":808,"bytes_in":1219,"bytes_out":312},{"timestamp":"2026-10-06T17:03:49","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":5,"duration_ms":1003,"bytes_in":1631,"bytes_out":390},{"timestamp":"2026-10-06T17:03:49","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":6,"duration_ms":1198,"bytes_in":1942,"bytes_out":468},{"timestamp":"2026-10-06T17:03:48","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":1,"duration_ms":100,"bytes_in":290,"bytes_out":78},{"timestamp":"2026-10-06T17:03:48","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":2,"duration_ms":296,"bytes_in":604,"bytes_out":156},{"timestamp":"2026-10-06T17:03:48","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"22396bf8-04fb-4211-a5d4-673617788b26","seq":3,"duration_ms":491,"bytes_in":911,"bytes_out":234},{"timestamp":"2026-10-05T14:52:25","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"fefc1b0b-8455-48b4-8e84-00b8abfb5b8a","seq":3,"duration_ms":326,"bytes_in":914,"bytes_out":234},{"timestamp":"2026-10-05T14:52:25","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"fefc1b0b-8455-48b4-8e84-00b8abfb5b8a","seq":4,"duration_ms":438,"bytes_in":1223,"bytes_out":312},{"timestamp":"2026-10-05T14:52:25","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"fefc1b0b-8455-48b4-8e84-00b8abfb5b8a","seq":5,"duration_ms":550,"bytes_in":1636,"bytes_out":390},{"timestamp":"2026-10-05T14:52:25","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"fefc1b0b-8455-48b4-8e84-00b8abfb5b8a","seq":6,"duration_ms":663,"bytes_in":1948,"bytes_out":468}],"http_methods":[{"method":"GET","count":55},{"method":"POST","count":11}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":11,"ports":6},{"path":"/clients/","count":11,"ports":6},{"path":"/ssl-vpn/login.esp","count":11,"ports":6},{"path":"/userportal/Controller","count":11,"ports":6},{"path":"/sslvpn/Login/Login","count":11,"ports":6},{"path":"/global-protect/login.esp","count":11,"ports":6}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:7443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-3236","tag_type":"cve","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller","reference_urls":["https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection","https://nvd.nist.gov/vuln/detail/cve-2022-3236"]}],"data_as_of":"2026-10-07T02:29:14.251342+00:00"}