{"ip":"47.84.57.71","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,961 bytes sent","bytes_sent":1961,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T07:28:04","last_seen":"2026-09-30T07:28:21","events_24h":3,"events_7d":3,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":9380,"proto":"tcp","label":"","count":2},{"port":1935,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2412h1_df98b6d6dfe4_1b3407e2c936","t13i2412h2_df98b6d6dfe4_1b3407e2c936"],"tls_client_hello":"1603010200010001fc0303b6f0749ca5069716ff86a2055fb38546be42913ad7cba9a8030968ef683bbd1020f3e11f9bea5fcd0ddcc508bc62a5b742cac09430a4f45cb1e996793cc98de4e30030130213031301c02cc030cca9cca8c02bc02fc024c028c023c027c00ac014c009c013009d009c003d003c0035002f00ff01000183000b000403000102000a000c000a001d0017001e00190018337400000010000b000908687474702f312e31001600000017000000310000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003300260024001d00208978706c4defb0f08a8a0470ee52e0eedbbf5d56acb0d443a2ac81ca3f649470001500d70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["410d9b65ff73443a9a062d12534d1ea7"],"http_akin":["b11cun040_00040016_4110f156","b11cun050_0004001e_377ad04d"]},"fingerprint_peers":{"t13i2412h1_df98b6d6dfe4_1b3407e2c936":112,"t13i2412h2_df98b6d6dfe4_1b3407e2c936":112,"b11cun040_00040016_4110f156":261,"b11cun050_0004001e_377ad04d":112},"akin_families":{"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":8,"ips":261},"b11cun050_0004001e_377ad04d":{"head":"b11cun040_00040016_4110f156","shapes":8,"ips":261}},"user_agents":["Openwave/ UCWEB7.0.2.37/28/999"],"timeline":[{"date":"2026-09-30","count":3}],"recent_events":[{"timestamp":"2026-09-30T07:28:21","port":9380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:9380\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393338300d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"dbb0d4f5-0aa1-4ee2-87d0-2b15f49884a5","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":76},{"timestamp":"2026-09-30T07:28:20","port":9380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:9380\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393338300d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c6170706c69636174696f6e2f7868746d6c2b786d6c2c206170706c69636174696f6e2f786d6c3b713d302e392c202a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"42f050f1-99b7-4217-8449-7365738be118","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":76},{"timestamp":"2026-09-30T07:28:04","port":1935,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u00010�\u0000\u0000\u0000\u0000\u00001����횏���W�\u0012�埌���\\@е\u0006l����,��ð�]?m\r���\u0003~��\n3t����E�/\u0010�*���̥��\u0002��\u0010����?|pI��<?���S/�\tY��BV��哳��}�vK���-��i�7ie�������3�\u0010\u000e����F?E��(�EUQ��2\u001b(����;�\u0013������o�L���r|�\"�\u000fs�Φ��=g�΢g�]K�)=y���M�V�_\u000f�!\u001eU�����9��\u0007����J�\u0018�/�x��[J��Z��x��e�)G)\u0018�0��\u0019�*ϱ��a)�^�>\u001c?��\u001a\u0010��u��������|\u0014A���X�S�ֲ\u0006\u0014�E��_�:\u001c2�\u0002��\u0000���\b�ꯘ�\u0007z0�P��d��\u0010:3�tO�OQ��Qz���I�1��8\\����O\u0011�#!�V�3�����wGU\fB�U'\t7�B��\u0003?�RP6ur��`)pN�f)\"�.�W�\u0017`�\u0000�Nۥ�����mP�9�����\u0010(���ݮ�a�^\u001c�\u0001j���,���\f%�Eֆ��\u0012������j��/\u0000\u001b�\u0001���|�FR�RwV�M܅\"��\u001e�@�N�cM�ch�d�d\fi%R�դ3+;�\b���D�����0�B\nJ�ٮ�=�\u0000c\f�8��d�ol�\u0012c��\nuV��<A����5����*�>b�-Ƙ�2D��4���؞O\u0014���ʉ�LP��z�\r�h;�\u0000��D�kx\t\n\"��r��q�S�`�J n��|�C�DC�\u0019�\u0016�\u0000\u001f�\"\u00008���\u0006�\u0013\u0000��K\u0006!\u000f❰%T�i�\u000e����\u0018!\u0013\u0018Y�\u000e\u001a��-�z���\u0002\bc������׻��N��o�\u0002ɍ\u0010�:�\u0010�\u001e�����\u0002����P|^\f^/Z1\u0018�\u0016\u001a��*u�Ά��w��j���5\u001a������\u0010�&(�<CG�m��<C�)�,�$�D �^�y��\n���\u0010��L\u0000�,m����oҬ���Z��M+�� \u0019�\n��\u001ajrfjd��\u0014}�\u0006�T��܃��t/�\t��\"��ώ\u0017:\u0000~�d\u0011|x��{R2\u0003.���*\u0014�3\n�Uћ$_�^_0\u0003�A<�}�K��N��3��G~\u0000R\u001bU#�y�i���ۦ�Z��؞���D�/wy����\u0010\u0012Q4�ʷ2���}@��#Q��GWM��|\u0002ux�lt��\u0005H��z2VE��숹=8z���\u0010�D\u0013\u0001��n1����5�g����iS��\f\u001e)���O�E��FP���@�y��\u0000R��\u0010z#cZ\u0014px>�\u001b�F�<ٕ�*07�p�%[�%�4޽�\u0001!\t\u0016��T��K�l��\u0001\t�1@}�\u0019���Ǫ��g�����\u00195\u0011��\\o>�\u0017@��q-f\u0013F\b\u000f\u000eй\u000bv!�\u001d�j�ß�drI԰,��\u0019�bG9u�B��\u0012>��_]�\bǀ�fm0ض\u0004���y���C�P�>�lP\u0013\u0013�rp}z7�F�kvv!z�\u0003iy�+TB'�\u0013ez�����\u0003\u000by;\t��t5O��O�\u0018ȘD\u001c�k���;m��\u0000\u0014�\u0003\u001fA>(\u0000\u0017�6g1����~aB�<�\\)~��\u0005`�\u0019'�8h�`i���W-�\r���X�%�r���\u0019T�y�\u000e��F\t]�rM�\u0011�ϕ��\u0018<\u001e�a�N�o?��4u�C\u00152�\u001e�0��ҡ��71hOm�+�8z����k�#\u001908K�W��緼�8^�i�\u000f�L:���X,m\u0006�[)��a�E��/���)�J�/\u0011�\u0006]2���\u0004\u000eT\n��3U;�P�M'����\u0016{������U*]7\u0011bEel�\u0015�?P5�Ђ��pk\u001c��\u0003���}BO����\u0001�\u001en�3\u000e��C�S�:�5�����B\u001d��","payload_hex":"030130e3000000000031c4f097f1ed9a8faab0b257b612b9e59f8c8bd1e95c40d0b5066ccbfbfae62cbfd6c3b0c35d3f6d0df1c4c3037ea8a20a3374f38fb4c345bb2f10b62af6e2e9cca5998f02d8fd10cac1d3cd3f7c7049afe43c3f98ff84532f9409598aeb425690dbe593b3e2a37da4764be3f2bb2da29f69e13769658b98f994f1838033d9100ebea3c1a1463f45bd8a28af455551e4bf321b2897a6c0903bb113bbe4eccbf2ab6fb34cb5f291727cb922c10f73a5cea6c1f63d67b6cea267e15d4bce293d7998f0c54de356c05f0fe2211e55c6ecfb87e239ef980791ffe8ef4ab618872fb078f4fd5b4abdba5a9fdb78f5a265f029472918e030aadf19992acfb1b1ff6129f35e843e1c3f98bb1a10b0bc75a1e6bdcafe9dfba87c1441a6e3f258e25381d6b20614ce45ac895fbc3a1c32db02efa5008ca0a908b4eaaf98dd077a308850e28e64b0d3103a33cd744fff4f51eef4517a95fa8249e531e1c2385cf2c1acd54f11852321bf56ee33a5ed82f6db7747550c42d855270937e94293db033fb05250367572f5cb6029704eab662922ae7f2ef057841760bb00a24edba58d8cf8dec26d50b739b0e0a9fe8c1028aebea7ddaefe61c55e1cc5016aa0a6f72c9ed5ee0c25a645d686eed412fefcc1bca39e6aa1ff2f001bf4018595a77cc14652b0527756974ddc8522ef841eb040c24eab634dda6368cf64ed640c692552bbd5a4332b3b8008c0a2f744c1a78583f530e6420a4aaad9ae973dba00630cbc38b0ef64eb6f6cac1263f0d30a7556ffa53c41b086eb893582c7ef822afc3e62ac2dc6989d3244af9534829faad89e4f14dfff9bca89d04c50bfcf7abb0ddc683ba300d8d544876b78090a22e1a972f588719053fa609f4a206ec4db7ca143b744438f19871684001f8f22003894f5c006861300e6b34b06210fe29db02554f469e30ef0f992f01821131859a70e1aad942dae7ae0f9810208639fb988f4adf1d7bbe2d14ed2e96fe502c98d10e33aa410e81ef1e19ff3ea0292a38b86507c5e0c5e2f5a3118c9161a92a32a75dece86c6ed77a88c6a928ffc351a838596e191f510eb2628b53c4347e06dbdbe3c438429ba2cb524be4420f35ea379f5840aea94f610bdab4c00f22c6dafeaa9f26fd2ac9b88d05accf14d2b94c62019d10aadc71a6a72666a6493d8147d8106ec54b388dc83e2a8742fd309f6f322c7fdcf8e173a007ea464117c788efe7f7b5232032eb5e5d62a14aa330a9d55d19b245fb25e5f3003c4417f3cd07dbb4bcfed4efda333d4cd477e00521b5523b6798369d8e299dba6db5ae3abd89ef6a78c44a52f7779fcbef7fc10125134c9cab732a299cb7d40a6d82351b0c147574d8bfc7c027578c16c74d17fc5054890bc7a325645b096ec88b93d387a858fc8108c441301bdd46e31a5edf7ab358767afb9bdf46953e0f10c1e2987a3b94fb34593c646509ab48240a179ebd6005285b9107a23635a1470783ef71bf746cf3cd995822a3037ac70d8255baf25ad34debdae01210916918154889d4bce6c87a70109d131407da119a2fcc8c7aafca667aba788b4bd193511a1d25c6f3ee31740ede8712d661346080f0ed0b90b7621b61da96adbc39fec647249d4b02cebf019d3624739758d42849c123ea7885f5da508c780cb666d30d8b60489e2ef79fcc2db43fc50d03ed56c501313d872707d7a37fe469e6b7676217aff036979ff2b544227a513657a7fb58d938dff030b793b09bfd974354f95af4f9818c898441cda6bc1edd13b6d86c80014c7031f413e2800179c366731e5b6c9fe7e61429a3cad5c297e979605609619279a3868d86069f0fc9f572d840df6828b58c425947281bdf01954f579ea0ea08446095da6724da211a4cf95b1c6183c1edc61b24ee36f3ffcc33475ae431532891e8f3090dcd2a180a23731684f6d862bcf387ab2a7b9ae6bed231930384bba57dbeae7b7bc89385ec069c60fd74c3aa684b4582c6d06975b29b08b61fb45b8d62fa08eec29c64ae92f11f8065d32ace2e7040e540aa5af33553b9550804d27b0edb59c167be6ffaaf7f7b1552a5d37116245656cea15a03f50358fd082b680706b1c86e6038691fa7d424fa79f86b801cb1e6eb5330ef483438453c53ad435a6f0bc8cf3421deebf","method":"","user_agent":"","ja3":"","session":"a219efb5-eeb3-4354-be39-2e6ef7be8915","seq":1,"duration_ms":101,"bytes_in":1537,"bytes_out":11,"enriched":{"digest":"cda12036c51697a5","strings":["?|pI","RP6ur","`)pN","^/Z1","jrfjd","z2VE","z#cZ","bG9u","rp}z7","kvv!z"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1},{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"deflate, gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"<HONEYPOT>:9380","notable":false},{"name":"User-Agent","value":"Openwave/ UCWEB7.0.2.37/28/999","notable":false}],"distinct_sets":2,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-30T13:31:28.444587+00:00"}