{"ip":"93.152.213.8","total_events":66,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["66 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 72,567 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"72,567 bytes sent","bytes_sent":72567,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-30T18:41:00","last_seen":"2026-10-05T15:25:18","events_24h":18,"events_7d":66,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[{"cve_id":"CVE-2022-3236","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller"}],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":7443,"proto":"tcp","label":"","count":12},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":6},{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":14433,"proto":"tcp","label":"","count":6},{"port":444,"proto":"tcp","label":"","count":6},{"port":5443,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":6},{"port":1443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ca010005c6030390401fc0341032a3b40529409be289d6f4e97cbdc00d20779bb109cf8ff1c9c0209b2ef5eee27aa4a96d5503f1d84e14711790a230c3492ba0fc016dc443768222001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0643c7965479d01582d62acb28ef7861be5163bdc5828610dda0336eb3ca360c9b217f1716ff38f9ad9553be38a98b59176aa883d6924c7b4b32aa2ab81b1ba012b35eab10146d598a6b754e50b863311551fb37cb8684323aa49e80c2eb372b97accbe24a0ac97278fb4546ef55708c9fccd662626fb98341fc379f7469394e888bdd2a58a02b1bd3633409651e9ec8a86774689587653b81612f6a2d5027c26a56de1d01ab3001556b64d87c199cd36bc813c60865110205a756b3422c68273f47766a9797683129af94382df279c4670c4561badc0354cedd2caaff34c7c917b5559bad853108f12cc83e93388f4689b85a9ae2b83b5199edae7b0d71c3de4105d9af8af603498b786b1c9965ee8e3646387653eb40f62441a2aa048f6ebb86980c21f739ceb836af528883ba7098ca592291606143c094c719e3b5b1ba79bb24bd9c2e96a6ded7c544388a4291165c7b063d2b0527ffca8fc0844fd0065a8a81ee795b3fc09d08284a387da79a6aa21a4dc1817e216cf40cbbc526c877c20150b5a00e33b11dc925354523a656b4adc3c7ac474b0e71aa0a731ddc3ae3f977be7c3a1d10a7253966398113c68934b0649788a999e4e0a600ef96f2c3b4e170122543014ddb77838594dabdc3a8ae14d2ab9483bb73c0d116994eb5f2cd84999808b6c221c73a2678828a3bfe25fef3b16c1ac3d0f9b1469d7a6c97080c94216070b89b30472ccdc1a7a18b61e38bd43624dc2a49b06fa16f4f93cc8e4aade7acd3fe2c01d426b1eeca8d82a8c537185e657901935ca54a3613a96aaba93650b260f0d0a965669a7ba2804586192310065a4f4951fe8abd6db03f877205f496ae894cd68a70df2ebc07a7196720109fdd59d3d234e1b93c55ddc542ef1681d8916ecb3693c755e5da9108ae8243306bedc3239820a9fad20582409360cb087fdf3984fab3efe273e0e381aa05c3e3e0966657616766206197a8b7cb24194060cfc328ef261aa4ee13b7291522c82ad9b05c63bca1bdd85beca2a2839ab63d06233405ba9932410b60a19be1292f074c961f69f17754e806c39e7832740890960f91ff7e13022f31072c6ae2a201092db1400f94e42928955f9a15ed085e99ba1b66bc7ca068b8bd2c34115647de90f56161f64d69a5be49c67d6171dc32653d6067c44bbfaf60f16c0be929c48d828b3179a46550a84fe8c0286e48bfb1c89cef3bc6433262cd64d34f95531a83bd21573624753b11b3d9ca78188d04594777228fc5c47766d22b10fbee49fd9c5a2dea82c016a7a78c8b4004d7c5c01182980a3c4a1cd2e7cbcb3ba9f6ef72d8c532f9bd30c821980ae2454f7196414052d0828533a968816c91ad3098334fb255079c26b23972525071ff6c45512793e541fdc802b58f919c9e87c171195b1ba59eb327a3bc936170933b5c514013c6f883291014793827680897414ab0900399b70e2380974169f95661a49f1a14f924a20c1c917271518b65244f57f05ca952e8862d2827e17187adee70d1cbc80ecc468475361d59c243f87350b1c36c46b403e9151e4187bc311081ba16ba38c2b6224b80b7a153ca2553bb8267aa376f3a51d6083212238c2436c1a64a4838db14ac7d59e5c2c21762c1499bf6d1f4aa12361a4d46e297620fdc2900ea4870b25cf524cb276116f49a11f32a456c29cc8675eb6318f06cf99f749d28f0cd9cf2459001d0020524cb276116f49a11f32a456c29cc8675eb6318f06cf99f749d28f0cd9cf2459","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun070_0014001f_e9d96a03","b11cuq070_00150816_d7eb4f05"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4088,"b11cun070_0014001f_e9d96a03":10,"b11cuq070_00150816_d7eb4f05":10},"akin_families":{},"user_agents":["TRAC/9900","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":6},{"date":"2026-10-03","count":6},{"date":"2026-10-04","count":36},{"date":"2026-10-05","count":18}],"recent_events":[{"timestamp":"2026-10-05T15:25:18","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":6,"duration_ms":1076,"bytes_in":1942,"bytes_out":462},{"timestamp":"2026-10-05T15:25:17","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":1,"duration_ms":100,"bytes_in":290,"bytes_out":77},{"timestamp":"2026-10-05T15:25:17","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":2,"duration_ms":296,"bytes_in":604,"bytes_out":154},{"timestamp":"2026-10-05T15:25:17","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":3,"duration_ms":491,"bytes_in":911,"bytes_out":231},{"timestamp":"2026-10-05T15:25:17","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":4,"duration_ms":686,"bytes_in":1219,"bytes_out":308},{"timestamp":"2026-10-05T15:25:17","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"71762013-423f-4103-b036-1e317fb3794d","seq":5,"duration_ms":881,"bytes_in":1631,"bytes_out":385},{"timestamp":"2026-10-05T13:16:02","port":14433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:14433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a31343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"a39d55d6-086c-42f3-8f21-2c55df67900d","seq":3,"duration_ms":490,"bytes_in":914,"bytes_out":231},{"timestamp":"2026-10-05T13:16:02","port":14433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:14433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"a39d55d6-086c-42f3-8f21-2c55df67900d","seq":4,"duration_ms":686,"bytes_in":1223,"bytes_out":308},{"timestamp":"2026-10-05T13:16:02","port":14433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:14433\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31343433330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"a39d55d6-086c-42f3-8f21-2c55df67900d","seq":5,"duration_ms":881,"bytes_in":1636,"bytes_out":385},{"timestamp":"2026-10-05T13:16:02","port":14433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:14433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a31343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"a39d55d6-086c-42f3-8f21-2c55df67900d","seq":6,"duration_ms":1077,"bytes_in":1948,"bytes_out":462}],"http_methods":[{"method":"GET","count":55},{"method":"POST","count":11}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":11,"ports":9},{"path":"/clients/","count":11,"ports":9},{"path":"/ssl-vpn/login.esp","count":11,"ports":9},{"path":"/userportal/Controller","count":11,"ports":9},{"path":"/sslvpn/Login/Login","count":11,"ports":9},{"path":"/global-protect/login.esp","count":11,"ports":9}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:5443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-3236","tag_type":"cve","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller","reference_urls":["https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection","https://nvd.nist.gov/vuln/detail/cve-2022-3236"]}],"data_as_of":"2026-10-05T22:22:50.446727+00:00"}