{"ip":"194.187.176.95","total_events":25,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"alphastrike","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (alphastrike).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,912 bytes sent","bytes_sent":8912,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-26T15:49:26","last_seen":"2026-09-30T13:36:49","events_24h":1,"events_7d":2,"geo":{"country_code":"DE","country_name":"Germany","region":"State of Berlin","city":"Berlin","lat":52.5196,"lon":13.4069,"asn":208843,"org":"Alpha Strike Labs GmbH"},"source_domain":null,"known_scanners":["alphastrike","Alpha Strike Labs"],"scanner_tag":{"key":"alphastrike","label":"Alpha Strike Labs","category":"research","url":"https://alphastrike.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":58080,"proto":"tcp","label":"","count":1},{"port":8085,"proto":"tcp","label":"","count":1},{"port":60001,"proto":"tcp","label":"","count":1},{"port":8442,"proto":"tcp","label":"","count":1},{"port":19100,"proto":"tcp","label":"","count":1},{"port":4455,"proto":"tcp","label":"","count":1},{"port":35000,"proto":"tcp","label":"","count":1},{"port":886,"proto":"tcp","label":"","count":1},{"port":777,"proto":"tcp","label":"","count":1},{"port":22323,"proto":"tcp","label":"","count":1},{"port":6505,"proto":"tcp","label":"","count":1},{"port":389,"proto":"tcp","label":"LDAP","count":1},{"port":33389,"proto":"tcp","label":"","count":1},{"port":180,"proto":"tcp","label":"","count":1},{"port":4010,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i520500_7554301188de_e51b7354d87f"],"tls_client_hello":"","tls_ja3":["04b3f524166caafd433b6864250945be"],"http_akin":["b11cun080_0034001f_ee1daacd","b11cuq040_00050801_bf8a4cbb"]},"fingerprint_peers":{"t12i520500_7554301188de_e51b7354d87f":10,"084386fa7ae5039bcf6f07298a05a227":425,"b11cun080_0034001f_ee1daacd":762,"b11cuq040_00050801_bf8a4cbb":8},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0"],"timeline":[{"date":"2026-07-08","count":2},{"date":"2026-07-28","count":1},{"date":"2026-08-02","count":1},{"date":"2026-08-03","count":1},{"date":"2026-08-08","count":2},{"date":"2026-08-18","count":1},{"date":"2026-08-21","count":1},{"date":"2026-08-22","count":1},{"date":"2026-08-25","count":1},{"date":"2026-08-30","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-11","count":1},{"date":"2026-09-14","count":1},{"date":"2026-09-15","count":1},{"date":"2026-09-16","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-30","count":1}],"recent_events":[{"timestamp":"2026-09-30T13:36:49","port":886,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:886\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3838360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"0741aabc-9b66-4aaa-be57-3adaa3e62920","seq":1,"duration_ms":100,"bytes_in":288,"bytes_out":79},{"timestamp":"2026-09-27T01:32:15","port":35000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:35000\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"21d352bb-2d82-46b7-86bf-51ac42a046ac","seq":1,"duration_ms":100,"bytes_in":290,"bytes_out":79},{"timestamp":"2026-09-21T16:44:19","port":180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:180\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3138300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"61a9189c-25db-41d3-98ca-5e01b2b3b929","seq":1,"duration_ms":100,"bytes_in":277,"bytes_out":79},{"timestamp":"2026-09-20T20:53:41","port":3143,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3143\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"b3cd9015-f3f4-403d-bbea-82d504655e4a","seq":1,"duration_ms":100,"bytes_in":277,"bytes_out":79},{"timestamp":"2026-09-16T08:53:03","port":62222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0005L\u0013\u0014�6ؒ0:�\u0017�\u001d��)qg�\u0000\u0000\u0001\u0019curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0002[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0015�|�Z���M�Q���!���","payload_hex":"5353482d322e302d476f0d0a0000054c1314f136d892303a9717f41df0c7297167b400000119637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000025b7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531392c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531390000009b6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132380000009b6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f757231323800000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000008415a27c985affbadb4da25193e19a21b29f9a","method":"","user_agent":"","ja3":"","session":"385f38f7-1a1d-483d-b62c-57fe11bf3bda","seq":1,"duration_ms":218,"bytes_in":1372,"bytes_out":14,"enriched":{"digest":"5a19e8a008379af1","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,ae…","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-15T08:00:09","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"https://<HONEYPOT>:5555","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"1411\",\"content-type\":\"image/jpeg\",\"host\":\"https://<HONEYPOT>:5555\"}","body":"GIF89a�\u00003\u0000�\u0000\u0000674yhT����[���������\u0000\u0000\u0000,\u0000\u0000\u0000\u0000�\u00003\u0000\u0000\u0003�\b\u001a�4\n\u0004Ake1O\u0011��`(�di�h��l��K�\f\f%oV�������pȊ�,��\u0005�1f$\u0004�tJ�N\u0005�\ra�%ԸI\u001b�\u0019�����\u0007+\u0011t\t�x�\rn���\u0002�\u00125�)j�,\u0004\nn\\r�zzoMw\u0019%q\u0016q/\u0005�\u0006��\"H\u0016}�\u0002�|�\u0006\u0016#\u0002\u0005kHp#\u0015}\u001f��!����|{<�#���+� ���\u0014��!\u0015���\"��ř ��Ơp��[\u0003\u001c\u0016�e!���*����ѧ�n�ւ����Ѯ�����s47v�<Ț\u0007BN8L�\n�\u0012\u0017�R\u0005\u0012\f�5����,r\u0013�@\"���a�O�@~��P\u00136��jy�w�\u001b(i\u001bU\t\u001bg�\u001a�R�PqB�1ڴV\u0015�q�\u0019�'I>�<Nے�R�\u0001�\u0002D��k�2r\n%r\u001c�\u0011�<_3aru��(B�}r� h�\u001c:s?ᄂU�䥻��L`0u\f��Ԍ�2;�d�qFE~<g�0 �)�=s��\u001e�?�։`��i6�\u001b��#\u0003Q��ć\u0019���\u0013-eձ\"J޺��Wz\u000b��=��.J�*�%a\t\u0010\u001c$S}��3�\u0015rXů���\\\u0013��\u0013�hW?���Xò:�T���������D��t�D�\u0006%|T�W�&\u0018�*�����͈\u0000W\u000bT� 1\u001a\u000f\u0001\u0014��ai�\u0014\u000f;�\\7\u0016VϽ\u0014�a\u0012\u000e�\u0014v��D�<�\u0004v�x��&�p\u000f\u0010��a�-�\\EΉ(\u001b4\u001c���d���\u001c\n���bL��\u0005Q��\u0004��p\u0001l�b\r�u��v=UT]'��#\u0013d;ng͎( QZP�E��+�x&\u0007\u0017\u0004��F_,\u001d��$�`�\u001dx\u001f%��u^f\u0018�s�\u0001��'�X�\t��\u0005\t?��y$T\u000f��f\u0007�D*��#\":�6\r\f�(���D駠�qR6p�%U��F��@���j\u0010��I����ʩ�����\n�N�W\u001d�n��\u0018�\u0016k�>q �H\u00166]$���i�p���&�E\r\u001c�\n,��v*-�ྚ�!�\fGn����(�%�TҘ�է\t1�%3JH��4�\ntV��\u000fm\u0010'A\u001bLy�._��g�\u001a�0������0W�6L¿\u0012[�o�\u0016���\nY�0���h��\u0002\t+pq�\u0015��q�\u001ag<�W��l\u0014���'3�:�,/���%���~\u0010�\u0012đ[2TF\u0014���\u000f�\u001bq�@��0����5�SC�_שpݰ�bWm��M�<2�䦊�_O�\u001cu�eW�/�C;����j�r�6�,�b~�-�\bi���?k�\u000b��|����c��'5�\u0018�m6�rS\u001e��\u001d�\u001c��$,�D\u000e,��m���\u001cz˞�\u001e5�y˝9����{؆S\rȿ�sn�\u00129�'r\u0007:��v�^�D�M��\r��z����\u001a��\u0012�`\u0007��Ϣ㝹\u0001��n|\r\u0018�`-��N\u001ew��|�\u0006�\u0017�`nh\u0003/�hT*K�>�j�\u001f\u001a�W�И+\t�\u0003�!n�:\u0000:0\r\u0004�\u001f\u000e��\u0017#H�\u0011g ����?�y)R\u0002|`\u001ap7����}!�B\nE��عnk�\u0013�\fY����Pl�;J�X(\n\u0012&\u0006xa�Y�~���ᬈe�\u0017\u000f\u0003\u00183\r�·\u0014��\r�3��٭Up;\\�\b�'��\u0005os�Ӝ\u0014a':�i\u0011��s�\u0017��;�\r��P\u001c�\u0015���4�\u0010���!\u0019�7C\u000e�N���c�V(�B��h�L�\"\u0017��F:򑐌�$u�\u0000\u0000;","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/vpnsvc/connect.cgi","summary":"","payload_hex":"504f5354202f76706e7376632f636f6e6e6563742e63676920485454502f312e310d0a486f73743a2068747470733a2f2f<HONEYPOT>3a353535350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20696d6167652f6a7065670d0a436f6e74656e742d4c656e6774683a20313431310d0a0d0a474946383961c8003300f20000363734796854808080af7f5bb3a89dd5d5d4ffffff0000002c00000000c80033000003fe081adc340a04416b65314f1180f960288e64699e68aaae6ceb9a4be30c0c256f56a7e9d2ebffc0a070c88adc2c9cc605c731662404a2744aad4e05b10d61cb25d4b8491be619b19acfe8f4072b1174098578fc0d6e909fea02811235ef296a812c040a6e5c72887a7a6f4d7719257116712f05920695802248167d98029a7c820616237f02056b487023157d1f98a8217f8789b58b7c7b3c8e239e9bae2bad20a6ac9b14b1c32115b1819e229eaec5992096afc6a070b6b65b031c168e6521bd9bcb2a9ecbc1e1d1a7a96ee9d682cdc9cad5d1aebdcb7facb4d973343776df3cc89a07424e384cab0afa1217ea5205120cdb35d3f3ced92c7213b74022e8feb061c74fec407e94f650133683a86a79f977e31b28691b55091b678a1aa952c55071428231dab456159d71bc19f227493eef3c4edb92ed52bf01fe024495b16ba032720a25721ce511993c5f3361727593922842a37d729a20688a1c3a733fe1848255eae4a5bb89de4c6030750c9e97d48cc6323bb464d67146457e3c67b83020b829823d73e7931eaa3f91d689609ac86936a81ba4fe230351edc7c48719b7a3cc132d65d5b1224adebaf6a1577a0bb3963d95af2e4abc2ab9256109101c24537dbca233e0157258c5afad8a845c13f1ed13e668573f85b5f758c3b23aa754b9878698bda38dd7ce44d4f174da448506257c54ec57e82618fe2abafeb9fee6cd8800570b54fe20311a0f011494d0616995140f3bae5c371656cfbd14a161120ea6147688bd44a13cf604769078e4812680700f10a7c461952dc65c45ce89281b341cc5e8d164aface21c0ae2ece7624ce4b40551809304e78f70016ca1620dfe75f8c1763d55545d27d1e02313643b6e67cd8e2820515a50f24589df2bb578260717048ae6465f2c1d84dc24bc60d61d781f25a4e57f755e66189773f001a784278858a109dec505093f88a07924540f80c66607a2442ae9a423223ac7360d0cd02881a0b544e9a7a0a271523670e825559a9c46e58f40a1b6ea6a10a39e499e92a7a6caa9a7afe6aaeb0aa54e99571db56e8aea18bb166bac3e7120fe4816365d24c1a9b069ea70ecb4c626d9450d1c8c0a2c81d0762a2db5e0be9aa421b90c476e9fb5daea28b1258854d2988dd5a70931f625334a489f8034a60a7456a1af0f6d1027411b4c79a12e5f9daa67ef1ad330bcf0bdeedeeb3057f3364cc2bf125bbc6f97169bb1b10a59c8309cc8db689aea02092b7071c715b39271be1a673cf157f8c26c14c4eeb22733bc3ac32c2fc4ec8c25f1bbfd7e10b212c4915b32544614b7f2cc0fcf1b71c44083f230c6fa929235c35343875fd7a970ddb0ce62576df6984d8b3c32d2e4a68ab05f4fcb1c75cc6557bd2fd9433becf5c4f96aed72cb36bf2cb8627e9f2df8086987b1f63f6baa0b9ac27cb7fbf7e063fec72735dd18d36d36d472531ef9d41ddb1cf8e8242cb0440e2c99de6d9a90ef1c7acb9ebb1e35e979cb9d39e9f08ead7bd886530dc8bfa0736e8012399c2772073ab4ed76eb5ec344f84df1ee0dd8cd7af7fdd0ef1ae3fd12f56007bdb3cfa2e39db901a69f6e7c0d18e8602db4ec4e1e77b8817c9c06f117d8606e68032fa068542a4bfe3efc6a901f1aca57bfd0982b09f90380216ed53a003a300d04b41f0e8ee0172348f0116720dcf7def53ff9792952027c601a7037bbb5c0ee7d2194420a45e8b1d8b96e6be0139a0c5996b59cd9506cbe3b4ae758280a1226067861eb59e47ef8b9dde1ac8865ab170f0318330dc6ce8714ab980dd933c5c0d9ad55703b5ce208a127bbbc056f73b6d39c1461273ac06911849773a21783b83baa0df18b501ce215cfd8c33496108683ab2119bd37430ece4e87e3a363b85628c84282b068864ca42217c9c8463af291908ca424759500003b","method":"POST","user_agent":"","ja3":"04b3f524166caafd433b6864250945be","session":"1e4228f4-d3be-45b0-9dbc-1e22894d78ba","seq":1,"duration_ms":121,"bytes_in":1554,"bytes_out":79},{"timestamp":"2026-09-14T05:17:31","port":4010,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4010\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343031300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"55e04eab-8944-4889-a459-3f3350bad089","seq":1,"duration_ms":100,"bytes_in":288,"bytes_out":79},{"timestamp":"2026-09-11T23:17:42","port":30080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:30080\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"06d8d43b-a5af-4f2b-9c0e-32d602d30030","seq":1,"duration_ms":100,"bytes_in":289,"bytes_out":79},{"timestamp":"2026-09-04T23:04:40","port":6505,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6505\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363530350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"405b979c-57dd-4b46-8ba1-8a81251dc2b7","seq":1,"duration_ms":100,"bytes_in":288,"bytes_out":79},{"timestamp":"2026-08-30T18:37:23","port":18542,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en;q=0.7,en-US;q=0.3\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:18542\",\"pragma\":\"no-cache\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383534320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a36352e3029204765636b6f2f32303130303130312046697265666f782f36352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e3b713d302e372c656e2d55533b713d302e330d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a507261676d613a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","ja3":"","session":"8da87a95-5319-4884-bb5a-6f2b239ff90d","seq":1,"duration_ms":100,"bytes_in":278,"bytes_out":79}],"http_methods":[{"method":"GET","count":21},{"method":"POST","count":1}],"distinct_ports_total":25,"top_paths":[{"path":"/favicon.ico","count":12,"ports":12},{"path":"/","count":9,"ports":9},{"path":"/vpnsvc/connect.cgi","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"zhaoxisheng.com","count":1},{"value":"https://<HONEYPOT>:5555","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","Pragma","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en;q=0.7,en-US;q=0.3","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:886","notable":false},{"name":"Pragma","value":"no-cache","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-30T16:52:53.522507+00:00"}