{"ip":"112.124.22.223","total_events":115,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"50+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 50 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,768 bytes sent","bytes_sent":7768,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-01T16:23:46","last_seen":"2026-09-01T16:29:17","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":16601,"proto":"tcp","label":"","count":11},{"port":50031,"proto":"tcp","label":"","count":11},{"port":17003,"proto":"tcp","label":"","count":10},{"port":20880,"proto":"tcp","label":"","count":8},{"port":20007,"proto":"tcp","label":"","count":5},{"port":1114,"proto":"tcp","label":"","count":4},{"port":18113,"proto":"tcp","label":"","count":4},{"port":8313,"proto":"tcp","label":"","count":3},{"port":28640,"proto":"tcp","label":"","count":3},{"port":19974,"proto":"tcp","label":"","count":3},{"port":456,"proto":"tcp","label":"","count":3},{"port":30768,"proto":"tcp","label":"","count":2},{"port":2300,"proto":"tcp","label":"","count":2},{"port":5600,"proto":"tcp","label":"","count":2},{"port":9190,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":30},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-01","count":115}],"recent_events":[{"timestamp":"2026-09-01T16:29:17","port":3001,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0015A.U\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002815412e550000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"711af9fa-5571-4ede-856c-d634903d3655","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:16","port":830,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0016���\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002816ecddc30000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d514c87f-28f0-4067-9350-c60fe88e17f6","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:13","port":28640,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u00071�\u0011\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002807318b110000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"0b9d5186-e497-4dc8-bc4b-e949b2e47126","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:13","port":2300,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0016Zfu\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028165a66750000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"8e26192e-b21e-4d5d-a7f4-a0c627debbe0","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:12","port":8313,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(/��\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282fa68f0d0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"719f59c9-c0a8-4b2c-b89f-b082b4750a84","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:11","port":20880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f7002edb-c5cd-44b9-af6a-8f64b8ddfad8","seq":1,"duration_ms":101,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-01T16:29:08","port":7011,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(:�|?\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000283ae37c3f0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"407c6e87-ab68-43ce-8ce1-95dab63e2d9b","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-01T16:29:08","port":50031,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e712dd90-883e-4475-b403-bc97a09312fe","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-01T16:29:06","port":16601,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"393f308d-094c-43b5-942c-6da9076f788c","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-01T16:29:04","port":2221,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000((��:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002828dbcc3a0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"30c84503-c645-43c9-b895-f5e4fd0b4ad2","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14}],"http_methods":[{"method":"GET","count":41},{"method":"POST","count":4},{"method":"OPTIONS","count":2}],"distinct_ports_total":50,"top_paths":[{"path":"/","count":25,"ports":12},{"path":"/HNAP1","count":5,"ports":4},{"path":"/evox/about","count":5,"ports":5},{"path":"/nmaplowercheck1788280043","count":5,"ports":3},{"path":"/sdk","count":4,"ports":3},{"path":"/Nmap/folder/check1788280043","count":2,"ports":2},{"path":"/NmapUpperCheck1788280043","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-24T13:53:30.160456+00:00"}