{"ip":"1.24.16.117","total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"touch","label":"Touch only","detail":"0 bytes sent, no real exchange","bytes_sent":0,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-15T08:43:57","last_seen":"2026-03-23T20:54:30","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"dns","events":1}],"ports":[{"port":53,"events":1}],"dns_questions":[{"name":"version.bind","type":"TXT","events":1}],"quic_clients":[],"first_seen":"2026-10-05T18:10:48","last_seen":"2026-10-05T18:10:48","recent":[{"timestamp":"2026-10-05T18:10:48","port":53,"src_port":45164,"proto":"udp","app_proto":"dns","app_protocol":"dns","summary":"DNS query TXT/CH version.bind","payload_hex":"3c8d012000010000000000000776657273696f6e0462696e64000010000300","sni":"","session":"0d57d881-d60c-4f3d-8686-94fc4f5c83f6","bytes_in":31,"source_verified":false,"dns":{"kind":"query","name":"version.bind","type":"TXT","class":"CH"}}]},"top_ports":[{"port":8032,"proto":"tcp","label":"","count":1},{"port":2105,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun020_00040004_0a8d7f11","b10cun020_00040004_0a8d7f11"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3123,"b11cun020_00040004_0a8d7f11":3850,"b10cun020_00040004_0a8d7f11":24},"akin_families":{"b11cun020_00040004_0a8d7f11":{"head":"b11cun020_00040004_0a8d7f11","shapes":2,"ips":3850}},"user_agents":[],"timeline":[],"recent_events":[{"timestamp":"2026-03-23T20:54:30","port":2105,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2105\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323130350d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"664e3278-c4e7-4cf2-a27b-5e80f328379d","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-15T08:43:57","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.0\r\nHost: <HONEYPOT>:8032\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383033320d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"df6d2061-4e74-4fbc-98b2-4d5d333b2f66","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"75ac9b262786a7ac","strings":["ET / HTTP/1.0","Host: <HONEYPOT>:8032","Accept: */*"]}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:2105","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-05T23:10:42.616253+00:00"}