{"ip":"121.40.47.199","total_events":189,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"42+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 42 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,487 bytes sent","bytes_sent":20487,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-09T10:14:04","last_seen":"2026-09-09T10:17:33","events_24h":0,"events_7d":189,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":5098,"proto":"tcp","label":"","count":14},{"port":16689,"proto":"tcp","label":"","count":13},{"port":5675,"proto":"tcp","label":"","count":11},{"port":61151,"proto":"tcp","label":"","count":9},{"port":8517,"proto":"tcp","label":"","count":9},{"port":8905,"proto":"tcp","label":"","count":9},{"port":7970,"proto":"tcp","label":"","count":9},{"port":6607,"proto":"tcp","label":"","count":9},{"port":5519,"proto":"tcp","label":"","count":9},{"port":17005,"proto":"tcp","label":"","count":8},{"port":15230,"proto":"tcp","label":"","count":8},{"port":519,"proto":"tcp","label":"","count":8},{"port":30629,"proto":"tcp","label":"","count":8},{"port":50601,"proto":"tcp","label":"","count":8},{"port":29009,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"ja4h":["ge11nn0300_88b8dd6ae43e","op10nn0000_000000000000","po11nn0400_b49adc7719e4","ge10nn0000_000000000000"]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":28,"ge11nn0300_88b8dd6ae43e":32,"op10nn0000_000000000000":1562,"po11nn0400_b49adc7719e4":3,"ge10nn0000_000000000000":2506},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-09","count":189}],"recent_events":[{"timestamp":"2026-09-09T10:17:33","port":29009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"03bd93f4-3899-481e-807b-bccb9d5acb33","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":78},{"timestamp":"2026-09-09T10:17:32","port":29009,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"9d6a3f8a-7224-415e-99bd-b1047d12ece1","seq":1,"duration_ms":327,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-09T10:17:28","port":8517,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"3e0f1bc4-0c5a-4449-9a9e-0fb4797c024b","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":78},{"timestamp":"2026-09-09T10:17:24","port":8517,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"752e6496-9919-41a1-853a-effb3b8b5020","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-09T10:17:22","port":8614,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0001�X�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028018058980000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"1835fb6b-a92f-4a33-a75c-6b5e4a016e35","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-09T10:17:20","port":6607,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"83ef8a2b-2269-488f-ac0e-f44083c474cc","seq":1,"duration_ms":2873,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-09T10:17:20","port":5675,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8801aec8-f6c0-4404-ae83-2c719781b076","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":78},{"timestamp":"2026-09-09T10:17:20","port":7970,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"010ee34b-e95b-42fe-bcf2-5da28529e2dc","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-09T10:17:19","port":29009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9c656f26-2af9-4938-8ac5-ea24288f899e","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-09T10:17:18","port":10451,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0017�\u0003�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002817f903ca0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6283fa75-4a5e-4932-acef-05de849ab079","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13}],"http_methods":[{"method":"GET","count":111},{"method":"POST","count":15},{"method":"OPTIONS","count":3}],"distinct_ports_total":42,"top_paths":[{"path":"/","count":63,"ports":27},{"path":"/nmaplowercheck1788948920","count":17,"ports":11},{"path":"/sdk","count":15,"ports":14},{"path":"/evox/about","count":10,"ports":10},{"path":"/HNAP1","count":9,"ports":8},{"path":"/Nmap/folder/check1788948920","count":8,"ports":7},{"path":"/NmapUpperCheck1788948920","count":7,"ports":7}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-11T10:37:19.966856+00:00"}