{"ip":"170.106.117.80","total_events":107,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"24+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 24 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,430 bytes sent","bytes_sent":10430,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-03T12:29:32","last_seen":"2026-09-27T19:13:59","events_24h":0,"events_7d":69,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.353,"lon":-121.9544,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[],"malware":[],"top_ports":[{"port":20128,"proto":"tcp","label":"","count":15},{"port":8317,"proto":"tcp","label":"","count":14},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":7},{"port":443,"proto":"tcp","label":"HTTPS","count":6},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":5},{"port":3001,"proto":"tcp","label":"","count":5},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":5},{"port":9000,"proto":"tcp","label":"Web-alt","count":5},{"port":3000,"proto":"tcp","label":"Web-alt","count":5},{"port":5000,"proto":"tcp","label":"Web-alt","count":5},{"port":7860,"proto":"tcp","label":"","count":3},{"port":8088,"proto":"tcp","label":"Hadoop","count":2},{"port":9001,"proto":"tcp","label":"Tor","count":2},{"port":8082,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e","t13i3111h2_e8f1e7e78f70_b26ce05bbdd6"],"tls_client_hello":"1603010200010001fc0303847744329d513e0cc6b39cad13abc72acafbf96afc21c4e1d49cd389b446f7482064109ed42f7a992de0663a0a98556f0ca13a4d8ffd97d750cf758aa054dd97a4003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e00190018010001010102010301040010000e000c02683208687474702f312e31001600000017000000310000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020046994b5fcff3cd82cc2fdd1ee65bf2ccd8234d6b02dc2405d31753e81f5c23e001500ca00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","78f0dc5ac5b19daf131a133cfdee9691"],"http_akin":["a11cun030_00000049_54d07b6d","a11cun041_00000049_6e8c246c","a11cun050_0000004f_faf67e57","a11cun051_0000004e_2619b3ac"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":807,"t13i3111h2_e8f1e7e78f70_b26ce05bbdd6":17,"a11cun030_00000049_54d07b6d":2608,"a11cun050_0000004f_faf67e57":1,"a11cun051_0000004e_2619b3ac":15,"a11cun041_00000049_6e8c246c":3},"akin_families":{"a11cun030_00000049_54d07b6d":{"head":"a11cun030_00000049_54d07b6d","shapes":2,"ips":2614}},"user_agents":["curl/7.88","curl/8.5.0","Python-urllib/3.12"],"timeline":[{"date":"2026-09-03","count":38},{"date":"2026-09-24","count":3},{"date":"2026-09-25","count":36},{"date":"2026-09-26","count":6},{"date":"2026-09-27","count":24}],"recent_events":[{"timestamp":"2026-09-27T19:13:59","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"e82a3f4f-769b-4e71-afa1-514092cfad02","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":79},{"timestamp":"2026-09-27T18:52:42","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"92891895-2d4e-4c30-8f6c-8ad4bde6c773","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":79},{"timestamp":"2026-09-27T18:52:41","port":20128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"0fa064ee-6c34-4272-b501-86dd68ae7e79","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":79},{"timestamp":"2026-09-27T18:52:41","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"a69019b7-edf1-46f5-b8ae-7547c25334fc","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":79},{"timestamp":"2026-09-27T18:51:03","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"9154bea8-9edf-4718-b859-421deee4246f","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":79},{"timestamp":"2026-09-27T18:50:59","port":20128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"c42178b7-9235-4611-b22a-aae412f9617b","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":79},{"timestamp":"2026-09-27T18:50:59","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"8a0e9435-5335-4d86-8d36-a0c75b2c8586","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":79},{"timestamp":"2026-09-27T15:36:32","port":20128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"b7207e3d-8bc7-454b-be42-82fbe6f86c5b","seq":1,"duration_ms":101,"bytes_in":90,"bytes_out":79},{"timestamp":"2026-09-27T15:36:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"57d961b5-b5a6-4dce-88fa-e00c4e68b0b2","seq":1,"duration_ms":122,"bytes_in":84,"bytes_out":79},{"timestamp":"2026-09-27T15:36:32","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"cdfa8697-2e72-4a69-b98e-3cad310b23e6","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":79}],"http_methods":[{"method":"GET","count":107}],"distinct_ports_total":24,"top_paths":[{"path":"/v1/models","count":107,"ports":24}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":8}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"curl/8.5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-29T14:11:10.561911+00:00"}