{"ip":"152.32.185.168","total_events":635,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":null,"why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 5,529,265 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,529,265 bytes sent","bytes_sent":5529265,"session_seconds":14,"persistent":false}},"first_seen":"2026-07-20T18:40:31","last_seen":"2026-07-20T18:41:01","events_24h":0,"events_7d":0,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":10430,"proto":"tcp","label":"","count":635}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1811h1_85036bcba153_b26ce05bbdd6"],"tls_ja3":["b885946e72ad51dca6c70abc2f773506"],"ja4h":["ge11nr09zh_e6502950d40b","po11nr10zh_411354fc6351","po11nr08zh_7acfa6e3d66c","ge11nr07zh_c683925b1d66","ge11nr08zh_22847e83d8c5"]},"fingerprint_peers":{"t13i1811h1_85036bcba153_b26ce05bbdd6":59,"ge11nr07zh_c683925b1d66":24,"ge11nr09zh_e6502950d40b":24,"po11nr08zh_7acfa6e3d66c":24,"po11nr10zh_411354fc6351":24,"ge11nr08zh_22847e83d8c5":24},"user_agents":["Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/605.1.15","Mozilla/5.0 (Linux; Android 12; Mi 4 LTE; Build/SQ3A.240112.188) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.124 Mobile Safari/537.36","Mozilla/5.0 (Android 12; Mobile; rv:122.0.0) Gecko/122.0.0 Firefox/122.0.0","okhttp/3.14.9","Mozilla/5.0 (Android 12; Mobile; rv:128.0.1) Gecko/128.0.1 Firefox/128.0.1","curl/7.4.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","Dart/3.5"],"timeline":[{"date":"2026-07-20","count":635}],"recent_events":[{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/leftDao.php%3Fcallback%3DjQuery183016740860980352856_1604309800583\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/leftDao.php?callback=jQuery183016740860980352856_1604309800583","summary":"","payload_hex":"474554202f6c65667444616f2e7068703f63616c6c6261636b3d6a51756572793138333031363734303836303938303335323835365f3136303433303938303035383320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f6c65667444616f2e70687025334663616c6c6261636b2533446a51756572793138333031363734303836303938303335323835365f313630343330393830303538330d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"542a9d87-49ac-4294-bfbd-21af3ab6ace4","seq":42,"duration_ms":12955,"bytes_in":18440,"bytes_out":3318},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/wap/api/syspara%21getSyspara.action%3Fcode%3Dcustomer_service_url\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/wap/api/syspara!getSyspara.action?code=customer_service_url","summary":"","payload_hex":"474554202f7761702f6170692f7379737061726121676574537973706172612e616374696f6e3f636f64653d637573746f6d65725f736572766963655f75726c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f7761702f6170692f73797370617261253231676574537973706172612e616374696f6e253346636f6465253344637573746f6d65725f736572766963655f75726c0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"02e7d6c0-36bb-45c6-9501-178cebe7f04f","seq":43,"duration_ms":12947,"bytes_in":18819,"bytes_out":3397},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-length\":\"21\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/api/heartbeat\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"{\"id\":\"1\",\"uuid\":\"1\"}","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/heartbeat","summary":"","payload_hex":"504f5354202f6170692f68656172746265617420485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f6170692f6865617274626561740d0a436f6e74656e742d4c656e6774683a2032310d0a0d0a7b226964223a2231222c2275756964223a2231227d","method":"POST","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"7de2925d-4d54-460c-9cc4-cac144ef7341","seq":44,"duration_ms":12959,"bytes_in":19380,"bytes_out":3476},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"02e7d6c0-36bb-45c6-9501-178cebe7f04f","seq":42,"duration_ms":12645,"bytes_in":18292,"bytes_out":3318},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-length\":\"0\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/site/api/v1/site/vipExclusiveDomain/getGuestDomain\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/site/api/v1/site/vipExclusiveDomain/getGuestDomain","summary":"","payload_hex":"504f5354202f736974652f6170692f76312f736974652f7669704578636c7573697665446f6d61696e2f6765744775657374446f6d61696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f736974652f6170692f76312f736974652f7669704578636c7573697665446f6d61696e2f6765744775657374446f6d61696e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"542a9d87-49ac-4294-bfbd-21af3ab6ace4","seq":41,"duration_ms":12644,"bytes_in":17909,"bytes_out":3239},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/favicon.ico\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f66617669636f6e2e69636f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"7de2925d-4d54-460c-9cc4-cac144ef7341","seq":43,"duration_ms":12646,"bytes_in":18909,"bytes_out":3397},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/client/api/findConfigByKey%3FconfigKey%3Dlevel_config\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/client/api/findConfigByKey?configKey=level_config","summary":"","payload_hex":"474554202f636c69656e742f6170692f66696e64436f6e66696742794b65793f636f6e6669674b65793d6c6576656c5f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f636c69656e742f6170692f66696e64436f6e66696742794b6579253346636f6e6669674b65792533446c6576656c5f636f6e6669670d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"3d2b2f3d-63d5-4367-a82d-64ac3ed70d1c","seq":47,"duration_ms":14198,"bytes_in":20275,"bytes_out":3713},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/Public/Mobile/ecshe_css/wapmain.css%3Fv%3D1545408652\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/Public/Mobile/ecshe_css/wapmain.css?v=1545408652","summary":"","payload_hex":"474554202f5075626c69632f4d6f62696c652f65637368655f6373732f7761706d61696e2e6373733f763d3135343534303836353220485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f5075626c69632f4d6f62696c652f65637368655f6373732f7761706d61696e2e63737325334676253344313534353430383635320d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"2b393552-bf24-43ec-a7dd-3503e549f90a","seq":43,"duration_ms":12580,"bytes_in":18578,"bytes_out":3397},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-length\":\"0\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/api/system/systemConfigs/getCustomerServiceLink\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/system/systemConfigs/getCustomerServiceLink","summary":"","payload_hex":"504f5354202f6170692f73797374656d2f73797374656d436f6e666967732f676574437573746f6d6572536572766963654c696e6b20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f6170692f73797374656d2f73797374656d436f6e666967732f676574437573746f6d6572536572766963654c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"302054f2-5faf-45b2-bcf2-f483768c3622","seq":42,"duration_ms":12580,"bytes_in":18300,"bytes_out":3318},{"timestamp":"2026-07-20T18:41:01","port":10430,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"zh\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:10430\",\"referer\":\"https://<HONEYPOT>:10430/api/set/appSysSet/getKeyByParam%3Fkey%3Dsys_set\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/set/appSysSet/getKeyByParam?key=sys_set","summary":"","payload_hex":"474554202f6170692f7365742f6170705379735365742f6765744b65794279506172616d3f6b65793d7379735f73657420485454502f312e310d0a486f73743a20<HONEYPOT>3a31303433300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031355f31206c696b65204d6163204f53205829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204372694f532f3130372e302e353330342e3236204d6f62696c652f313545313438205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d4c616e67756167653a207a680d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a31303433302f6170692f7365742f6170705379735365742f6765744b65794279506172616d2533466b65792533447379735f7365740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"eb872f48-7c5d-4fbe-b34d-8bf224b2fffa","seq":43,"duration_ms":12572,"bytes_in":18779,"bytes_out":3397}],"http_methods":[{"method":"GET","count":599},{"method":"POST","count":36}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":12,"ports":1},{"path":"/api/user/ismustmobile","count":8,"ports":1},{"path":"/api/","count":4,"ports":1},{"path":"/favicon.ico","count":4,"ports":1},{"path":"/join_room","count":4,"ports":1},{"path":"/h5/","count":4,"ports":1},{"path":"/api/v1/getGameList","count":2,"ports":1},{"path":"/site.js","count":2,"ports":1},{"path":"/Public/Home/ecshe_css/main.css?v=1543997196","count":2,"ports":1},{"path":"/Public/home/wap/css/qdgame.css","count":2,"ports":1},{"path":"/Public/Mobile/ecshe_css/wapmain.css?v=1545408652","count":2,"ports":1},{"path":"/Public/home/common/js/index.js","count":2,"ports":1},{"path":"/public/static/home/js/moblie/login.js","count":2,"ports":1},{"path":"/admin/webadmin.php?mod=do&act=login","count":2,"ports":1},{"path":"/wap/api/syspara!getSyspara.action?code=customer_service_url","count":2,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":345}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Content-Length","Content-Type","Host","Referer","User-Agent"],"representative":[{"name":"Accept","value":"application/json,text/html,*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"zh","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"21","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:10430","notable":false},{"name":"Referer","value":"https://<HONEYPOT>:10430/api/heartbeat","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/107.0.5304.26 Mobile/15E148 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-07-30T23:52:28.529857+00:00"}