{"ip":"134.168.249.217","total_events":111,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"28,242 bytes sent","bytes_sent":28242,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-14T17:27:01","last_seen":"2026-09-22T10:41:39","events_24h":15,"events_7d":81,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":20000,"proto":"tcp","label":"","count":27},{"port":7000,"proto":"tcp","label":"","count":11},{"port":5706,"proto":"tcp","label":"","count":8},{"port":18980,"proto":"tcp","label":"","count":8},{"port":49674,"proto":"tcp","label":"","count":8},{"port":2022,"proto":"tcp","label":"","count":7},{"port":5090,"proto":"tcp","label":"","count":7},{"port":7778,"proto":"tcp","label":"","count":7},{"port":11280,"proto":"tcp","label":"","count":7},{"port":1027,"proto":"tcp","label":"","count":7},{"port":10143,"proto":"tcp","label":"","count":7},{"port":1337,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105ac010005a803038df156c9dbf4f731f295dcb3cfd3da659db750a533e0487c8ea21fdec853f01d2055fb398b6479994b9db64d3374c2c9eeca9a25a14748bb1a0e00879a7986e20a001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c058b76893a68044bc39e146139e1a039d37ad05874540992348605c30e6ae17340ef8ea1737f57571765bd7475a1324839182c063eb2538a964d06ab86fdc91ce851181c218d77806ed7779ead008a304077cb5553c6cc397279b9675372110250e2c5262f1b4b97121566826a7666779c71ec1532327511077e98c73d94c5d9bb80b955f0d3a1e9ca09d6d64ce1369bc7714261b6a7b2e722a685006e69475a9a3803958181ca7cb4534806f5413a178550295711bc4b50df72abc8b6cfdb25d05f305868b1aed9977f3c00ea9e5706d063c766010475135d426034fd21ee831a84f555159d36dc7498670581a34e38d433b8bc35595c802c559d87ece7112a1d89a5b1772df7673e25623d67b25c186a91e9ab5e5c24d7325046e4c995ba85549e3b9efeb610788ba8027c2066614a42748c5494c7c10012941bf0645c62088c8e7d975c52c745e483c5b63894987c575e564be2ba847809ab01b61e1623b2dbc5215f55b6c53ba5c71919217849d89bb51c01184d30346043e1c525bbdb1cacad191c37231d5f5b38af26b1214141ea606bc464c061898a1aa8ed4906ea062175df5bf01a03295539aa2b393481b0503318afa030cd365b128ab527e177a7edbc9be8087cf81677d8084f3c8adb494584c217ae5c6cf93cb45b784a6c471c01f46a0bdb7591795552b002ea1a66e6f5c37231b7d491c06ea17ccdef365fad592d4eba369f830ea338da81c883ad01a82c86735373a4ea49701355bba5a701602b547a621a634b055746678840ea8363376b114f79b94ad1138da6a4582591909bb9d18871c73306134e82456a98787717c0d49726201b9c0da011912cefc2569fd823bcc78bb7e729984db4fe061bfa9255451600ea99c43206ab1ec8a89af84aa6b7304f7a91f688bb3cc4931ddc59c4834353e60b69bdc85a81830bbd8c0770b42b169982589273788b97fe22b51eca5ba643e8bb198117239f443cba23c6ae7b6425cc56e20b08a0cab25a196091c44768d6740faa38681520eae96ca94b09569b74f3194b4fbab8361264bd9133c0ad89a14f335c457ae8c18b28e525959349221ac0c8b638747f79d9190b2a9c6ba8d09c2032c965a2a1983334c5cb67566e382aefcc86ea579bdf850a78a454920143db5bbff320907eb9d24a73374ccae9d68bd39b00568392cf23c96055bc4a198a14013cec9280c3d4a72a23801eae9bf5993b9d9d2c248bca23811b2bbab3037705f9fe33d6ac70055974af21c104ad8af9c9481ce4605dfa8794abc7adf442d2b3b56958363a23715fb61cb38ac028e515290bca01fe3672d858ff0e082b40c9e6914ca7ba24829585acc5c1e4ad2906f05a72c85cf5bf910c8bc5af6f5caa83651211276c13867f0ec0b715298f10296014927087ab3613c6b983b7f95d2ca60e4bfae6aa5612c02fd625997159baba672c23934b88b9a52e8af9755c73c9649f5d45f1c16a0d39b92b6c0cd9f45a556bbcbcc626a7c165537ec251da837d825721599c460557e7515c30953024b28234e8443c99c924d8ab555970f3c572e02f20f3ea1403148bb77313a7ef3915b22be6834418a42c93a541511ccca67a89b81566e6f9b2198008ddad234f81530ae928d08149f19f0fe5289e62761a5b81f856b2af611459d56e84f48da40f78df5497d72863f17c260aad86928286c92593c0340cb0cd3a158bf970849001d002040f78df5497d72863f17c260aad86928286c92593c0340cb0cd3a158","tls_ja3":["6639916abfac56b9257ca216677085bc"],"http_akin":[]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":4464},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"],"timeline":[{"date":"2026-09-14","count":14},{"date":"2026-09-15","count":16},{"date":"2026-09-16","count":7},{"date":"2026-09-19","count":45},{"date":"2026-09-21","count":14},{"date":"2026-09-22","count":15}],"recent_events":[{"timestamp":"2026-09-22T10:41:39","port":49674,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"185.228.81.201:49674\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a34393637340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f375f3029204170706c655765624b69742f3533352e313120284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31372e302e3936332e3536205361666172692f3533352e31310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","ja3":"6639916abfac56b9257ca216677085bc","session":"0167f6cc-b378-418b-badf-562081d5843e","seq":1,"duration_ms":100,"bytes_in":423,"bytes_out":80},{"timestamp":"2026-09-22T10:41:31","port":49674,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"185.228.81.201:49674\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a34393637340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"5043a6cc-97ca-44e5-bb6d-b2d2f7737f46","seq":1,"duration_ms":100,"bytes_in":436,"bytes_out":80},{"timestamp":"2026-09-22T10:41:31","port":49674,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"185.228.81.201:49674\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a34393637340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"f053bc8d-74be-4955-b111-54a1ab6d4d58","seq":1,"duration_ms":100,"bytes_in":435,"bytes_out":80},{"timestamp":"2026-09-22T10:41:30","port":49674,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"185.228.81.201:49674\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a34393637340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"8dc84994-4ff5-4ea0-88dd-fba591772288","seq":1,"duration_ms":100,"bytes_in":436,"bytes_out":80},{"timestamp":"2026-09-22T10:41:11","port":49674,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"185.228.81.201:49674\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a34393637340d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"dcb6b46c-e1c3-4d44-a158-d413deb7aad7","seq":1,"duration_ms":100,"bytes_in":257,"bytes_out":80},{"timestamp":"2026-09-22T10:40:53","port":49674,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000�\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000","payload_hex":"000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"3c4e8148-cf44-43cf-831e-4c0f381d1edb","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":15,"enriched":{"digest":"517d6cf13ba58442","strings":["SMBr","PC NETWORK PROGRAM 1.0","MICROSOFT NETWORKS 1.03","MICROSOFT NETWORKS 3.0","LANMAN1.0","LM1.2X002","Samba","NT LANMAN 1.0","NT LM 0.12"]}},{"timestamp":"2026-09-22T10:40:35","port":49674,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u00003.�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000332ee00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"274650f1-3c31-41e5-9a9d-b4810a9a0aa0","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"c91e42b831f80102","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-22T10:40:16","port":49674,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u000b\u0006�\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300000b06e00000000000","method":"","user_agent":"","ja3":"","session":"42fa3687-d515-4cdf-9f00-b373aacb69b9","seq":1,"duration_ms":101,"bytes_in":11,"bytes_out":15,"enriched":{"digest":"c6ea7c5d89294245","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-22T04:53:10","port":1027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1027\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a313032370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"e4e70766-fb49-496e-8ddf-8461f6547d2c","seq":1,"duration_ms":101,"bytes_in":433,"bytes_out":80},{"timestamp":"2026-09-22T04:53:09","port":1027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1027\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313032370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"ef2f5963-5f78-455f-8bc9-58ddb3b5a4dd","seq":1,"duration_ms":100,"bytes_in":432,"bytes_out":80}],"http_methods":[{"method":"GET","count":60}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":12,"ports":12},{"path":"/robots.txt","count":12,"ports":12},{"path":"/sitemap.xml","count":12,"ports":12},{"path":"/favicon.ico","count":12,"ports":12},{"path":"/config.json","count":11,"ports":11},{"path":"/hazelcast/rest/cluster","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":5}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"185.228.81.201:49674","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-09-22T17:35:40.711562+00:00"}