{"ip":"47.84.93.5","total_events":24,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,122 bytes sent","bytes_sent":8122,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T06:07:38","last_seen":"2026-09-17T03:09:09","events_24h":0,"events_7d":0,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":31380,"proto":"tcp","label":"","count":4},{"port":4000,"proto":"tcp","label":"","count":3},{"port":5601,"proto":"tcp","label":"Kibana","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":8777,"proto":"tcp","label":"","count":2},{"port":3002,"proto":"tcp","label":"","count":2},{"port":8978,"proto":"tcp","label":"","count":2},{"port":9997,"proto":"tcp","label":"","count":2},{"port":9994,"proto":"tcp","label":"","count":2},{"port":8501,"proto":"tcp","label":"","count":2},{"port":1935,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2412h1_df98b6d6dfe4_1b3407e2c936","t13i2412h2_df98b6d6dfe4_1b3407e2c936"],"tls_client_hello":"","tls_ja3":["410d9b65ff73443a9a062d12534d1ea7"],"http_akin":[]},"fingerprint_peers":{"t13i2412h1_df98b6d6dfe4_1b3407e2c936":89,"t13i2412h2_df98b6d6dfe4_1b3407e2c936":89},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;","Openwave/ UCWEB7.0.2.37/28/999","Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"],"timeline":[{"date":"2026-09-15","count":8},{"date":"2026-09-16","count":9},{"date":"2026-09-17","count":7}],"recent_events":[{"timestamp":"2026-09-17T03:09:09","port":8978,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:8978\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383937380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"be4bdd2c-1caf-47e6-a987-0da323210b22","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":75},{"timestamp":"2026-09-17T03:09:09","port":9994,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:9994\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"ef1c5d69-35f1-4e0f-94f6-2fe6843005b5","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":75},{"timestamp":"2026-09-17T03:09:08","port":8978,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:8978\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383937380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c6170706c69636174696f6e2f7868746d6c2b786d6c2c206170706c69636174696f6e2f786d6c3b713d302e392c202a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"09282572-79d8-4ac9-97d8-81be2355f236","seq":1,"duration_ms":100,"bytes_in":353,"bytes_out":75},{"timestamp":"2026-09-17T03:09:08","port":9994,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:9994\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c6170706c69636174696f6e2f7868746d6c2b786d6c2c206170706c69636174696f6e2f786d6c3b713d302e392c202a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"e7fd7fde-285a-436c-8c2e-863072ef159a","seq":1,"duration_ms":100,"bytes_in":353,"bytes_out":75},{"timestamp":"2026-09-17T03:08:58","port":5601,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:5601\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353630310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"","session":"24e4bd6a-320f-479f-9eff-66acf39b3517","seq":1,"duration_ms":100,"bytes_in":274,"bytes_out":75},{"timestamp":"2026-09-17T03:08:58","port":5601,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:5601\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353630310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533342e35372e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f352e312e37205361666172692f3533342e35372e320d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","ja3":"","session":"676bd2a8-dbad-4d10-9aa1-fb5729cc321a","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":75},{"timestamp":"2026-09-17T03:08:23","port":1935,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\r�t�\u0000\u0000\u0000\u00007�/B�i�ⷫ%ҫ��ĸ\u001bHLóZ\u001b�d\u0019�S�틷\u001c͞���=0�\u000f�L��\u0004��P}���M\u000e�Hb�5�XR���?w\u0014o\u001d#Ji��m|н�jg��vC\u0000��6�=�4_��t-ȗw1Z`��0[К�bR8�S\u0010����\u0011T�p\u0012��?o|���\u0016>�F�|�[�3����\u000e\u000fz� �ґ�yu ��׈���t4_�\u0015��HOS��a�m8�<\n�\u001d�\u0005=l�\u0014��\u0002�26\u001b#K���%Eb\u0018�A��@����m�\u001c��1΋3��i���{�G�\u0017����>�+\u0000������̝-�(`$����}D����n�nY�\n�ܐ��P�N���\u0015D\r�\r���\u001bYO\u0000\t��w\u0017x��T\u0011\u001b\u0010�k��X��m��g��(�ˁ�ˊ�h\u0001���G5�bE(�\r\n%�֒����_\"0*�\u0007�-�^.H?��uD��l��w��Mx*�r�[�\u0001�7\t{d�ڒ�\u0019B~��pI�0\u0010j\u0016�����\u0000�\u000e���˗\u000f/<��*\u0003\u0003���\u0019�~I��_|��7S��b�Q�L�\u0005{%�<O�@���\u0011^HZI1��ѧ�$���\u0016\u0011|c���\u001eq\u001bnc[f�%wDnэ��Rp3N��\u000e\u001b�\u001f�A\u0018\u0019 7�;���\u000bԻ�\u0018)S����8\u0012G��U��t���\u001a�#Uh\u0011�s�����I��(��:��\u00148�̬\u0005�8����5d� ظ�͵�\u0016Y/>�\u0000x؞�\u0010$Y�*\u001f��\u0000��5U]V-\u0015\u001d�˴\u0011$�O\u0019����T\u0001����ͱ�͢$\u0002��X$�u\u001eb)/�\r��G�s��\u001aIN�\u0016��㡩��*>����#�\n���H���Nlii��T˷ٮX����ѭn���b�;L\u001c�'�\\uY��\u000e}3�4\f���\u001a~<�+�q�<�Gx\u001fc�FPX��\u001e���͐��\u0017]h2ۤ\u001e\u0007O���b\u0002\u0003�e�ǶX�_v\u001c\u0017\u0012���ÿ@+�\u001c�\u000f#\u001f�ު\u0000஁E�H�\u0005�[|�r��\u0019q�ز��Ώ���v�Xv�\u0006���?��\nK5�����5U��\u0014x��Q�Q�u�>$�5\u0019du\t\u001dTSp\u0011\u00171�L��4�\u000f�=`��'\u00058e*��CL\u0010Li������0� �/TQ>=���\u001d��U+�=�@�֌�e,�d݃�u�K����4,�\u0002IF՟q��7\u0012f\r�Yr�\b֧�j\u001c.��%S�Z$\\�j1g�\u0003D\u0012\u0015�\u001f�\u0003�}\u000bg$��@Ň\u0001�ڥEYɡ\"3҉\u000e�� �w?�z�\u001a�7>\u001d\b~␀�j%\u0012����!�o/Z=OD���/^���9ҝ��-8��]�\\KHBlͱ�(��l�xN��I�k�Y\b;\r6s���$*\u001bll�9\u001d\"a\f\fί�\u001c�Ze\b��a�#n\u0003���f\"���g\bDž*)�6�@�\u0013�\u0014x��a*����\u001b�|��w\u0003F�\u000b\u000ed67�l.5'A�;��\u0015\u001a鼟�f�\u0018�;�Z>\u00179J%��\\����\u0013˽O�|d�e >����i3��r���\u000b�<g+(��<���@+�ߐ\u000f\u001dv�\u0015u�ID��*�w5V���ۍs\u0017I\"��M�iݠ�T6��4�\r��7�\u0017l\n�\b������!_go��L�W���i��v�x���\u0019�Y!;��:��[\u001b��\f�\u0017�#�e\u0016!a��SfE��^�N��M6\u001d\b�x#�C/�Zͷ\u00112�2����\"\u000f�\u0018m�f�i�$����߶B\u000fI��\u0000�\u000e�ࡊ����e�&�+\u0014U�8ܚ'�z�\u001d�&�e'fs�F\u0014��+�\u0000���\u001b�B�\u001c\u001e�C�\u000e \u0016�F��m5ob|��l\u001e\r\u0016\u001e��\u000b\u0018�M\u0011�k�)d�IzJ�IF�~�_�8AgVN}uKc�c-","payload_hex":"030dfd749a0000000037c72f42e769b8e2b7ab25d2aba690c4b81b484cc3b35a1bb36419fb53f0ed8bb71ccd9e8585803d30a60fdb4c9f9f04bae7507d9aaa984d0eb14862a135ed5852baf6d73f77146f1d234a69c2e96d7cd0bdf96a6792b8764300d8e536c53d887f345fbeab742dc89777315a609ed6305bd09ac2625238a553108a89d5c81154fc7012a7e43f6f7cb6a0d6163eac46997ce15bde33948486a40e0f7ad620ced291e1797520e8f1d788c7edc674345ff015bbcf484f53cff361de6d38ff3c0a901d84053d6cf714f5be02bb32361b234bd6f29325456218a64186de40c2e9d0df6dd51cd9cc31ce8b338abd69a5e0b47bd247a017aab8beeb3e9c2b0085fbdff2d0fccc9d2d9a286024e5c9c9c67d4498c4e4b06e9d6e59db0a84dc907fbb8250b74eede4e915440dfa0dd7c08a1b594f0009bd9d771778819b54111b10946bc7e258accb6df0d967feb02888cb81d7cb8a956801ace182473594624528cd0d0a25b9d692a9affaa75f22302aa307f62d9c5e2e483fb0907544f2ba6cc0c777e5804d782afc72d15b94018537097b64a5da92ee19427e8e877049f330106a1691b78ebbb3008c0e948e94cb970f2f3ce9c12a0303a8918a19da7e49ebe85f7ca0ed3753edc3628151f64ce8057b25ef3c4ff240f883ca115e485a4931bac5d1a7fc2495bf8616117c63f982de1e711b6e635b66e62577446ed18d9f8b5270334e94c80e1bde1f9741181920378a3ba5ed960bd4bb82182953a6c8dff8381247cdda55e8b8747ffa8c991ac323556811eb73e5a6f5fdd049a398289cd13ae39e143886ccac05c6389ee0fcc23564d320d8b8c7cdb59716592f3ef50078d89e8c102459bc2a1ff4c800f08a35555d562d151dfacbb41124e34f19e4c8f1825401a7adbdd1cdb199cda22402f781582497751e62292f860d7f9ff14790739b911a494eeb16ff85e3a1a9e5982a3ebcc1b3db23dd0aa9ea8948dbd0d84e6c6969b5b754cbb7d9ae588293f1add1ad6e85889262933b4c1c8427ed5c7559c6de0e7d33d9340c878d8f1a7e3cec2baa71b43cd347781f63fc465058bba91e9ab79ccd90d0d9175d6832dba41e074f8fbb8b6202038165ffc7b658825f761c1712e9a7e3c3bf402bf11cd00f231f9edeaa00e0ae8145ad48fb05ca5b7ce7728ed0197193d8b2bfc9ce8fd8f1ae76cf5876af06f7f4b43ff0b90a4b35f1bdc4c1d63555afe71478b5a351a651c775a93e24b035196475091d7f545370111731e74c8696349a0fe93d60908e270538652ae89b434c104c698fa0bcffb1d3309820b72f54513e3d8f9ecd1dc5d3552bfd3dc64089d68cf3652caf64dd839475a34ba4f79de2342c80024946d59f71d2dc3712660d9e5972ca08d6a78b6a1c2eb6c12553a35a7f245cc86a3167db03441215aa1fb303917d0b672497d140c58701ebdaa54559c9a12233d2890ed5cd20ea773f9d7ad01a86373e1d087ee29080cd6a2512c4eeb3e621856f2f5a3d4f44b48ee12f5efbb59539d29db8b42d3882985d945c4b48426ccdb19b28eeea6ca3784ed2d649876b8359083b0d36738fced0242a1b6c6c87391d22610c0cceaf841c815a6508c5e861cd236e0396fed16622fb818e6708c7852a299136f740ba13c11478c9d9612aa78498aa1b967c81b8770346df0b0e643637f56c2e352741f63bb9bf151ae9bc9f8166ba18e23bd05a3e17394a259d805c92ec8ac713cbbd4f847c649f65203ee686f8fe6933cfc372e6fcbc0b993c672b28f1f23cbcaf8b402befdf900f1d76951575fe4944c1bb2abd773556b39c81db8d73174922a2894d9169dda08654369cc934e50df6a037b3176c0aca088ba595ffbdde215f676ff1d04c9157a0c7f369fcd876f278ada58f19af59213bfeb63abb945b1bfcca0ccc179d23b765162161ee97536645f8f55ea84e80e34d361d08cb7823c7432f935acdb71132cd3293bccae6220fde186d8666ed69b32486bcefffdfb6420f499cdc00ad0ecee0a18aaa87acb965c426ec2b1455de38dc9a27db7add1d8926b965276673f546147ff09b2ba900f0d0ec1be442f91c1e9443f90e20169746cffc6d356f627c83e16c1e0d161efde60b18ca4d11e66ba52964b3497a4a8f4946fd7eb55ffa384167564e7d754b6380632d","method":"","user_agent":"","ja3":"","session":"5a091ff2-6cc6-4a9b-ac4e-882bd9484e93","seq":1,"duration_ms":100,"bytes_in":1537,"bytes_out":10,"enriched":{"digest":"f312b6050590b868","strings":["w1Z`","_\"0*","^.H?","^HZI1","nc[f","%wDn","Rp3N","5U]V-","Nlii","/TQ>="]}},{"timestamp":"2026-09-16T19:02:51","port":8501,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:8501\",\"user-agent\":\"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383530310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d53494520392e303b2057696e646f7773204e5420362e313b2054726964656e742f352e303b0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"e68716bf-abbe-4a03-86aa-cb03ea5a9728","seq":1,"duration_ms":101,"bytes_in":176,"bytes_out":75},{"timestamp":"2026-09-16T19:02:50","port":8501,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:8501\",\"user-agent\":\"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383530310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204d53494520392e303b2057696e646f7773204e5420362e313b2054726964656e742f352e303b0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c6170706c69636174696f6e2f7868746d6c2b786d6c2c206170706c69636174696f6e2f786d6c3b713d302e392c202a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"77a724bb-5415-4b5a-8ad6-0ed1a3a0ebf3","seq":1,"duration_ms":100,"bytes_in":310,"bytes_out":75},{"timestamp":"2026-09-16T19:02:46","port":31380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:31380\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33313338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e313120284b48544d4c2c206c696b65204765636b6f29204368726f6d652f32332e302e313237312e3634205361666172692f3533372e31310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"63dff0ae-e2b1-44ff-bb70-5f7ed0135644","seq":1,"duration_ms":101,"bytes_in":218,"bytes_out":75}],"http_methods":[{"method":"GET","count":22}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":11,"ports":10},{"path":"/favicon.ico","count":11,"ports":10}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":6},{"value":"h2, http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"deflate, gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"<HONEYPOT>:8978","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-24T12:55:07.413036+00:00"}