{"ip":"47.245.117.221","total_events":529,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"690,951 bytes sent","bytes_sent":690951,"session_seconds":9,"persistent":false}},"first_seen":"2026-02-19T23:12:32","last_seen":"2026-09-30T08:59:09","events_24h":24,"events_7d":25,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":456},{"port":853,"proto":"tcp","label":"","count":24},{"port":80,"proto":"tcp","label":"HTTP","count":9},{"port":6379,"proto":"tcp","label":"Redis","count":9},{"port":5432,"proto":"tcp","label":"Postgres","count":8},{"port":445,"proto":"tcp","label":"SMB","count":6},{"port":1911,"proto":"tcp","label":"","count":4},{"port":20000,"proto":"tcp","label":"","count":4},{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":1521,"proto":"tcp","label":"Oracle","count":3},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":631,"proto":"tcp","label":"IPP","count":1},{"port":502,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i110800_cba83a0ed4ae_824bd91ab3e2","t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e003034478b3187c6de57f50deb74032f81c301894721fabe92e04e8685833201efb7c207200c4c8b08ea5222ccf9342ea586fda292d9af534d56a12bec2179876751fa8001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d00209a2f679cb47f2d80d292edc3878869ffb979440009369f215c485a9f","tls_ja3":["54ebc082cb189c4643f54f6b4cdc51b1","ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00050011_bf8a4cbb","b11cuq050_00050811_9b8c433a","b11cun040_00040015_ba182931"]},"fingerprint_peers":{"t12i110800_cba83a0ed4ae_824bd91ab3e2":7,"t13i140900_cbb2034c60b8_e7c285222651":658,"b11cuq060_00050816_84d4cebf":323,"b11cun040_00050011_bf8a4cbb":6,"b11cuq050_00050811_9b8c433a":7,"b11cun040_00040015_ba182931":6},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":3,"ips":323},"b11cun040_00050011_bf8a4cbb":{"head":"b11cuq050_00050811_9b8c433a","shapes":2,"ips":7},"b11cuq050_00050811_9b8c433a":{"head":"b11cuq050_00050811_9b8c433a","shapes":2,"ips":7}},"user_agents":["Mozilla/5.0 zgrab/0.x","Go-http-client/1.1"],"timeline":[{"date":"2026-07-03","count":1},{"date":"2026-07-04","count":3},{"date":"2026-07-05","count":2},{"date":"2026-07-10","count":1},{"date":"2026-07-15","count":24},{"date":"2026-07-16","count":24},{"date":"2026-07-19","count":24},{"date":"2026-07-20","count":25},{"date":"2026-07-23","count":1},{"date":"2026-07-30","count":2},{"date":"2026-07-31","count":24},{"date":"2026-08-01","count":1},{"date":"2026-08-06","count":3},{"date":"2026-08-07","count":2},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-13","count":1},{"date":"2026-08-14","count":3},{"date":"2026-08-15","count":2},{"date":"2026-08-21","count":1},{"date":"2026-08-26","count":24},{"date":"2026-08-28","count":1},{"date":"2026-09-02","count":25},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":1},{"date":"2026-09-09","count":24},{"date":"2026-09-16","count":24},{"date":"2026-09-25","count":1},{"date":"2026-09-30","count":24}],"recent_events":[{"timestamp":"2026-09-30T08:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?dns=5-EBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","summary":"","payload_hex":"474554202f3f646e733d352d4542414141424141414141414141415445456232527563774674436d52756332316c59584e31636d5544644739774141414241414520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":22,"duration_ms":7052,"bytes_in":4155,"bytes_out":1738},{"timestamp":"2026-09-30T08:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"41\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"xu\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00011\u0004odns\u0001m\ndnsmeasure\u0003top\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2034310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0a7875010000010000000000000131046f646e73016d0a646e736d65617375726503746f700000010001","method":"POST","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":23,"duration_ms":7383,"bytes_in":4350,"bytes_out":1817},{"timestamp":"2026-09-30T08:59:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-json\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?name=1.odns.m.dnsmeasure.top&type=A","summary":"","payload_hex":"474554202f3f6e616d653d312e6f646e732e6d2e646e736d6561737572652e746f7026747970653d4120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a206170706c69636174696f6e2f646e732d6a736f6e0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":24,"duration_ms":7713,"bytes_in":4510,"bytes_out":1896},{"timestamp":"2026-09-30T08:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-json\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/resolve?name=1.odns.m.dnsmeasure.top&type=A","summary":"","payload_hex":"474554202f7265736f6c76653f6e616d653d312e6f646e732e6d2e646e736d6561737572652e746f7026747970653d4120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a206170706c69636174696f6e2f646e732d6a736f6e0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":18,"duration_ms":5729,"bytes_in":3414,"bytes_out":1422},{"timestamp":"2026-09-30T08:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?dns=mSkBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","summary":"","payload_hex":"474554202f3f646e733d6d536b42414141424141414141414141415445456232527563774674436d52756332316c59584e31636d5544644739774141414241414520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":19,"duration_ms":6059,"bytes_in":3607,"bytes_out":1501},{"timestamp":"2026-09-30T08:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"41\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"�W\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00011\u0004odns\u0001m\ndnsmeasure\u0003top\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2034310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0af957010000010000000000000131046f646e73016d0a646e736d65617375726503746f700000010001","method":"POST","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":20,"duration_ms":6389,"bytes_in":3802,"bytes_out":1580},{"timestamp":"2026-09-30T08:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-json\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?name=1.odns.m.dnsmeasure.top&type=A","summary":"","payload_hex":"474554202f3f6e616d653d312e6f646e732e6d2e646e736d6561737572652e746f7026747970653d4120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a206170706c69636174696f6e2f646e732d6a736f6e0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":21,"duration_ms":6722,"bytes_in":3962,"bytes_out":1659},{"timestamp":"2026-09-30T08:59:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/dns-json\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/resolve?name=1.odns.m.dnsmeasure.top&type=A","summary":"","payload_hex":"474554202f7265736f6c76653f6e616d653d312e6f646e732e6d2e646e736d6561737572652e746f7026747970653d4120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a206170706c69636174696f6e2f646e732d6a736f6e0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":15,"duration_ms":4740,"bytes_in":2845,"bytes_out":1185},{"timestamp":"2026-09-30T08:59:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/resolve?dns=5DoBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","summary":"","payload_hex":"474554202f7265736f6c76653f646e733d35446f42414141424141414141414141415445456232527563774674436d52756332316c59584e31636d5544644739774141414241414520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":16,"duration_ms":5069,"bytes_in":3045,"bytes_out":1264},{"timestamp":"2026-09-30T08:59:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"keep-alive\",\"content-length\":\"41\",\"content-type\":\"application/dns-message\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"D$\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00011\u0004odns\u0001m\ndnsmeasure\u0003top\u0000\u0000\u0001\u0000\u0001","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/resolve","summary":"","payload_hex":"504f5354202f7265736f6c766520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2034310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f646e732d6d6573736167650d0a0d0a4424010000010000000000000131046f646e73016d0a646e736d65617375726503746f700000010001","method":"POST","user_agent":"Go-http-client/1.1","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3bc8e9dd-d4f0-4f9b-a28a-4203ac8ea9c9","seq":17,"duration_ms":5399,"bytes_in":3247,"bytes_out":1343}],"http_methods":[{"method":"GET","count":311},{"method":"POST","count":153}],"distinct_ports_total":13,"top_paths":[{"path":"/","count":45,"ports":2},{"path":"/query?name=1.odns.m.dnsmeasure.top&type=A","count":38,"ports":1},{"path":"/query","count":38,"ports":1},{"path":"/resolve","count":38,"ports":1},{"path":"/dns-query","count":38,"ports":1},{"path":"/?name=1.odns.m.dnsmeasure.top&type=A","count":38,"ports":1},{"path":"/dns-query?name=1.odns.m.dnsmeasure.top&type=A","count":38,"ports":1},{"path":"/resolve?name=1.odns.m.dnsmeasure.top&type=A","count":38,"ports":1},{"path":"/?dns=kikBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/dns-query?dns=HO0BAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/dns-query?dns=qNsBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/?dns=Xx0BAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/resolve?dns=hyYBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/?dns=jBIBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1},{"path":"/resolve?dns=RVQBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDdG9wAAABAAE","count":1,"ports":1}],"distinct_paths_total":161,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"41","notable":false},{"name":"Content-Type","value":"application/dns-message","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T10:48:58.725884+00:00"}