{"ip":"39.100.83.5","total_events":276,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"27+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 27 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"34,920 bytes sent","bytes_sent":34920,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T15:02:09","last_seen":"2026-09-16T15:03:29","events_24h":0,"events_7d":276,"geo":{"country_code":"CN","country_name":"China","region":"Beijing","city":"Beijing","lat":39.911,"lon":116.395,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":9501,"proto":"tcp","label":"","count":12},{"port":9991,"proto":"tcp","label":"","count":11},{"port":8728,"proto":"tcp","label":"","count":11},{"port":10003,"proto":"tcp","label":"","count":11},{"port":16002,"proto":"tcp","label":"","count":11},{"port":6020,"proto":"tcp","label":"","count":11},{"port":18980,"proto":"tcp","label":"","count":11},{"port":8511,"proto":"tcp","label":"","count":10},{"port":65222,"proto":"tcp","label":"","count":10},{"port":7998,"proto":"tcp","label":"","count":10},{"port":49683,"proto":"tcp","label":"","count":10},{"port":30028,"proto":"tcp","label":"","count":10},{"port":8102,"proto":"tcp","label":"","count":10},{"port":9997,"proto":"tcp","label":"","count":10},{"port":15101,"proto":"tcp","label":"","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":31},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-16","count":276}],"recent_events":[{"timestamp":"2026-09-16T15:03:29","port":30553,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ad567150-68fb-47bd-b99f-e9a36339adb9","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":8511,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"80eb1902-1142-4e2a-8ee4-0cc746bd41ae","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":9997,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"26c82798-415a-46ff-859d-def58999c32e","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":11512,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"fa0162a7-ea18-4e4b-b070-2ff63a553b76","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":16002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"e97a0df6-29ac-4298-9342-43f44c89a658","seq":1,"duration_ms":411,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":49189,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"97942ba4-2107-49ad-bda3-8d70189660d3","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"cc230758-4006-4daf-8d0c-8ee704cf1d79","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":15101,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"40f66869-a0fc-40a4-ab31-13d59c0eccf3","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:29","port":9501,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"7359dc7f-8df1-4505-9189-d9170a913ffe","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":76},{"timestamp":"2026-09-16T15:03:28","port":8728,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f1963543-931e-4cb7-85d1-e55875e7539e","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":76}],"http_methods":[{"method":"GET","count":193},{"method":"POST","count":26}],"distinct_ports_total":27,"top_paths":[{"path":"/","count":108,"ports":27},{"path":"/NmapUpperCheck1789570959","count":28,"ports":27},{"path":"/nmaplowercheck1789570959","count":27,"ports":27},{"path":"/Nmap/folder/check1789570959","count":27,"ports":27},{"path":"/sdk","count":26,"ports":26},{"path":"/evox/about","count":2,"ports":2},{"path":"/HNAP1","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T18:23:59.852757+00:00"}