{"ip":"121.41.170.8","total_events":145,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"31+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 31 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,761 bytes sent","bytes_sent":15761,"session_seconds":3,"persistent":false}},"first_seen":"2026-06-16T05:12:09","last_seen":"2026-09-05T12:03:00","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":2650,"proto":"tcp","label":"","count":13},{"port":35021,"proto":"tcp","label":"","count":12},{"port":6096,"proto":"tcp","label":"","count":11},{"port":22993,"proto":"tcp","label":"","count":11},{"port":16088,"proto":"tcp","label":"","count":11},{"port":15222,"proto":"tcp","label":"","count":10},{"port":12399,"proto":"tcp","label":"","count":10},{"port":65229,"proto":"tcp","label":"","count":9},{"port":52022,"proto":"tcp","label":"","count":8},{"port":20790,"proto":"tcp","label":"","count":8},{"port":9796,"proto":"tcp","label":"","count":7},{"port":10526,"proto":"tcp","label":"","count":4},{"port":9971,"proto":"tcp","label":"","count":3},{"port":38905,"proto":"tcp","label":"","count":3},{"port":12404,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":35},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"],"timeline":[{"date":"2026-09-05","count":143}],"recent_events":[{"timestamp":"2026-09-05T12:03:00","port":35021,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"3ed0673d-22d6-42d9-9008-e285a0dcd9ee","seq":1,"duration_ms":1598,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-05T12:02:53","port":22993,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"2e81f07e-3fd4-464c-9ae1-f27a7d3450c4","seq":1,"duration_ms":310,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-05T12:02:52","port":38905,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(.�z�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282ece7a850000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"1868831c-1724-42ff-97b3-ff90e8ba8c3b","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":12},{"timestamp":"2026-09-05T12:02:47","port":12399,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9134d4fd-ffc1-4a09-9b37-0a28f4844e9c","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-05T12:02:45","port":12399,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"6e010a19-4a61-447e-8233-f35896ffa431","seq":1,"duration_ms":968,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-05T12:02:41","port":35021,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ec2276bf-aeea-4080-8b0c-fd9fdb8faa9d","seq":1,"duration_ms":101,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-05T12:02:39","port":6096,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8ae2f81d-69d1-412c-aead-f9dd61d345c3","seq":1,"duration_ms":103,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-05T12:02:38","port":2650,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e3b4d001-6012-4a1d-990e-9f29441657af","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-05T12:02:38","port":20790,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"20b8e2fd-06d0-4d02-8323-4d614e025558","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-05T12:02:38","port":31801,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(,`Y�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282c6059ba0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"e6e37d1a-d43a-4ca4-b2c6-503bbe6ac16f","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":12,"enriched":{"digest":"5ce20b782336b9b6","strings":["(,`Y"]}}],"http_methods":[{"method":"GET","count":86},{"method":"POST","count":8},{"method":"OPTIONS","count":4}],"distinct_ports_total":31,"top_paths":[{"path":"/","count":41,"ports":18},{"path":"/nmaplowercheck1788609623","count":14,"ports":11},{"path":"/NmapUpperCheck1788609623","count":11,"ports":7},{"path":"/sdk","count":8,"ports":8},{"path":"/evox/about","count":8,"ports":7},{"path":"/Nmap/folder/check1788609623","count":8,"ports":8},{"path":"/HNAP1","count":7,"ports":7},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-25T18:06:36.340810+00:00"}