{"ip":"121.29.149.86","data_as_of":"2026-10-26T10:41:12+00:00","observed":true,"total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network service provider","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"76 bytes sent","bytes_sent":76,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-03-16T02:38:53","last_seen":"2026-10-24T00:42:29","events_24h":0,"events_7d":1,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":2831,"proto":"tcp","label":"","count":1},{"port":6400,"proto":"tcp","label":"","count":1},{"port":8729,"proto":"tcp","label":"","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105ac010005a80303737fea555f6bf223b60a2aa6c23163c08d1ad8911a373853f197971f4999878e203032ab338777564c6c62f24011afaef641d72c50131ea9aa8f80667ba63dd931001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c07d0135104cacc4086058b4abdab625db81c1a4457ea487470b4184672b3f93bb0b030c971773331bba48fd82954d318793f5cbccd85fd8f1be18da15d613b4efd3534eeb42b1806e52979b77261680c4b47d6bb262b8c91e03c7a19bb8fa7513e8659516e56f086213ca5b96e0480ab3baa46c094aea9c902edb957f85837a3b40afe4cc2926add5e139a206362c7b4e1bf15739d03da2689d4ec64b80e23987a33f5e59281a7c3bea397501a90f6bb3111e25148ccc1152320c01329d825a382988a6ab783b0356a033c41a19920dc858ab2875147a88bf4b74a2954254e9d83a5eb09a32bb865945086d3525bc47a5d2ca0864fbc60602c6c2513105c46943ec4d986b1aa5ea9267c128b50689f3b4805968b7309cc173e15a1d9121dbe1a7035a17df741781113a088a84686ca38fc825c5b666c46050ebc99b32497af8356235a63fb3002819f73d5b854374a0a9884100098ab9b09bbd10c8920d0c5c68e796d25757d24cbc3e1a52bc69329d532507059fe550753cc5177d1275dbbc5ff26ca450e334bf81c4e0e297f9b6a7e46425520245d222a7ee9bb2a9608650ca08b35185d74a145eb44cdbb8c0f50cc30d66544dd568f5e1b7f287809709acf7570fc86617fb7299d1c80c427a6c1a82734422beef048652817959e9805cb21f715cc1ef17c281fb75baa8bce5e53e0b0885ad51636a08cb4f4a0e073545d2481e9aa7a9d41b00dc9acc698cc2817b10fe081552d651809248c6f17341a72324c4b03879a8caf9289f4233ecc30aee947401aa7c5a4520b7f14dc968c516428b50764cb517c63df4b48e509811ab15381acfd4f02f9744c2299ab554faacaef82fd2b9bb5cbcaf12cc56526a4aa6f3942050572cf3909f98098be073079c7b783a39651535a4337423e2bd1d78278104300f43287044cf6abb725fa48fa382c1bc02b5a8312918797b4700899c30747bbc76917c3dfa3344f6fc24c1f873247a6de05b239d332d8e01acf80623b1e10d300a431fc429b96c3a7dd160c1f1759da83f1f260968622bf7955618242fb7755146782969ea08acd1a5eea4a3c5aab784593e36d66819a463e084425ad96650e3ce86a0b7e7ab2933ba4acb562517d52b4058789840695e3b3adedc4702fa5b57f792b1eb502edcc6d605947b6892b7db5e7f1b4a3c733471db9436a858d1949c58072a571971dfe20fbdb9234d1565136bbe507b010dabcfc51122084360227817d98b13d1cb2a65d80dab11b143f38ea393977a13b7d591c8abac8178d520b186849fe5c085525bb3f37e662c3b1a661928f6a4ab74c2c0054d30d02ad1247834f60db53b4c2d66306708372601822b178287dc69b5933c3b60ba8edab8559c5e777660d4416ff7405eb19cb4c4626f6b8b2be4d8324b5812f8f070ddba1c968ca9a25b0e931756b304cfc06c352ba4591f674c6f8155d5ec34607a399974572370951e23893cfc7b1bdc48c5b8b891d149aa3954b2e27121d775dd322f0d5726b70b038a71bf5bc455cb2b0ee00b03c487be7013ac8fd4499f478c41a68639f03ae0a64188b533159bc675134ec99ac2dc072d61796b140c0515470a1a0b8b98e98ce7987c2261325281ae077476ec253f66d8fd1aafb10c0a8858a145cb2144266f1ca515abcd52f7f1f3de1ceceafef5926afd4cbc0174845c9522953ab2add1d6d7914bfb8db948ecb7f73a0c001d0020eafef5926afd4cbc0174845c9522953ab2add1d6d7914bfb8db948ec","tls_ja3":["6639916abfac56b9257ca216677085bc"],"http_akin":["b11cun020_00040004_0a8d7f11","b11cun030_00040011_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3304,"t13i130900_f57a46bbacb6_e7c285222651":2731,"b11cun020_00040004_0a8d7f11":3852,"b11cun030_00040011_c91eaf54":975},"akin_families":{"b11cun020_00040004_0a8d7f11":{"head":"b11cun020_00040004_0a8d7f11","shapes":3,"ips":3849},"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":975}},"user_agents":["Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":1},{"date":"2026-10-24","count":1}],"recent_events":[{"timestamp":"2026-10-24T00:42:29","port":2831,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2831\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323833310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"6639916abfac56b9257ca216677085bc","session":"b06a2d21-4c20-4340-a84b-38720a7fa1ab","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":78},{"timestamp":"2026-09-23T22:29:40","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000","payload_hex":"030000130ee00000000000010008000b000000","method":"","user_agent":"","ja3":"","session":"93185a8e-2a90-4dad-8adf-49d3326436fc","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":13,"enriched":{"digest":"25de8bd668f2cb15","label":"RDP (X.224)"}},{"timestamp":"2026-05-04T14:13:30","port":8729,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8729\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383732390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34392e302e323632332e313132205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","ja3":"","session":"c6dd17e0-50ff-40b6-aeb5-ad364b509a7e","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-16T02:38:53","port":6400,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:6400\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363430300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"89ed1cb5-76aa-444f-92a5-f84f2be4641b","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8729","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[]}