{"ip":"165.154.194.209","total_events":112,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"29,861 bytes sent","bytes_sent":29861,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-15T03:21:25","last_seen":"2026-09-29T17:51:47","events_24h":11,"events_7d":42,"geo":{"country_code":"TW","country_name":"Taiwan","region":"","city":"","lat":24.0,"lon":121.0,"asn":142002,"org":"Scloud Pte Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":11},{"port":3306,"proto":"tcp","label":"MySQL","count":9},{"port":2049,"proto":"tcp","label":"NFS","count":8},{"port":49152,"proto":"tcp","label":"","count":8},{"port":30010,"proto":"tcp","label":"","count":7},{"port":8022,"proto":"tcp","label":"","count":7},{"port":631,"proto":"tcp","label":"IPP","count":7},{"port":10262,"proto":"tcp","label":"","count":7},{"port":50777,"proto":"tcp","label":"","count":7},{"port":10011,"proto":"tcp","label":"","count":7},{"port":8009,"proto":"tcp","label":"","count":7},{"port":60118,"proto":"tcp","label":"","count":7},{"port":8099,"proto":"tcp","label":"","count":7},{"port":7070,"proto":"tcp","label":"","count":7},{"port":2323,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105ac010005a80303f51f6bf55499106d1d75648990c103aadf8107d3c1aba2edfa74d873f235db8b202d17706778c6a493263bc9c32d74676feff973e17ac7c8752e30d0c610346244001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c07e13573118a8ceb70038851db27b3706b9cf8b522a66f80e28868094d31033311a7bc14a9a39c11815cfad231bd1c6829aea5d91368c9c34c31962afa323ce665ca18b2824903c8ebddc5242674e0f29b39016c6a49c2e6e5627ed4b6de60683f4ca898b297e2808c3592355e189b51e193de8d51ce75a6546218eb0ac43d8384cab5874a4f0344b79ae141bbb1ce52b9930cf5612b5225931642cc3ee0166b27031bff752a54651419509d637bb1a2600b1e695383b856f725b572b8249f84006ab0ab3e88c31e055ab60517e0705d979be9b364ccabcbee46c400a003cc279be6f2b48d5c85a8d17224a085340e307112458643452c6c3c5b80b12a6cc5295767a62f4b89c318e54d674925645f7e6c618b8aa3fb12cccd8c8fc32948780a8cea03d925088da3a4c3f953cf45a0a8c9a591a36b7d82879778851ab1b1b18dbca0a9110fd112a912bb0612a5242f2854fcc5e32a36b82128e1724cf6b8c9b83c95d9e646d2ebb8c10e891954b9afc042600908ed3b12a1af16dc409ac8df3290938987d4cb803608b51998b3b74387f07115ae6b6a2d41f9322cef66c3db2bacf5840a653126513122e6754718a9b3fd7e76aeae72c398b7d0c2a18a5d16e92a3b7944a88c8d84345532086d8c5da66044fb37fbb2c1276b484486707da420bc8d777042238f0476aec509a93e48db8b98e7ad3bd8c5c0f580c7e44e16754a0787248b9898040466519b9b07f6b3608c062ae3e48870d83c99c748eec6032aa06276c1811de5bc63ad23bd653859ff9bc23f634dd47ad78fa8dee34a1a15abf7918b9b480498d73c075d259c65578e579364a8a4f2c18697596cf68f4cdd02424f5e33f2c4343e5f111cc45b5df30bd388b7a3f859cd63435b15268a7c14ad187034723872ad40ee7b8b162546dc71b3056cab4b9a93a66077ed5286753f6a882838238731eafe94af6a11ba907c77dd423bb8851fe850a2065afc0d1981c8b172f21cad9d33026b757bb664858b00cea122064a43bc57c1baeb77267d055e71031dac655174735a1e601728b4aa8d55afdb733c2197cd8c4370624c7c828227796a14253b8417bcc107cbd2ff14522b9b405a60b017747821a886b7b291b44b22751cfc56521c6708a394c0f7f08a9a5c18e65744b42c8a3fbcaac00795b4452bcb4e616530012ee733f7f7126de4a38a4b7495b5383d9c47506e3c0aee79dfe242469948637cb279d1b101fa99415c157aba4cd47c763891b15f2731b6e5b546f3a818e1815c7c6b54fccaa1594b684b9be3e9305335cb349db8f88c59731128bd7147298a56463b2a3bc2809790542a6e8aaf1236d1a67b151a41fcf9116b176bbad085e379936fe1bcad3b5c6e37c7deec455dce06196b7392446c794081e6b5580c7d6c8ddc6949786aa4ac5ab0da42d03a73f4ff9513a6a9eb521b2c8c9bc18900ee9b261e93b49c0871a5ee4a2a76812aa936b9558c8fd2710d21c669548739c5179da514704b7284c452fa283c01f4052d5980a3d954dccd0c20fa6ad2cb7bc339520e313c378234d7c670975316568455e70357fd3871d8cfcb36a0a290b0a2c5665bad2c218cd771b16f24570a649b836c224f076a7e93f986a2d259de36f937e3ec3740fab7ffda503ab907cf6b49273726493506545148ee04440937b23e9f5431820cc3dfed5ccae76ae5d7153cb504fbe953b39423c3b7642001d002040937b23e9f5431820cc3dfed5ccae76ae5d7153cb504fbe953b3942","tls_ja3":["6639916abfac56b9257ca216677085bc"],"http_akin":["b11cun030_00040018_f74a6e72","b11cun050_0004001e_5f886858"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3806,"b11cun030_00040018_f74a6e72":564,"b11cun050_0004001e_5f886858":562},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0"],"timeline":[{"date":"2026-09-15","count":14},{"date":"2026-09-16","count":7},{"date":"2026-09-17","count":7},{"date":"2026-09-18","count":13},{"date":"2026-09-19","count":7},{"date":"2026-09-20","count":14},{"date":"2026-09-22","count":8},{"date":"2026-09-23","count":8},{"date":"2026-09-24","count":16},{"date":"2026-09-28","count":7},{"date":"2026-09-29","count":11}],"recent_events":[{"timestamp":"2026-09-29T17:51:47","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f375f3029204170706c655765624b69742f3533352e313120284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31372e302e3936332e3536205361666172692f3533352e31310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","ja3":"6639916abfac56b9257ca216677085bc","session":"6320aa4b-b7f2-4195-be04-7b656223f6ee","seq":1,"duration_ms":100,"bytes_in":421,"bytes_out":80},{"timestamp":"2026-09-29T17:51:38","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0010\u0001\u0000�\u0000\u0000\u0001\u0000�\u0000\u0000\u0000\u0001\u0000\u0000q\u0000\u0000\u0000\u0000\u0007\u0000\u0000\u00003H\u0001\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000V\u0000\u0004\u0000^\u0000\u0000\u0000^\u0000\u0000\u0000^\u0000\b\u0000n\u0000\u000e\u0000\u0000\u0000\u0000\u0000�\u0000\t\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000!\u0000�\u0000\u0000\u0000N\u0000m\u0000a\u0000p\u0000N\u0000m\u0000a\u0000p\u0000 \u0000N\u0000S\u0000E\u00008\u00008\u0000.\u00002\u00001\u00003\u0000.\u00002\u00002\u00004\u0000.\u00002\u00002\u00004\u0000m\u0000s\u0000s\u0000q\u0000l\u0000.\u0000l\u0000u\u0000a\u0000NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0001�\u0000\u0000\u0001\u0000\u0001\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000.","payload_hex":"100100c500000100bd0000000100007100000000070000003348010000000000a08300000000000000000000560004005e0000005e0000005e0008006e000e00000000008a0009009c0000009c0000000000000000009c002100bd0000004e006d00610070004e006d006100700020004e0053004500380038002e003200310033002e003200320034002e003200320034006d007300730071006c002e006c00750061004e544c4d535350000100000001b20000010001002000000000000000200000002e","method":"","user_agent":"","ja3":"","session":"ca81ed45-358d-47aa-a9cb-b30dfc2ab1a5","seq":1,"duration_ms":100,"bytes_in":197,"bytes_out":15,"enriched":{"digest":"2fc20ff4a8c88da7","strings":["NTLMSSP","NmapNmap NSE88.213.224.224mssql.luaNTLMSSP"],"iocs":{"ips":["88.213.224.224"],"domains":["nse88.213.224.224mssql.luantlmssp"]}}},{"timestamp":"2026-09-29T17:51:20","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"15c27f2c-3593-4c53-b2f4-bcc1befaac83","seq":1,"duration_ms":100,"bytes_in":434,"bytes_out":80},{"timestamp":"2026-09-29T17:51:20","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000020000001a00060100200001020021000103002200040400260001ff00000000000001000000000000","method":"","user_agent":"","ja3":"","session":"948183ab-d35e-4073-b21c-0d50584d6df8","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":15},{"timestamp":"2026-09-29T17:51:19","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"bcd0e01b-0b81-45e0-8c5b-f6a98b62b01a","seq":1,"duration_ms":100,"bytes_in":433,"bytes_out":80},{"timestamp":"2026-09-29T17:51:18","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"70c734d2-f83f-4cc4-ac1d-8090462bc57c","seq":1,"duration_ms":100,"bytes_in":434,"bytes_out":80},{"timestamp":"2026-09-29T17:50:59","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e3336204564672f3132302e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","ja3":"6639916abfac56b9257ca216677085bc","session":"e705289c-99d4-4eba-ada1-f74ce8fc3408","seq":1,"duration_ms":100,"bytes_in":255,"bytes_out":80},{"timestamp":"2026-09-29T17:50:41","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000","payload_hex":"1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200480f0000","method":"","user_agent":"","ja3":"","session":"b807b07f-c7cd-46f6-a22e-516753ad63c1","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":15,"enriched":{"digest":"9852857ade38ccb3","strings":["MSSQLServer","UMSSQLServerH"]}},{"timestamp":"2026-09-29T17:50:22","port":1433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"3f096cf1-e1e9-40b5-9141-1ee2e84cdd89","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-09-29T17:50:04","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u00003.�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000332ee00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"e28acb03-3ef8-47cd-bb5f-8e1b1b23af21","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"c91e42b831f80102","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}}],"http_methods":[{"method":"GET","count":71}],"distinct_ports_total":15,"top_paths":[{"path":"/","count":15,"ports":15},{"path":"/config.json","count":14,"ports":14},{"path":"/robots.txt","count":14,"ports":14},{"path":"/sitemap.xml","count":14,"ports":14},{"path":"/favicon.ico","count":14,"ports":14}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"<HONEYPOT>:1433","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-30T11:33:19.648272+00:00"}