{"ip":"134.168.246.134","total_events":93,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"26,878 bytes sent","bytes_sent":26878,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T04:52:34","last_seen":"2026-10-02T04:44:38","events_24h":8,"events_7d":43,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":49502,"proto":"tcp","label":"","count":14},{"port":3479,"proto":"tcp","label":"","count":14},{"port":49666,"proto":"tcp","label":"","count":8},{"port":1112,"proto":"tcp","label":"","count":8},{"port":43080,"proto":"tcp","label":"","count":7},{"port":10605,"proto":"tcp","label":"","count":7},{"port":18301,"proto":"tcp","label":"","count":7},{"port":5351,"proto":"tcp","label":"","count":7},{"port":11445,"proto":"tcp","label":"","count":7},{"port":52230,"proto":"tcp","label":"","count":7},{"port":8082,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105ac010005a80303f0f1fda41498a243f022acc3f5c0ffca7cab0ec1d6278f73551eb30047263343206c232a1b0a1dda82a35f475cde568dd61abed3e791b9902c1b602e15088f7793001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c095087c6eb086b7690113884d35937b5c31b5a5d4c136748a5c6c8726c55fe9e32b6ed210df42c428060181725afe2cca8e79b1846009ea8b7d0f317eb85c79da5b41c53604d4892585d3addff9a0e618b6678c507ab2859a06132b07c76acaca8e2224cbe2b3f93c29ab77011fa6adce7050472bb44507ab0583298f8812e5e3c2752215c80302aac6b146330444aa9efe528e81aa931950cc574166ebe26bcfa9101bac817a8812c43a7567e46b4d84c0bad86236a427a346407fdcb4bd76159a7681b60282ed0381ddd14f8475cb13f36cbd3b009d0c3bf2f11414b433fc7859cf6691b522080694c3ded5a0575c983d8a12549753aa312d170594ac077f90445f09f7686740abbf145636a24c93197f4ff7952cb39f1ef5073be8ae7ee6c514fa6610b7859a54768954a5c77c0cb23b8d5fe626a2cb097d3222fe6b89e1ba1bb57c17eeb10c26192f01f75974fb4d9041b05866701fbcc3a15cb361d4ce3e35cb0ba770d3e84baa938aa946594189b76f803a89a0357d9514b5c35418a19576129076954de5f33bde556ae842496dc798c133470ff3cb0b2945dfd51df5685097560a6231c710b98ae939a91159c269d71d4a898400354ec2965694f6844c017bb051acaec501600008f8e3322cd007d5e705bd072539414ca39691befaaf03f75987676e9afb76679a6c5b663f9d5cb79661516c2ac65dac8644862487e84930e3cc41548dadaccbcf3634dfe65560b528e7e6a742a09abbebc7454908388b98bd2c3d5299afac7268573a859d738b2ec171d22c0560ecab5bca365038013f2941e0126a7038c375905f32907875a3c753ab6a87b5201913cfc23cbdee18a3cbc58980c5b402eb8665a98a8f889c9d44b2614c29fca3502efa9fa974301ea6be83639e49741f00985ff6ec7c80862ec3d53c92a4020a0297cabcb654b8950ce94c2391572f0690e376761d7443e6d10289dc98aaf07a67458070ccc2112a778c784fb6ec03fe6347d106addfc9376299bc0a5c94ad43370e1a09b1b2077b22b670c7aa87a07360a60d7f2a55dd115146b76e35f989e6fa5202e25486957fe1d07343e72a311656b2786d71f87606d36c739c145695333596096827b22cd7153ec38e54f3ca466486971b2b069c1891b26d08105584152f67ab5126620b3b2ba587e2c0a7429a55d8958c2697681b98fec50738515f12e42d0461a95fe0cc14ca704ee3605ab11d3a0c45bb59b0a85b2acc6ac615835321e9686ba583187783df220a2f015c667a06ac8484855470498907904117b2b77c42229c9e5863cca5c0e0336a08437fc844027c148ba4a2672c16760d69392a4c68da96ae24e5949b1180d152542ef7593cc13e0ef097427677b22c4238b0b6d861aa8b8102fbe95b0650c123d72836a2720d407a3ca96d44469b08ab282d6b3d2b88021788c25478557b1229a28534a9c309ccf629e3209696766e857b4682790e3eac4957f789fb71cba9364e11b51191306c87400e1151534e1a1bf814c7be54bc92310d5c3b46943297da9b62622bbf1c985302c3a55de772188b1ac5ac3fe0483a94bc78b1ea58db0a32c40c4a067c87a071371ae498cd922f38366a33b4c122b81ad5187889f818ff3e6a5da8ed6e2def4c29fe5ae9ecea38490b1f30a1e22524837813fbe4872b9fa49e3b07b03381405916de7e6224e97d9d3e182473f84348c984de31001d0020e4872b9fa49e3b07b03381405916de7e6224e97d9d3e182473f84348","tls_ja3":["6639916abfac56b9257ca216677085bc"],"http_akin":["b11cun030_00040018_f74a6e72","b11cun050_0004001e_5f886858"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3375,"b11cun030_00040018_f74a6e72":564,"b11cun050_0004001e_5f886858":562},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"],"timeline":[{"date":"2026-09-15","count":22},{"date":"2026-09-16","count":21},{"date":"2026-09-17","count":7},{"date":"2026-09-28","count":14},{"date":"2026-09-29","count":21},{"date":"2026-10-02","count":8}],"recent_events":[{"timestamp":"2026-10-02T04:44:38","port":49666,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:49666\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393636360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f375f3029204170706c655765624b69742f3533352e313120284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31372e302e3936332e3536205361666172692f3533352e31310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","ja3":"6639916abfac56b9257ca216677085bc","session":"327fb861-ee70-4817-afc2-7a3982a73870","seq":1,"duration_ms":100,"bytes_in":421,"bytes_out":80},{"timestamp":"2026-10-02T04:44:33","port":49666,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:49666\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393636360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"50176354-5820-4a7c-838e-37dfd8284d40","seq":1,"duration_ms":100,"bytes_in":434,"bytes_out":80},{"timestamp":"2026-10-02T04:44:33","port":49666,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:49666\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a34393636360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"90f5404c-146e-419c-abd6-4094cd468d5d","seq":1,"duration_ms":100,"bytes_in":433,"bytes_out":80},{"timestamp":"2026-10-02T04:44:33","port":49666,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:49666\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393636360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"8412e0ff-f751-4fe7-ac6f-05043d7b49b4","seq":1,"duration_ms":100,"bytes_in":434,"bytes_out":80},{"timestamp":"2026-10-02T04:44:15","port":49666,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:49666\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393636360d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"e6de7dbc-e399-44e4-8af3-81ff9edbf658","seq":1,"duration_ms":100,"bytes_in":255,"bytes_out":80},{"timestamp":"2026-10-02T04:43:57","port":49666,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000�\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000","payload_hex":"000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"35945f2f-4083-4b20-801e-ec2f1d91d987","seq":1,"duration_ms":101,"bytes_in":168,"bytes_out":15,"enriched":{"digest":"517d6cf13ba58442","strings":["SMBr","PC NETWORK PROGRAM 1.0","MICROSOFT NETWORKS 1.03","MICROSOFT NETWORKS 3.0","LANMAN1.0","LM1.2X002","Samba","NT LANMAN 1.0","NT LM 0.12"]}},{"timestamp":"2026-10-02T04:43:39","port":49666,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u00003.�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000332ee00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"5609ad11-7bd2-4cd4-9865-4f2fd7857b44","seq":1,"duration_ms":101,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"c91e42b831f80102","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-10-02T04:43:20","port":49666,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u000b\u0006�\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300000b06e00000000000","method":"","user_agent":"","ja3":"","session":"d64c5418-5ece-405b-8e1d-8660ad951781","seq":1,"duration_ms":100,"bytes_in":11,"bytes_out":15,"enriched":{"digest":"c6ea7c5d89294245","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-29T17:07:01","port":3479,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:3479\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333437390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f375f3029204170706c655765624b69742f3533352e313120284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31372e302e3936332e3536205361666172692f3533352e31310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","ja3":"6639916abfac56b9257ca216677085bc","session":"81e589fc-920d-4973-80e3-b22e60928d73","seq":1,"duration_ms":100,"bytes_in":421,"bytes_out":80},{"timestamp":"2026-09-29T17:06:54","port":3479,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:3479\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a333437390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"7fdf6a99-a815-47b3-ae32-74e1610c8493","seq":1,"duration_ms":107,"bytes_in":434,"bytes_out":80}],"http_methods":[{"method":"GET","count":65}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":13,"ports":11},{"path":"/config.json","count":13,"ports":11},{"path":"/robots.txt","count":13,"ports":11},{"path":"/sitemap.xml","count":13,"ports":11},{"path":"/favicon.ico","count":13,"ports":11}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"<HONEYPOT>:49666","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-02T21:48:54.280740+00:00"}