{"ip":"121.199.163.202","total_events":276,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"57+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 57 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"28,293 bytes sent","bytes_sent":28293,"session_seconds":6,"persistent":false}},"first_seen":"2026-02-28T14:33:25","last_seen":"2026-10-05T06:00:31","events_24h":0,"events_7d":274,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":34831,"proto":"tcp","label":"","count":14},{"port":32660,"proto":"tcp","label":"","count":13},{"port":24828,"proto":"tcp","label":"","count":12},{"port":33948,"proto":"tcp","label":"","count":11},{"port":34390,"proto":"tcp","label":"","count":11},{"port":55799,"proto":"tcp","label":"","count":11},{"port":45167,"proto":"tcp","label":"","count":11},{"port":32283,"proto":"tcp","label":"","count":11},{"port":49051,"proto":"tcp","label":"","count":10},{"port":45694,"proto":"tcp","label":"","count":10},{"port":60752,"proto":"tcp","label":"","count":10},{"port":52823,"proto":"tcp","label":"","count":10},{"port":29021,"proto":"tcp","label":"","count":10},{"port":24799,"proto":"tcp","label":"","count":9},{"port":50340,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224","t13i3612h1_bcee18a5b459_e10b9050f4c9"],"tls_client_hello":"1603010200010001fc03038008ab737eb423d3804c87e0fe09bc38b64e43fdd2bc9379e1c7b7aa6f8140220000da0005000400020001001600330039003a00180035000a001b002f0034c010c006c015c00bc001003bc030c02cc028c024c014c00a00a500a300a1009f006b006a006900680038003700360088008700860085c01900a7006d0089c032c02ec02ac026c00fc005009d003d0084c02fc02bc027c023c013c00900a400a200a0009e00670040003f003e003200310030009a0099009800970045004400430042c01800a6006c009b0046c031c02dc029c025c00ec004009c003c00960041c012c00800130010000dc017c00dc0030007c011c007c016c00cc00200ff010000f9000b000403000102000a000a0008001700190018001600230000000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101001500b200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5","382bf461327b7a16e4205fb4b5d1bf09"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun010_00040000_c4b2c4aa","b11cuq040_00040811_2daa70d6","b11cun060_0004001f_e609a46c"]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":46,"t13i3612h1_bcee18a5b459_e10b9050f4c9":134,"b11cun030_00040011_c91eaf54":664,"b11cun010_00040000_c4b2c4aa":673,"b11cuq040_00040811_2daa70d6":288,"b11cun060_0004001f_e609a46c":268},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"],"timeline":[{"date":"2026-09-26","count":1},{"date":"2026-10-05","count":274}],"recent_events":[{"timestamp":"2026-10-05T06:00:31","port":49051,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c6d3f709-f24e-45b0-a613-813ef2cdc960","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":80},{"timestamp":"2026-10-05T06:00:24","port":49051,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"9bc1a2b5-63f9-43c9-9b32-f94740dc643d","seq":1,"duration_ms":6202,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-10-05T06:00:21","port":63872,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"1870361a-4006-4524-a7e1-a084c4183901","seq":1,"duration_ms":364,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-10-05T06:00:18","port":17869,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(-��c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282de4dd630000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"74e01f12-1e6e-43c5-8381-d495cffdc46c","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-10-05T06:00:17","port":52823,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"36a69bc3-935a-4a50-a8ff-29e0c1bb9c26","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":80},{"timestamp":"2026-10-05T06:00:11","port":50340,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"1f493635-4114-4422-8494-8012717a637c","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-10-05T06:00:10","port":32283,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9e390a71-cc1f-42de-beaf-efe8a6052088","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":80},{"timestamp":"2026-10-05T06:00:10","port":55799,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5accfe3e-efb3-4c42-bbfe-9268e1ae8617","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":80},{"timestamp":"2026-10-05T06:00:09","port":55799,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"fe835e18-4c12-4490-9dc1-a668ad9702ae","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-10-05T06:00:09","port":52823,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"1aae9cf0-37d4-47ea-b7c1-a0c2d01cc6f4","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":80}],"http_methods":[{"method":"GET","count":163},{"method":"POST","count":17},{"method":"OPTIONS","count":4}],"distinct_ports_total":57,"top_paths":[{"path":"/","count":90,"ports":40},{"path":"/nmaplowercheck1791179833","count":25,"ports":20},{"path":"/Nmap/folder/check1791179833","count":18,"ports":17},{"path":"/NmapUpperCheck1791179833","count":18,"ports":17},{"path":"/sdk","count":17,"ports":17},{"path":"/evox/about","count":10,"ports":9},{"path":"/HNAP1","count":6,"ports":6}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-10-06T20:37:58.605137+00:00"}