{"ip":"93.152.213.3","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 52,860 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"52,860 bytes sent","bytes_sent":52860,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-30T18:50:02","last_seen":"2026-10-05T16:54:01","events_24h":24,"events_7d":48,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[{"cve_id":"CVE-2022-3236","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller"}],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":6},{"port":11443,"proto":"tcp","label":"","count":6},{"port":10403,"proto":"tcp","label":"","count":6},{"port":20403,"proto":"tcp","label":"","count":6},{"port":10443,"proto":"tcp","label":"","count":6},{"port":1443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ca010005c603030f269838744da7b6eaed49143db5598533b77892e7e2b91e63a351fdc5e0bc532095d3465085458aad149ebcf4ac3b132911328d6c7d2cdace2af68709b31c9fd6001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0c039054a2b9bca73a6a47937dc147e9fb408847589d7e07cabea8f9d64a84af64f1f981142981599447f84719810355a4907460ca88592d31835f21f0de22c4eb6a67342365ec13298b5519f5b425d04a00b850a175c096647214676b527430d56956a3a11ca81b22c074175373c6c22000964009c631c99ceb164b572265ff43ad5fb0e25363ca924c3d886770f8b11da691be4e4ac54228fdfea252d0ac653779869534371e70c1c31ac18db3141e6656c8b1db8e8b75da422008a1fe71aa2d832bce0d29604e09dd326c8531161eca18194222ad20480aea3ca9aa96cb918b75df6a64c1523c675cdfef72d866a29bbd0ca81eb318b8832ea3b966cb9249b5407fc3a901e71c70f20b4b9e1ceb0d2922f7b10562b5a25475a20fc58dc27aa57561b0d6547b637a4e6638d28f267e5ca66b70187d5e3180a52683f715e31f9228315c5b13718279aba84082755b768d78431d265c296e094eb4a524eb6a31a0bc855d04af1929182918b786203c7f5c599d63d47c38377e408fd822793c58578c2bcb2c90e8c7c9c2307537d8c9f2a98caec46365d817216f2b8a209477f20c0b4f93edd528aeef70a04083f4a49c1be8c5bf1161540da135c6bc4bc9c1052796e9e40b7e7c3473dd365f11cbcc0d66063b01757c160a052babfd998b97a0596e688d195a041d4aa0bd65fe1155340c8684ca7afbb7898a6670a01564671a947d7341e9741b59e83a19a3c6fcac863f283ab518a2ab1f282f4559a83f45ff8bc7b9176abfb4893daf81e62ab04d8ea12bae15564f6281116c71c90900e2b1921e54363248a30f697dbcb410bf197a747ccb150704c24a2b7b39b4135a6f377cb60219b0f897296b12f38586298731e4f38c892128ef83b2adfc48d108b8f6c863015a37e104ca413a1ba3ef2492b8397f042ae7a2647f1f674a5b59991b323fd593a223a371ec7342c6076167aad8ae04212380adb37878e14ab5153033a535b31754a827c40e8489cd7aa307876955a656148dba60156aa6eea6a6a2663cd466c34258abb2c8da4d7859fe28c9ff0269911948c7a79f1db7a1d0a1f7d3901c82046440a098219061fb3c51be804d1435f79388f4d757ac8e1c4f023a5a7cb4dc119cab3aa923c2674e840c8ad4c3240b0bb6b1113ecfc56122c1fa42b8736bb7af0b310cd180d13c3347a72361451b2c3756e3d0034dc588f4a6b1ce681c5670c002f308185229322e778b54c0e7608205f817ad882a345379adc1797ee71243f2821eb300999d192d8eb5219532b980a81c1e9434e34b4bf6c4fb9a372f6417d0d3834374a4776982c83a7332667ca15b5250862b4ed290a24e38a2ec46ba792803c1c6432f751764919e39b2bb9a1c6ee7a3f9ef3445e1968cdb8aeb46668bffb4188f5c347571df8f5c885e89173200ce4152f329666c3d01144da550f073427626d8c42a0e745097874ade409ab45a4cea7882ffcc5036c9c327f15bc1f39a385ac22d98094357ba92e8b7ab2bc574e2788cb816a787559487a6e4500bdf08792353bb9b5a6a3bc1c0c1ab4349fe79263c860c0d51113e9926b717b4f64a9729b0c67fa3e18d03a445ccb6fa5666ba90ddcb11a942b8ec3f47748982bdfe21c4757022af4f3282ffd0704cbc761cb0c34ec5990f200486c0322085a9c97ec026aa292c40ab85b886616a966d660b512f03b9605c910349fff452f3679001d002097ec026aa292c40ab85b886616a966d660b512f03b9605c910349fff452f3679","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun070_0014001f_e9d96a03","b11cuq070_00150816_d7eb4f05"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4114,"b11cun070_0014001f_e9d96a03":10,"b11cuq070_00150816_d7eb4f05":10},"akin_families":{},"user_agents":["TRAC/9900","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":6},{"date":"2026-10-04","count":30},{"date":"2026-10-05","count":12}],"recent_events":[{"timestamp":"2026-10-05T16:54:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":3,"duration_ms":490,"bytes_in":908,"bytes_out":231},{"timestamp":"2026-10-05T16:54:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":4,"duration_ms":686,"bytes_in":1215,"bytes_out":308},{"timestamp":"2026-10-05T16:54:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":5,"duration_ms":881,"bytes_in":1626,"bytes_out":385},{"timestamp":"2026-10-05T16:54:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":6,"duration_ms":1076,"bytes_in":1936,"bytes_out":462},{"timestamp":"2026-10-05T16:54:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":1,"duration_ms":100,"bytes_in":289,"bytes_out":77},{"timestamp":"2026-10-05T16:54:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"28967583-e335-4410-92b1-595d2885bb1a","seq":2,"duration_ms":295,"bytes_in":602,"bytes_out":154},{"timestamp":"2026-10-05T12:07:28","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"c5f7ce49-4ee6-4934-b971-e6fce57a063f","seq":1,"duration_ms":100,"bytes_in":292,"bytes_out":77},{"timestamp":"2026-10-05T12:07:28","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"c5f7ce49-4ee6-4934-b971-e6fce57a063f","seq":2,"duration_ms":214,"bytes_in":608,"bytes_out":154},{"timestamp":"2026-10-05T12:07:28","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"c5f7ce49-4ee6-4934-b971-e6fce57a063f","seq":3,"duration_ms":357,"bytes_in":917,"bytes_out":231},{"timestamp":"2026-10-05T12:07:28","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"c5f7ce49-4ee6-4934-b971-e6fce57a063f","seq":4,"duration_ms":480,"bytes_in":1227,"bytes_out":308}],"http_methods":[{"method":"GET","count":40},{"method":"POST","count":8}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":8,"ports":7},{"path":"/clients/","count":8,"ports":7},{"path":"/ssl-vpn/login.esp","count":8,"ports":7},{"path":"/userportal/Controller","count":8,"ports":7},{"path":"/sslvpn/Login/Login","count":8,"ports":7},{"path":"/global-protect/login.esp","count":8,"ports":7}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-3236","tag_type":"cve","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller","reference_urls":["https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection","https://nvd.nist.gov/vuln/detail/cve-2022-3236"]}],"data_as_of":"2026-10-05T20:49:22.518658+00:00"}