{"ip":"93.152.213.9","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 52,860 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"52,860 bytes sent","bytes_sent":52860,"session_seconds":1,"persistent":false}},"first_seen":"2026-10-04T14:36:08","last_seen":"2026-10-05T17:32:46","events_24h":24,"events_7d":48,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[{"cve_id":"CVE-2022-3236","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller"}],"malware":[],"udp":null,"top_ports":[{"port":3443,"proto":"tcp","label":"","count":12},{"port":5443,"proto":"tcp","label":"","count":12},{"port":4443,"proto":"tcp","label":"","count":12},{"port":6443,"proto":"tcp","label":"k8s API","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105ca010005c603034d63d96b115937e01cb8f16e3f3d3a8b9383585fbe767f8de8f53c9e88b14c1020edfafa8474c4f572a34bf0ad20a392b744020a91d7bf2f22189a2c39ead19e41001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c000995649670abc152d00418e3c1a644ea97e8f900d85bc2870878457c023e42712c89c09edc8948f68390c9c0ee0566d2ec9b5a3d37ff18666b1d12bc6ac7114cc2f67bb5ed0cc57f3ca2e23e77c7e0679ff71550a84ccba28b39c609de91b52312ccb84f3c849ba5d33a076166b1c47584f54d34626f3bea9809d432b44a1e7186469071519cb53870e686b12e966ca6efb52fa991a04dc3a13955aaa317c89615ca9b5cb75790458e63f7a600129b0cea3fb36fe60720ed94c218b1fd07c2c3d00b87c20b40f08795cc3400a434cca7104d6a81de0354700443969533cce0ca4d56b4916a1986f52c85d757d2b2514aa0b65cd771b43c633368636af9479e1335f1e653462db5a7a7080952916c9137ee38626cc56164bac88746190b6020ca7f23d7b7a5fe85b373d3925cb62737153682b098e8f53b4b5c36b4966362e748d75c778bb87ac2c5956636103f77580ec087bd7cb3e4357bb41a0cb47e7974cea04dc230dcc86cfd45caa3d0c453c401fc1752db4987387dac9618c4881bc8b7df90337c04e5d04529575c339f7044ac56200b58ef095b845a51719030b63e47e42b949df9a284b6017616c88182b0d1ba9c24f621e0978a58078241db27d8f62ac4cc50a8fa9a38b801e1f4121714b27e9b78134e8a5a9a65c05ab8088acc2adcc8a3e651a17f3108d3ab70afa9e4e0c119d757705e61a14cc4077cb5195b910c27a6035fa7a9789782a2552158c0c5f951107c10d04767321a4429fa26ebba93c9337be4ce10cf6e3b0e2789ad9c65eb2817cd561093dc88b1c8a389ca64b47cc05e4734c332b627b1930bd2817d6d914ca31767a2294bf884654fbc930a3bf688231567cbcdd24be3d14761462a785492deda1649db14a326c682cf44ce79a89cdd65985545666b24f0da3aadb84a23a461377461b2e6ab980617b773c2c7cf89402dc79e7f497cf82ca5a19a4dfa0c559ea0342662e5b6bb8fd7058c53cc74f164f4b29705b845ad23ac9c9378413ba19346772f48128dc37918862494abcbb1544c7c866bc2b33a23bbb998deb9d7ff21039f830e0c56e78b061d6f42c8e869d7c47bf64311ce841b49ff8a4fa06824291443990c8004006b37661c9049af0c4a64f98c2ac4650a5f1284238cea4095faf20b1cfb776cc13a2f80864d7bc53e621643cf447d84a98a7f7755df151ec124ef401742f79a98a150508204c16639fa991b7523a924104d01985ba4adb647b4433b7155a6d7c045eab56af54a5626023f35c4d9fa358166b747bb825c6b598f90000c82cc963c43520063b323b7fff3cb09786295178a2c783306667cb54f6ccd2e892f6db5d055788a2442e20660a2b3c125c5212271ac02028ab12a61631a7a81ec2cca40a01b932babc71adfe2006350a5143047020d94da10707b43017be204988cc6923244a1895c45c6b94ac5ccbec8a0ba56599005aad3b56547300420c727e46cb2d6f5189fe9acb6836a2a67922424bb5d2a8c67fca463e657c7919461723a5022605efba2d9279931904ad0ed6028b7851b7b3370c9cb09ad7910d486a0d097bc5f983a9d5937e5aaa7c7279d1b7784a2983555b834ea38fbc88b5d2b2b5349832b23a1737dc4586b7a23846f64cf8fb037f075e6bc30f073401a2cc01e6e60eb2719d388c7dca19e8c085b080a070b3c7325ebd44849b5257cf42faa14a3e4df919af710e796b001d002019e8c085b080a070b3c7325ebd44849b5257cf42faa14a3e4df919af710e796b","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun070_0014001f_e9d96a03","b11cuq070_00150816_d7eb4f05"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4088,"b11cun070_0014001f_e9d96a03":10,"b11cuq070_00150816_d7eb4f05":10},"akin_families":{},"user_agents":["TRAC/9900","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-04","count":24},{"date":"2026-10-05","count":24}],"recent_events":[{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":6,"duration_ms":1077,"bytes_in":1942,"bytes_out":462},{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":5,"duration_ms":881,"bytes_in":1631,"bytes_out":385},{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ssl-vpn/login.esp","summary":"","payload_hex":"474554202f73736c2d76706e2f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":3,"duration_ms":491,"bytes_in":911,"bytes_out":231},{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":2,"duration_ms":296,"bytes_in":604,"bytes_out":154},{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":1,"duration_ms":101,"bytes_in":290,"bytes_out":77},{"timestamp":"2026-10-05T17:32:46","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sslvpn/Login/Login","summary":"","payload_hex":"474554202f73736c76706e2f4c6f67696e2f4c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"2652eb2c-cf67-4e05-9418-e5c266f9e85e","seq":4,"duration_ms":686,"bytes_in":1219,"bytes_out":308},{"timestamp":"2026-10-05T17:27:26","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/userportal/Controller","summary":"","payload_hex":"474554202f75736572706f7274616c2f436f6e74726f6c6c657220485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"8bf62de4-f12b-4f50-9844-5fc593a2f966","seq":6,"duration_ms":666,"bytes_in":1948,"bytes_out":462},{"timestamp":"2026-10-05T17:27:26","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"cache-control\":\"no-cache\",\"content-length\":\"202\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"TRAC/9900\"}","body":"(CCCclientRequest\n\t:RequestHeader (\n\t\t:id (1)\n\t\t:session_id ()\n\t\t:type (ClientHello)\n\t\t:protocol_version (100)\n\t)\n\t:RequestData (\n\t\t:client_info (\n\t\t\t:client_type (TRAC)\n\t\t\t:client_version (1)\n\t\t)\n\t)\n)\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/clients/","summary":"","payload_hex":"504f5354202f636c69656e74732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a20545241432f393930300d0a436f6e74656e742d4c656e6774683a203230320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a28434343636c69656e74526571756573740a093a5265717565737448656164657220280a09093a6964202831290a09093a73657373696f6e5f69642028290a09093a747970652028436c69656e7448656c6c6f290a09093a70726f746f636f6c5f76657273696f6e2028313030290a09290a093a526571756573744461746120280a09093a636c69656e745f696e666f20280a0909093a636c69656e745f74797065202854524143290a0909093a636c69656e745f76657273696f6e202831290a0909290a09290a290a","method":"POST","user_agent":"TRAC/9900","ja3":"725543c78edf669194c11dc7a039b56e","session":"8bf62de4-f12b-4f50-9844-5fc593a2f966","seq":5,"duration_ms":551,"bytes_in":1636,"bytes_out":385},{"timestamp":"2026-10-05T17:27:25","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/global-protect/login.esp","summary":"","payload_hex":"474554202f676c6f62616c2d70726f746563742f6c6f67696e2e65737020485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"8bf62de4-f12b-4f50-9844-5fc593a2f966","seq":2,"duration_ms":213,"bytes_in":606,"bytes_out":154},{"timestamp":"2026-10-05T17:27:25","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.5\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"8bf62de4-f12b-4f50-9844-5fc593a2f966","seq":1,"duration_ms":100,"bytes_in":291,"bytes_out":77}],"http_methods":[{"method":"GET","count":40},{"method":"POST","count":8}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":8,"ports":4},{"path":"/clients/","count":8,"ports":4},{"path":"/ssl-vpn/login.esp","count":8,"ports":4},{"path":"/userportal/Controller","count":8,"ports":4},{"path":"/sslvpn/Login/Login","count":8,"ports":4},{"path":"/global-protect/login.esp","count":8,"ports":4}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:3443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-3236","tag_type":"cve","title":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/userportal/Controller","reference_urls":["https://www.thezdi.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection","https://nvd.nist.gov/vuln/detail/cve-2022-3236"]}],"data_as_of":"2026-10-05T22:22:55.454722+00:00"}