{"ip":"123.178.210.44","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"229 bytes sent","bytes_sent":229,"session_seconds":1,"persistent":false}},"first_seen":"2026-02-28T14:05:15","last_seen":"2026-09-19T03:11:28","events_24h":0,"events_7d":1,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4134,"org":"Chinanet"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4134","label":"China Telecom","category":"isp","url":"https://www.peeringdb.com/asn/4134"},"cve_matches":[],"malware":[],"top_ports":[{"port":10426,"proto":"tcp","label":"","count":1},{"port":1965,"proto":"tcp","label":"","count":1},{"port":10421,"proto":"tcp","label":"","count":1},{"port":8030,"proto":"tcp","label":"","count":1},{"port":2128,"proto":"tcp","label":"","count":1},{"port":7548,"proto":"tcp","label":"","count":1},{"port":21316,"proto":"tcp","label":"","count":1},{"port":48018,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["6639916abfac56b9257ca216677085bc"],"http_akin":[]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3002,"t13i130900_f57a46bbacb6_e7c285222651":4279},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-13","count":1},{"date":"2026-08-06","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-19","count":1}],"recent_events":[{"timestamp":"2026-09-19T03:11:28","port":1965,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1965\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313936350d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"6639916abfac56b9257ca216677085bc","session":"6d07ae95-9d27-471c-8c14-d7f0af59519a","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":79},{"timestamp":"2026-09-03T11:46:37","port":7548,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:7548\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373534380d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9eee3229-f4f1-4694-a0fe-731d03a480e6","seq":1,"duration_ms":101,"bytes_in":58,"bytes_out":79},{"timestamp":"2026-08-06T04:43:34","port":10421,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:10421\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303432310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"6639916abfac56b9257ca216677085bc","session":"586db418-4ad8-428b-b028-678c26a66ed7","seq":1,"duration_ms":1104,"bytes_in":57,"bytes_out":79},{"timestamp":"2026-07-13T10:51:56","port":10426,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:10426\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303432360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"6639916abfac56b9257ca216677085bc","session":"9287b142-3b6d-45fc-ae26-96c067da4199","seq":1,"duration_ms":1074,"bytes_in":58,"bytes_out":79},{"timestamp":"2026-04-18T17:57:25","port":2128,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2128\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323132380d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"40a1fb38-19d7-462d-a5b0-89813e431910","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-17T05:01:43","port":48018,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:48018\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34383031380d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e4ab1bd6-f10e-4b4c-9d43-c650b3f50499","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-05T01:16:35","port":21316,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�I2��pMCj\u0015���\u0005\"=';�B\u001e&��q+��\u0018�����\u001a=㮁�`La?�k1iO)��湭�e�\u0018M\u0000\u001d\u0000 \u0018�����\u001a=㮁�`La?�k1iO)��湭�e�\u0018M","payload_hex":"02ca4932c1a7704d436a1590cbd205223d273ba1421e2693c4712bf59618c8ffc18d961a3de3ae81e0604c613f816b31694f29fb8de6b9add665ad184d001d002018c8ffc18d961a3de3ae81e0604c613f816b31694f29fb8de6b9add665ad184d","method":"","user_agent":"","ja3":"","session":"a8612f41-d2ba-401c-a47d-442b8789f3d0","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6ecbc6f0060e2975","strings":["pMCj","`La?","k1iO)"]}},{"timestamp":"2026-02-28T14:05:15","port":8030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.0\r\nHost: <HONEYPOT>:8030\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383033300d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"aabe13f6-cec4-4251-90cd-62809beb5165","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04c597b9c89ee477","strings":["ET / HTTP/1.0","Host: <HONEYPOT>:8030","Accept: */*"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":6,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:1965","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-24T14:28:14.433908+00:00"}