{"ip":"121.199.160.207","total_events":195,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"53+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 53 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,956 bytes sent","bytes_sent":16956,"session_seconds":2,"persistent":false}},"first_seen":"2026-03-17T12:17:14","last_seen":"2026-09-05T12:20:04","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":20408,"proto":"tcp","label":"","count":10},{"port":19786,"proto":"tcp","label":"","count":9},{"port":11028,"proto":"tcp","label":"","count":9},{"port":11260,"proto":"tcp","label":"","count":9},{"port":1430,"proto":"tcp","label":"","count":8},{"port":18812,"proto":"tcp","label":"","count":8},{"port":20106,"proto":"tcp","label":"","count":8},{"port":329,"proto":"tcp","label":"","count":8},{"port":14014,"proto":"tcp","label":"","count":8},{"port":2401,"proto":"tcp","label":"","count":8},{"port":4521,"proto":"tcp","label":"","count":8},{"port":49705,"proto":"tcp","label":"","count":7},{"port":17320,"proto":"tcp","label":"","count":7},{"port":6052,"proto":"tcp","label":"","count":7},{"port":8771,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224","t13i3612h1_bcee18a5b459_e10b9050f4c9"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":30,"t13i3612h1_bcee18a5b459_e10b9050f4c9":96},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"],"timeline":[{"date":"2026-09-02","count":1},{"date":"2026-09-05","count":193}],"recent_events":[{"timestamp":"2026-09-05T12:20:04","port":11260,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"03572178-fa79-4655-b17a-bf91272ce431","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-09-05T12:20:04","port":1962,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\f�t�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000280ce874870000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d2cf92e2-abf1-49a2-a164-83eeb8913749","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-09-05T12:20:03","port":11524,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0012��h\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002812b4cc680000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ea08ebe1-d745-4b16-aab4-4570a3e52bfd","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-09-05T12:20:01","port":49705,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9e70fab5-0775-48e4-9f5f-66a499c7691e","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-09-05T12:20:01","port":19786,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"53cef3ad-c574-4d5f-8b75-7b1b01a72df2","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":80},{"timestamp":"2026-09-05T12:20:00","port":19786,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"97952899-8e25-4f53-95c6-c77f3896595e","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-09-05T12:19:58","port":853,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(7n��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028376e8d9e0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"5be6a935-d75e-435a-b651-a3e3d53b1c90","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-09-05T12:19:56","port":17320,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"a44f5836-f37a-41ed-8d08-0d9474e2a3b1","seq":1,"duration_ms":971,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-09-05T12:19:56","port":4403,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u00187��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002818379ce90000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d69cf764-f231-4512-9fe6-d494c5892ccf","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-09-05T12:19:56","port":20408,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8ee32653-a4a6-4eb1-98ee-5e8c72f2dc8d","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":80}],"http_methods":[{"method":"GET","count":109},{"method":"POST","count":9},{"method":"OPTIONS","count":4},{"method":"HEAD","count":1}],"distinct_ports_total":53,"top_paths":[{"path":"/","count":62,"ports":33},{"path":"/evox/about","count":11,"ports":9},{"path":"/sdk","count":9,"ports":9},{"path":"/HNAP1","count":8,"ports":8},{"path":"/nmaplowercheck1788610657","count":8,"ports":6},{"path":"/nmaplowercheck1788610658","count":8,"ports":6},{"path":"/Nmap/folder/check1788610657","count":6,"ports":5},{"path":"/NmapUpperCheck1788610658","count":4,"ports":3},{"path":"/NmapUpperCheck1788610657","count":4,"ports":3},{"path":"/Nmap/folder/check1788610658","count":3,"ports":3}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T12:58:23.197639+00:00"}