{"ip":"180.76.97.126","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,596 bytes sent","bytes_sent":2596,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-21T13:01:29","last_seen":"2026-09-21T13:02:17","events_24h":0,"events_7d":48,"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":38365,"org":"Beijing Baidu Netcom Science and Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as38365","label":"Baidu Netcom Science and Technology Co., Ltd.","category":"cdn","url":"https://www.peeringdb.com/asn/38365"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":6},{"port":9119,"proto":"tcp","label":"","count":6},{"port":9121,"proto":"tcp","label":"","count":6},{"port":9122,"proto":"tcp","label":"","count":6},{"port":443,"proto":"tcp","label":"HTTPS","count":6},{"port":9118,"proto":"tcp","label":"","count":6},{"port":9120,"proto":"tcp","label":"","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3012h2_1d37bd780c83_8537cf56674e"],"tls_client_hello":"","tls_ja3":["7587a1ac9a4f17b4e4e5fe226716f4df"],"http_akin":[]},"fingerprint_peers":{"t13i3012h2_1d37bd780c83_8537cf56674e":20},"akin_families":{},"user_agents":["curl/8.14.1"],"timeline":[{"date":"2026-09-21","count":48}],"recent_events":[{"timestamp":"2026-09-21T13:02:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"4f10a025-84af-479a-992a-7800bfc5cffd","seq":1,"duration_ms":101,"bytes_in":76,"bytes_out":78},{"timestamp":"2026-09-21T13:02:16","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9b5b7bed-a2f8-4e47-aeb1-1ae0eb7aa45e","seq":1,"duration_ms":0,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-21T13:02:16","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"5191e62b-457a-42d2-90b0-d3bd97ec928d","seq":1,"duration_ms":100,"bytes_in":80,"bytes_out":78},{"timestamp":"2026-09-21T13:02:15","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"4410d8bb-75f0-4bef-96bf-43bf3938e4c4","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-21T13:02:14","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"15173e42-82c3-4a11-b9ce-41ddceb3af53","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-21T13:02:12","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"baa066e2-6dea-4d04-b581-e0e5e4bc9ca1","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-21T13:02:12","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"26daea16-349d-4811-969b-c564d9af41e3","seq":1,"duration_ms":0,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-21T13:02:11","port":3000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"20cfc2e8-8af7-4d1e-af71-a1c3d0963329","seq":1,"duration_ms":0,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-21T13:02:11","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"","session":"9b85fc89-cea0-4f4c-aa50-0f2388961ab3","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-21T13:02:10","port":9122,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9122\",\"user-agent\":\"curl/8.14.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393132320d0a557365722d4167656e743a206375726c2f382e31342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.14.1","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"ffa158f3-eccc-4965-9366-8143c3b0313e","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78}],"http_methods":[{"method":"GET","count":32}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":32,"ports":8}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":16}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"curl/8.14.1","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[],"data_as_of":"2026-09-24T20:08:03.193369+00:00"}