{"ip":"180.167.46.168","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,496 bytes sent","bytes_sent":1496,"session_seconds":1,"persistent":false}},"first_seen":"2026-04-02T15:26:00","last_seen":"2026-09-11T19:11:17","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Shanghai","city":"Shanghai","lat":31.2222,"lon":121.4581,"asn":4812,"org":"China Telecom (Group)"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":389,"proto":"tcp","label":"LDAP","count":3},{"port":9092,"proto":"tcp","label":"Kafka","count":1},{"port":2199,"proto":"tcp","label":"","count":1},{"port":9007,"proto":"tcp","label":"","count":1},{"port":5000,"proto":"tcp","label":"Web-alt","count":1},{"port":2184,"proto":"tcp","label":"","count":1},{"port":2072,"proto":"tcp","label":"","count":1},{"port":1443,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i130900_f57a46bbacb6_e7c285222651","t13i190900_9dc949149365_e7c285222651"],"tls_client_hello":"","tls_ja3":["9460af62ae0af667130bf0d36514f084","6639916abfac56b9257ca216677085bc"],"http_akin":["b11cun020_00040004_0a8d7f11","b10cun020_00040004_0a8d7f11","b11cun030_00040011_c91eaf54"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3155,"t13i130900_f57a46bbacb6_e7c285222651":3800,"t13i190900_9dc949149365_e7c285222651":393,"b11cun020_00040004_0a8d7f11":3956,"b10cun020_00040004_0a8d7f11":26,"b11cun030_00040011_c91eaf54":549},"akin_families":{"b11cun020_00040004_0a8d7f11":{"head":"b11cun020_00040004_0a8d7f11","shapes":3,"ips":3952},"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":548}},"user_agents":["Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"],"timeline":[{"date":"2026-08-11","count":1},{"date":"2026-08-28","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-11","count":1}],"recent_events":[{"timestamp":"2026-09-11T19:11:17","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:5000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a353030300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"480ed5a0-e4b5-4fb2-83f6-643974e7229f","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":79},{"timestamp":"2026-09-04T14:22:11","port":2072,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2072\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323037320d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"6639916abfac56b9257ca216677085bc","session":"1433c618-b81c-454e-a151-dc897b2b314f","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":79},{"timestamp":"2026-08-28T22:04:22","port":9007,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9007\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030370d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ecbb5b75-72ea-4a02-ad39-b9ff5f9fdb1f","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":79},{"timestamp":"2026-08-11T10:47:21","port":2199,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2199\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323139390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34392e302e323632332e313132205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","ja3":"9460af62ae0af667130bf0d36514f084","session":"6aea4628-f3d6-4dac-8d64-22e56c09451b","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":79},{"timestamp":"2026-06-22T08:17:33","port":389,"proto":"tcp","app_proto":"","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0003S\u0001\u0000\u0003O\u0003\u0003a�T�w�w��#�)�޼Ƿ��e�4\u0002\u0004��$�\u0004�!@\u0000\u0002�\u0000\u0000\u0000\u0001\u0000\u0002\u0000\u0003\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0007\u0000\b\u0000\t\u0000\n\u0000\u000b\u0000\f\u0000\r\u0000\u000e\u0000\u000f\u0000\u0010\u0000\u0011\u0000\u0012\u0000\u0013\u0000\u0014\u0000\u0015\u0000\u0016\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u001a\u0000\u001b\u0000\u001e\u0000\u001f\u0000 \u0000!\u0000\"\u0000#\u0000$\u0000%\u0000&\u0000'\u0000(\u0000)\u0000*\u0000+\u0000,\u0000-\u0000.\u0000/\u00000\u00001\u00002\u00003\u00004\u00005\u00006\u00007\u00008\u00009\u0000:\u0000;\u0000<\u0000=\u0000>\u0000?\u0000@\u0000A\u0000B\u0000C\u0000D\u0000E\u0000F\u0000g\u0000h\u0000i\u0000j\u0000k\u0000l\u0000m\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0000�\u0013\u0001\u0013\u0002\u0013\u0003\u0013\u0004\u0013\u0005�\u0001�\u0002�\u0003�\u0004�\u0005�\u0006�\u0007�\b�\t�\n�\u000b�\f�\r�\u000e�\u000f�\u0010�\u0011�\u0012�\u0013�\u0014�\u0015�\u0016�\u0017�\u0018�\u0019�\u001a�\u001b�\u001c�\u001d�\u001e�\u001f� �!�\"�#�$�%�&�'�(�)�*�+�,�-�.�/�0�1�2�3�4�5�6�7�8�9�:�;�<�=�>�?�@�A�B�C�D�E�F�G�H�I�J�K�L�M�N�O�P�Q�R�S�T�U�V�W�X�Y�Z�[�\\�]�^�_�`�a�b�c�d�e�f�g�h�i�j�k�l�m�n�o�p�q�r�s�t�u�v�w�x�y�z�{�|�}�~��������������������������������������������������������������������������������������������������������������\u0000�\u0001�\u0002̨̩̪̫̬̭̮�\u0001�\u0002�\u0003�\u0005\u0001\u0000\u0000v\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rtestsslsh.com\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000#\u0000\u0000\u0000\r\u00000\u0000.\b\u0004\b\u0005\b\u0006\b\u0007\b\b\b\t\b\n\b\u000b\u0006\u0001\u0006\u0002\u0006\u0003\u0005\u0001\u0005\u0002\u0005\u0003\u0004\u0001\u0004\u0002\u0004\u0003\u0003\u0001\u0003\u0002\u0003\u0003\u0002\u0001\u0002\u0002\u0002\u0003\u0000\n\u0000\u001c\u0000\u001a\u0000\u0017\u0000\u0019\u0000\u001c\u0000\u001b\u0000\u0018\u0000\u001a\u0000\u0016\u0000\u000e\u0000\r\u0000\u000b\u0000\f\u0000\t\u0000\n","payload_hex":"16030103530100034f030361dd54ed7788778b8e239a29a2debcc7b789df65d1340204ecdf24a2048b21400002b00000000100020003000400050006000700080009000a000b000c000d000e000f0010001100120013001400150016001700180019001a001b001e001f0020002100220023002400250026002700280029002a002b002c002d002e002f0030003100320033003400350036003700380039003a003b003c003d003e003f0040004100420043004400450046006700680069006a006b006c006d008400850086008700880089008a008b008c008d008e008f0090009100920093009400950096009700980099009a009b009c009d009e009f00a000a100a200a300a400a500a600a700a800a900aa00ab00ac00ad00ae00af00b000b100b200b300b400b500b600b700b800b900ba00bb00bc00bd00be00bf00c000c100c200c300c400c500c600c713011302130313041305c001c002c003c004c005c006c007c008c009c00ac00bc00cc00dc00ec00fc010c011c012c013c014c015c016c017c018c019c01ac01bc01cc01dc01ec01fc020c021c022c023c024c025c026c027c028c029c02ac02bc02cc02dc02ec02fc030c031c032c033c034c035c036c037c038c039c03ac03bc03cc03dc03ec03fc040c041c042c043c044c045c046c047c048c049c04ac04bc04cc04dc04ec04fc050c051c052c053c054c055c056c057c058c059c05ac05bc05cc05dc05ec05fc060c061c062c063c064c065c066c067c068c069c06ac06bc06cc06dc06ec06fc070c071c072c073c074c075c076c077c078c079c07ac07bc07cc07dc07ec07fc080c081c082c083c084c085c086c087c088c089c08ac08bc08cc08dc08ec08fc090c091c092c093c094c095c096c097c098c099c09ac09bc09cc09dc09ec09fc0a0c0a1c0a2c0a3c0a4c0a5c0a6c0a7c0a8c0a9c0aac0abc0acc0adc0aec0afc0b0c0b1c0b2c0b3c0b4c0b5c100c101c102cca8cca9ccaaccabccacccadccaed001d002d003d0050100007600000012001000000d7465737473736c73682e636f6d000b00040300010200230000000d0030002e080408050806080708080809080a080b060106020603050105020503040104020403030103020303020102020203000a001c001a00170019001c001b0018001a0016000e000d000b000c0009000a","method":"","user_agent":"","ja3":"","session":"07e47233-9885-4b8f-b9b1-655ef0c8131f","seq":3,"duration_ms":679,"bytes_in":901,"bytes_out":42,"enriched":{"digest":"581dec1e9f26b910","label":"TLS/SSL","strings":["testsslsh.com","!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFghijklm"],"iocs":{"domains":["testsslsh.com"]}}},{"timestamp":"2026-06-22T08:17:32","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"07e47233-9885-4b8f-b9b1-655ef0c8131f","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-06-22T08:17:32","port":389,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\u001d\u0002\u0001\u0001w\u0018�\u00161.3.6.1.4.1.1466.20037","payload_hex":"301d02010177188016312e332e362e312e342e312e313436362e3230303337","method":"","user_agent":"","ja3":"","session":"07e47233-9885-4b8f-b9b1-655ef0c8131f","seq":2,"duration_ms":391,"bytes_in":45,"bytes_out":28,"enriched":{"digest":"1fdcdbd9959a81b6","strings":["1.3.6.1.4.1.1466.20037"]}},{"timestamp":"2026-06-15T23:43:07","port":2184,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2184\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323138340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34392e302e323632332e313132205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","ja3":"9460af62ae0af667130bf0d36514f084","session":"792622f6-4a66-4a71-ba3a-d322d9806d29","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-04-05T19:25:06","port":9092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9092\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34392e302e323632332e313132205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","ja3":"","session":"773f9f27-db6f-409e-9e23-4a9a966a3b93","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-02T15:26:00","port":1443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:1443\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"156e0ce5-1f3f-45b0-857b-e4efdf46caa7","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1424d6b6e6730264","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:1443","Accept: */*"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":5,"ports":5},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2199","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-30T13:13:48.938661+00:00"}