{"ip":"106.58.237.189","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,697 bytes sent","bytes_sent":1697,"session_seconds":5,"persistent":false}},"first_seen":"2026-09-23T12:07:15","last_seen":"2026-09-24T15:35:27","events_24h":4,"events_7d":10,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4134,"org":"Chinanet"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4134","label":"China Telecom","category":"isp","url":"https://www.peeringdb.com/asn/4134"},"cve_matches":[],"malware":[],"top_ports":[{"port":8983,"proto":"tcp","label":"Solr","count":4},{"port":6379,"proto":"tcp","label":"Redis","count":3},{"port":10909,"proto":"tcp","label":"","count":1},{"port":10911,"proto":"tcp","label":"","count":1},{"port":10912,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun040_0000004e_608dab68","a11cun050_0000004f_6b90553b","a11cuq070_0000064f_9f8bde3d"]},"fingerprint_peers":{"a11cun040_0000004e_608dab68":530,"a11cuq070_0000064f_9f8bde3d":1,"a11cun050_0000004f_6b90553b":6},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:116.0) Gecko/20100101 Firefox/116.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:116.0) Gecko/20100101 Firefox/116.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":6},{"date":"2026-09-24","count":4}],"recent_events":[{"timestamp":"2026-09-24T15:35:27","port":8983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"29\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8983\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:116.0) Gecko/20100101 Firefox/116.0\"}","body":"stream.url=file:///etc/passwd","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/demo/debug/dump?param=ContentStreams","summary":"","payload_hex":"504f5354202f736f6c722f64656d6f2f64656275672f64756d703f706172616d3d436f6e74656e7453747265616d7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383938330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3131362e3029204765636b6f2f32303130303130312046697265666f782f3131362e300d0a436f6e74656e742d4c656e6774683a2032390d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a73747265616d2e75726c3d66696c653a2f2f2f6574632f706173737764","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:116.0) Gecko/20100101 Firefox/116.0","ja3":"","session":"f2fec0b4-e3a5-44e6-ae55-1610a99c38c9","seq":1,"duration_ms":100,"bytes_in":322,"bytes_out":79},{"timestamp":"2026-09-24T13:17:00","port":8983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8983\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin/cores?indexInfo=false&wt=json","summary":"","payload_hex":"474554202f61646d696e2f636f7265733f696e646578496e666f3d66616c73652677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383938330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"199c79ed-b239-4ce9-b247-f6875a78c141","seq":1,"duration_ms":100,"bytes_in":264,"bytes_out":79},{"timestamp":"2026-09-24T13:16:59","port":8983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8983\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383938330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"d102ac0c-f29d-4091-9c79-c5fbed9e2afe","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":79},{"timestamp":"2026-09-24T13:16:59","port":8983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8983\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:116.0) Gecko/20100101 Firefox/116.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?indexInfo=false&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f696e646578496e666f3d66616c73652677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383938330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3131362e3029204765636b6f2f32303130303130312046697265666f782f3131362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:116.0) Gecko/20100101 Firefox/116.0","ja3":"","session":"06ff0725-9dee-44e6-ae7a-0b4ee5923d04","seq":1,"duration_ms":100,"bytes_in":232,"bytes_out":79},{"timestamp":"2026-09-23T12:32:34","port":10909,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000�\u0000\u0000\u0000�{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW102\",\"AccessKey\":\"rocketmq2\"},\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":401}","payload_hex":"000000c7000000c37b22636f6465223a3130352c226578744669656c6473223a7b225369676e6174757265223a222f7535502f775a5562686a616e75344c4d2f557a45646f327532493d222c22746f706963223a22544257313032222c224163636573734b6579223a22726f636b65746d7132227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a312c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3430317d","method":"","user_agent":"","ja3":"","session":"ad0d79ad-15d4-40d3-8601-14badbea84cd","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":14,"enriched":{"digest":"4a73fcf8a3dd4698","strings":["{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW…"],"iocs":{"paths":["/u5P/wZUbhjanu4LM/UzEdo2u2I"]}}},{"timestamp":"2026-09-23T12:32:34","port":10912,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000�\u0000\u0000\u0000�{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW102\",\"AccessKey\":\"rocketmq2\"},\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":401}","payload_hex":"000000c7000000c37b22636f6465223a3130352c226578744669656c6473223a7b225369676e6174757265223a222f7535502f775a5562686a616e75344c4d2f557a45646f327532493d222c22746f706963223a22544257313032222c224163636573734b6579223a22726f636b65746d7132227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a312c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3430317d","method":"","user_agent":"","ja3":"","session":"a6df6b65-c81f-4058-904c-d09167b8372d","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":14,"enriched":{"digest":"4a73fcf8a3dd4698","strings":["{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW…"],"iocs":{"paths":["/u5P/wZUbhjanu4LM/UzEdo2u2I"]}}},{"timestamp":"2026-09-23T12:32:33","port":10911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000�\u0000\u0000\u0000�{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW102\",\"AccessKey\":\"rocketmq2\"},\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":401}","payload_hex":"000000c7000000c37b22636f6465223a3130352c226578744669656c6473223a7b225369676e6174757265223a222f7535502f775a5562686a616e75344c4d2f557a45646f327532493d222c22746f706963223a22544257313032222c224163636573734b6579223a22726f636b65746d7132227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a312c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3430317d","method":"","user_agent":"","ja3":"","session":"f5e97e31-aafd-4aa2-bdf0-00fdb43601b1","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":14,"enriched":{"digest":"4a73fcf8a3dd4698","strings":["{\"code\":105,\"extFields\":{\"Signature\":\"/u5P/wZUbhjanu4LM/UzEdo2u2I=\",\"topic\":\"TBW…"],"iocs":{"paths":["/u5P/wZUbhjanu4LM/UzEdo2u2I"]}}},{"timestamp":"2026-09-23T12:07:19","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONFIG GET dir\r\n","payload_hex":"434f4e46494720474554206469720d0a","method":"","user_agent":"","ja3":"","session":"568e4c89-ef23-46fd-8246-869564288beb","seq":3,"duration_ms":4824,"bytes_in":35,"bytes_out":17,"enriched":{"digest":"5deead8c374b384d","label":"Redis (RESP)","strings":["CONFIG GET dir"]}},{"timestamp":"2026-09-23T12:07:17","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INFO server\r\n","payload_hex":"494e464f207365727665720d0a","method":"","user_agent":"","ja3":"","session":"568e4c89-ef23-46fd-8246-869564288beb","seq":2,"duration_ms":2462,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"b6e0e697f5e5513d","label":"Redis (RESP)","strings":["INFO server"]}},{"timestamp":"2026-09-23T12:07:15","port":6379,"proto":"tcp","app_proto":"","app_protocol":"nats","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PING\r\n","payload_hex":"50494e470d0a","method":"","user_agent":"","ja3":"","session":"568e4c89-ef23-46fd-8246-869564288beb","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":7,"enriched":{"digest":"da45302d2f63942b","label":"Redis (RESP)","strings":["PING"]}}],"http_methods":[{"method":"GET","count":3},{"method":"POST","count":1}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/solr/demo/debug/dump?param=ContentStreams","count":1,"ports":1},{"path":"/solr/admin/cores?indexInfo=false&wt=json","count":1,"ports":1},{"path":"/admin/cores?indexInfo=false&wt=json","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"29","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:8983","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:116.0) Gecko/20100101 Firefox/116.0","notable":false}],"distinct_sets":3,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-24T18:20:16.039949+00:00"}