{"ip":"103.203.59.3","total_events":75,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"ipip","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (ipip).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,609 bytes sent","bytes_sent":8609,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-31T11:19:41","last_seen":"2026-09-10T01:15:41","events_24h":0,"events_7d":10,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":136180,"org":"Beijing Tiantexin Tech. Co., Ltd."},"source_domain":"scan-59-3.security.ipip.net","known_scanners":["ipip"],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":7547,"proto":"tcp","label":"TR-069","count":75}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":5910},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-07-31","count":2},{"date":"2026-08-02","count":2},{"date":"2026-08-03","count":3},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":3},{"date":"2026-08-08","count":3},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":3},{"date":"2026-08-12","count":2},{"date":"2026-08-13","count":1},{"date":"2026-08-14","count":4},{"date":"2026-08-16","count":1},{"date":"2026-08-17","count":3},{"date":"2026-08-18","count":2},{"date":"2026-08-19","count":1},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-22","count":2},{"date":"2026-08-23","count":2},{"date":"2026-08-24","count":1},{"date":"2026-08-25","count":2},{"date":"2026-08-27","count":3},{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":2},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":1},{"date":"2026-09-02","count":3},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":3},{"date":"2026-09-10","count":1}],"recent_events":[{"timestamp":"2026-09-10T01:15:41","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"f6a8fafb-ae8c-4d3b-9403-3e47a09495c0","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-09-09T14:31:09","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"71b71db2-bb72-4cf9-ac5a-9eab20506214","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-09T14:22:53","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"b428d2c8-3952-496b-a4d2-e4b5b1b9feed","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-09-09T07:58:35","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"46441d72-7851-4e25-8492-5bc7b66d5933","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":77},{"timestamp":"2026-09-08T23:36:04","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"bbd98961-9ac7-4ad4-b733-f49a80bdb5fd","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-07T11:41:17","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"a88e51ba-0b2f-4a13-90d3-1f012c80804c","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":77},{"timestamp":"2026-09-07T00:34:26","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"cb18a340-c94e-4d1c-beb8-98fe95f1c9fc","seq":1,"duration_ms":101,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-06T09:59:28","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"ddada6c2-68d2-4bd3-9f35-5b9eeb195504","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-09-06T08:13:10","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"50caaf0d-5584-4651-8b42-6da62e4162ff","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-04T21:04:22","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"902e1ff3-ff99-43e4-b628-b7ba6fa88bb3","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77}],"http_methods":[{"method":"GET","count":75}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":75,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:7547","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-11T09:52:18.573451+00:00"}