{"ip":"43.173.75.80","total_events":16,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["16 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,108 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,108 bytes sent","bytes_sent":4108,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-28T21:05:12","last_seen":"2026-09-15T22:21:17","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.353,"lon":-121.9544,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1811h1_85036bcba153_d41ae481755e"],"tls_client_hello":"","tls_ja3":["b0020a04d796a92096d3928b119a51f6"],"http_akin":[]},"fingerprint_peers":{"t13i1811h1_85036bcba153_d41ae481755e":66},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-28","count":8},{"date":"2026-09-15","count":8}],"recent_events":[{"timestamp":"2026-09-15T22:21:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/?dns=bJABAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","summary":"","payload_hex":"474554202f3f646e733d624a41424141414241414141414141414132527661416876646d567963325668637749794d7749354e41497a4e674d784e4445494d6a41794e6a41344d7a45456447567a64416c3361476c305a574e6f6457344465486c364141414241414520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"1afc32e1-7d7a-4932-b352-73abd68ad30f","seq":1,"duration_ms":150,"bytes_in":256,"bytes_out":77},{"timestamp":"2026-09-15T22:21:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"71\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"�R\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003doh\boverseas\u000223\u000294\u000236\u0003141\b20260831\u0004test\twhitechun\u0003xyz\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/doh","summary":"","payload_hex":"504f5354202f646f6820485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a2037310d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a95520100000100000000000003646f68086f766572736561730232330239340233360331343108323032363038333104746573740977686974656368756e0378797a0000010001","method":"POST","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"1cdfb5e4-5188-4c9f-81a2-2171a0374321","seq":1,"duration_ms":151,"bytes_in":251,"bytes_out":77},{"timestamp":"2026-09-15T22:21:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/doh?dns=6DMBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","summary":"","payload_hex":"474554202f646f683f646e733d36444d424141414241414141414141414132527661416876646d567963325668637749794d7749354e41497a4e674d784e4445494d6a41794e6a41344d7a45456447567a64416c3361476c305a574e6f6457344465486c364141414241414520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"6dc4d6f5-2465-4312-9540-c5cc48e4cd6a","seq":1,"duration_ms":154,"bytes_in":259,"bytes_out":77},{"timestamp":"2026-09-15T22:21:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"71\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"�Q\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003doh\boverseas\u000223\u000294\u000236\u0003141\b20260831\u0004test\twhitechun\u0003xyz\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a2037310d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0af5510100000100000000000003646f68086f766572736561730232330239340233360331343108323032363038333104746573740977686974656368756e0378797a0000010001","method":"POST","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"c74953e9-8bf3-46f2-bb9f-548ad27b6064","seq":1,"duration_ms":148,"bytes_in":248,"bytes_out":77},{"timestamp":"2026-09-15T22:21:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"71\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"��\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003doh\boverseas\u000223\u000294\u000236\u0003141\b20260831\u0004test\twhitechun\u0003xyz\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/resolve","summary":"","payload_hex":"504f5354202f7265736f6c766520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a2037310d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0aecd90100000100000000000003646f68086f766572736561730232330239340233360331343108323032363038333104746573740977686974656368756e0378797a0000010001","method":"POST","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"0733e32c-492c-48d6-9acd-751754462a36","seq":1,"duration_ms":148,"bytes_in":255,"bytes_out":77},{"timestamp":"2026-09-15T22:21:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/resolve?dns=5gUBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","summary":"","payload_hex":"474554202f7265736f6c76653f646e733d356755424141414241414141414141414132527661416876646d567963325668637749794d7749354e41497a4e674d784e4445494d6a41794e6a41344d7a45456447567a64416c3361476c305a574e6f6457344465486c364141414241414520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"925d22e4-da58-4e12-a09d-7b113df1681a","seq":1,"duration_ms":151,"bytes_in":263,"bytes_out":77},{"timestamp":"2026-09-15T22:21:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/dns-query?dns=CYkBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","summary":"","payload_hex":"474554202f646e732d71756572793f646e733d43596b424141414241414141414141414132527661416876646d567963325668637749794d7749354e41497a4e674d784e4445494d6a41794e6a41344d7a45456447567a64416c3361476c305a574e6f6457344465486c364141414241414520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"ddf715c7-8b20-40d3-a717-597ccbe4f508","seq":1,"duration_ms":154,"bytes_in":265,"bytes_out":77},{"timestamp":"2026-09-15T22:21:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"71\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"1�\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003doh\boverseas\u000223\u000294\u000236\u0003141\b20260831\u0004test\twhitechun\u0003xyz\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/dns-query","summary":"","payload_hex":"504f5354202f646e732d717565727920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a2037310d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a31fe0100000100000000000003646f68086f766572736561730232330239340233360331343108323032363038333104746573740977686974656368756e0378797a0000010001","method":"POST","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"1d556e02-f1ea-406b-b756-b938bc47ce7c","seq":1,"duration_ms":146,"bytes_in":257,"bytes_out":77},{"timestamp":"2026-08-28T21:05:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/?dns=Yd8BAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNwMyMjcIMjAyNjA4MTkEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","summary":"","payload_hex":"474554202f3f646e733d596438424141414241414141414141414132527661416876646d567963325668637749794d7749354e41497a4e774d794d6a63494d6a41794e6a41344d546b456447567a64416c3361476c305a574e6f6457344465486c364141414241414520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"508a992e-c778-456a-82e5-62bbe07f8ea9","seq":1,"duration_ms":150,"bytes_in":256,"bytes_out":77},{"timestamp":"2026-08-28T21:05:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-message\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"71\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\"}","body":"��\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003doh\boverseas\u000223\u000294\u000237\u0003227\b20260819\u0004test\twhitechun\u0003xyz\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/doh","summary":"","payload_hex":"504f5354202f646f6820485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a2037310d0a486f73743a20<HONEYPOT>0d0a4163636570743a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a83da0100000100000000000003646f68086f766572736561730232330239340233370332323708323032363038313904746573740977686974656368756e0378797a0000010001","method":"POST","user_agent":"","ja3":"b0020a04d796a92096d3928b119a51f6","session":"95b88f2b-afe3-4b12-a752-63e0b976cc6b","seq":1,"duration_ms":188,"bytes_in":251,"bytes_out":77}],"http_methods":[{"method":"GET","count":8},{"method":"POST","count":8}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/resolve","count":2,"ports":1},{"path":"/doh","count":2,"ports":1},{"path":"/dns-query","count":2,"ports":1},{"path":"/dns-query?dns=VtABAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNwMyMjcIMjAyNjA4MTkEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/dns-query?dns=CYkBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/?dns=bJABAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/doh?dns=CDwBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNwMyMjcIMjAyNjA4MTkEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/resolve?dns=5gUBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/doh?dns=6DMBAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNgMxNDEIMjAyNjA4MzEEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/resolve?dns=NcABAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNwMyMjcIMjAyNjA4MTkEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1},{"path":"/?dns=Yd8BAAABAAAAAAAAA2RvaAhvdmVyc2VhcwIyMwI5NAIzNwMyMjcIMjAyNjA4MTkEdGVzdAl3aGl0ZWNodW4DeHl6AAABAAE","count":1,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":16}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host"],"representative":[{"name":"Accept","value":"application/dns-message","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"71","notable":false},{"name":"Content-Type","value":"application/dns-message","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T12:55:10.052642+00:00"}