{"ip":"219.140.109.106","total_events":44,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,374 bytes sent","bytes_sent":8374,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-24T20:28:09","last_seen":"2026-09-18T19:16:17","events_24h":0,"events_7d":2,"geo":{"country_code":"CN","country_name":"China","region":"Hubei","city":"Wuhan","lat":30.5851,"lon":114.2662,"asn":137266,"org":"CHINATELECOM Hubei province Wuhan 5G network"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":8},{"port":3000,"proto":"tcp","label":"Web-alt","count":7},{"port":4000,"proto":"tcp","label":"","count":6},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":6},{"port":5000,"proto":"tcp","label":"Web-alt","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":9000,"proto":"tcp","label":"Web-alt","count":2},{"port":6000,"proto":"tcp","label":"X11","count":2},{"port":9080,"proto":"tcp","label":"","count":1},{"port":8010,"proto":"tcp","label":"","count":1},{"port":8001,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1811h1_85036bcba153_d41ae481755e"],"tls_client_hello":"","tls_ja3":["b0020a04d796a92096d3928b119a51f6"]},"fingerprint_peers":{"t13i1811h1_85036bcba153_d41ae481755e":58},"user_agents":["Python/3.13 aiohttp/3.13.3"],"timeline":[{"date":"2026-08-24","count":4},{"date":"2026-08-26","count":14},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":5},{"date":"2026-08-31","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-05","count":3},{"date":"2026-09-09","count":1},{"date":"2026-09-12","count":2},{"date":"2026-09-13","count":2},{"date":"2026-09-14","count":4},{"date":"2026-09-18","count":2}],"recent_events":[{"timestamp":"2026-09-18T19:16:17","port":9080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9080\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393038300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"b1136c25-12ac-47ed-bf60-2bad11ecd5ac","seq":1,"duration_ms":101,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-18T19:15:47","port":8001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8001\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383030310d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"dc9c5572-76e0-4774-9a46-8eb6409c230e","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-14T16:27:31","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"30f1372f-522b-4b48-806c-bc341e9f25d1","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-14T16:25:30","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"11bd27b4-fb24-4488-a4b8-8d32ad4b77f4","seq":1,"duration_ms":101,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-14T16:24:15","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"47c4c765-1ad6-4d7d-a5da-d737562a8044","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-14T16:22:53","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"381f53ec-eb65-47fb-a49b-5ee9a0202409","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-13T16:35:15","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"ce40f314-0620-4a4e-be5d-3f647eb2d4e3","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-13T16:32:39","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"356f27b9-22c3-4c51-ad73-4d61f7ad21fe","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":80},{"timestamp":"2026-09-12T16:56:05","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"b47ae7df-658f-4383-a851-bdc29108f946","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":80},{"timestamp":"2026-09-12T16:51:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br\",\"authorization\":\"Bearer sk-test\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Python/3.13 aiohttp/3.13.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a417574686f72697a6174696f6e3a2042656172657220736b2d746573740d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a557365722d4167656e743a20507974686f6e2f332e31332061696f687474702f332e31332e330d0a0d0a","method":"GET","user_agent":"Python/3.13 aiohttp/3.13.3","ja3":"","session":"ed492fb8-cd04-43df-a421-93acec90a92f","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":80}],"http_methods":[{"method":"GET","count":44}],"distinct_ports_total":12,"top_paths":[{"path":"/v1/models","count":44,"ports":12}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Authorization","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Authorization","value":"Bearer sk-test","notable":true},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9080","notable":false},{"name":"User-Agent","value":"Python/3.13 aiohttp/3.13.3","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T00:28:02.631338+00:00"}