{"ip":"112.124.56.253","total_events":460,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"86+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 86 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"52,731 bytes sent","bytes_sent":52731,"session_seconds":5,"persistent":false}},"first_seen":"2026-09-11T17:31:26","last_seen":"2026-09-11T17:39:24","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":5432,"proto":"tcp","label":"Postgres","count":16},{"port":19000,"proto":"tcp","label":"","count":15},{"port":87,"proto":"tcp","label":"","count":12},{"port":3336,"proto":"tcp","label":"","count":12},{"port":53389,"proto":"tcp","label":"","count":12},{"port":63790,"proto":"tcp","label":"","count":12},{"port":7999,"proto":"tcp","label":"","count":12},{"port":8021,"proto":"tcp","label":"","count":11},{"port":8004,"proto":"tcp","label":"","count":11},{"port":49178,"proto":"tcp","label":"","count":11},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":11},{"port":8030,"proto":"tcp","label":"","count":11},{"port":222,"proto":"tcp","label":"","count":11},{"port":11521,"proto":"tcp","label":"","count":11},{"port":10000,"proto":"tcp","label":"Webmin","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":30},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-11","count":460}],"recent_events":[{"timestamp":"2026-09-11T17:39:24","port":8004,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"3a05e7c6-d82b-45b6-8ce6-65b5d649c730","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-11T17:39:19","port":9418,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"38418076-835e-4866-83bb-45beefe10f08","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-11T17:39:17","port":8004,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"33f4f006-35f0-486c-99ce-beee8fe26004","seq":1,"duration_ms":2281,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-11T17:39:17","port":9418,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"e89260db-2216-4f9b-9804-c6ab3762f300","seq":1,"duration_ms":981,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-11T17:39:16","port":222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a7a675d2-3625-4aec-9394-725e853a5ce8","seq":1,"duration_ms":101,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-11T17:39:15","port":5826,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"3794e0b5-ff63-4a75-900c-9c9d6d74dae3","seq":1,"duration_ms":975,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-11T17:39:15","port":222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"5716c295-0a1a-4175-849c-bebc0bfde5c9","seq":1,"duration_ms":956,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-11T17:39:14","port":19000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"b221f26b-02b5-4f11-b83f-cf804b05c9bb","seq":1,"duration_ms":3014,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-11T17:39:13","port":11521,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"56e23572-75df-4585-96c2-b564eb55ab92","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":79},{"timestamp":"2026-09-11T17:39:09","port":8024,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"71f4c816-f199-48c5-ab18-58b1501f68f3","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":79}],"http_methods":[{"method":"GET","count":285},{"method":"POST","count":34},{"method":"OPTIONS","count":10}],"distinct_ports_total":86,"top_paths":[{"path":"/","count":148,"ports":51},{"path":"/nmaplowercheck1789148088","count":44,"ports":36},{"path":"/sdk","count":34,"ports":32},{"path":"/NmapUpperCheck1789148088","count":34,"ports":29},{"path":"/Nmap/folder/check1789148088","count":34,"ports":30},{"path":"/evox/about","count":20,"ports":19},{"path":"/HNAP1","count":14,"ports":14},{"path":"/temp%20files%2C/Def%61ult.txt%2etxt","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-24T13:01:29.529131+00:00"}