{"ip":"47.90.218.75","data_as_of":"2026-10-24T03:01:06+00:00","observed":true,"total_events":2534,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"887+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 887 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"464,433 bytes sent","bytes_sent":464433,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-02T06:39:30","last_seen":"2026-10-19T07:34:11","events_24h":0,"events_7d":2531,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"","lat":38.6879,"lon":-77.2978,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":36,"protocols":[{"protocol":"udp","events":34},{"protocol":"dns","events":1},{"protocol":"netbios","events":1}],"ports":[{"port":443,"events":3},{"port":1194,"events":3},{"port":500,"events":3},{"port":27964,"events":2},{"port":623,"events":2},{"port":53,"events":1},{"port":137,"events":1},{"port":161,"events":1},{"port":135,"events":1},{"port":123,"events":1}],"dns_questions":[{"name":"version.bind","type":"TXT","events":1}],"quic_clients":[],"first_seen":"2026-10-19T07:29:28","last_seen":"2026-10-19T07:33:53","recent":[{"timestamp":"2026-10-19T07:33:53","port":32770,"src_port":52291,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"7370f7b1-bbd1-49ae-b935-d36d86004d53","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:33:42","port":1701,"src_port":50832,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\u0002\u0000<\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\b\u0000\u0000\u0000\u0000\u0000\u0001�\b\u0000\u0000\u0000\u0002\u0001\u0000�\u000e\u0000\u0000\u0000\u0007nxp-scan�\n\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003�\b\u0000\u0000\u0000\t\u0000\u0001","payload_hex":"c802003c000000000000000080080000000000018008000000020100800e000000076e78702d7363616e800a00000003000000038008000000090001","sni":"","session":"fd1b7e17-e151-4fb9-960f-c43a00931afa","bytes_in":60,"source_verified":false,"enriched":{"digest":"4a739c811daa64d1","strings":["nxp-scan"]}},{"timestamp":"2026-10-19T07:33:25","port":10000,"src_port":53308,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"dcc7cf1e-2b0c-4e6c-aa01-379a936661c4","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:33:21","port":28138,"src_port":51780,"proto":"udp","app_proto":"","app_protocol":"","summary":"s","payload_hex":"73","sni":"","session":"25253157-0f23-4a2f-99c9-152cafbcbc79","bytes_in":1,"source_verified":false},{"timestamp":"2026-10-19T07:33:20","port":69,"src_port":53871,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001r7tftp.txt\u0000octet\u0000","payload_hex":"00017237746674702e747874006f6374657400","sni":"","session":"d990f5d2-7545-4243-974b-53bf966785a1","bytes_in":19,"source_verified":false,"enriched":{"digest":"d6b39e9877b82952","strings":["r7tftp.txt","octet","r7tftp.txtoctet"],"iocs":{"domains":["r7tftp.txtoctet"]}}},{"timestamp":"2026-10-19T07:33:00","port":32768,"src_port":53763,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"846227d6-c4d4-4fda-8dd8-6a728b63d72b","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:32:53","port":6881,"src_port":53084,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:\u001ca<MJ}�b�>���u�Z\t���6:target20:��\u001b���\u0001{�>��{�{߶�\u0002�e1:q9:find_node1:t2:aa1:y1:qe","payload_hex":"64313a6164323a696432303a1c613c4d4a7df462953ef9f09e75c85a0993d1e4363a74617267657432303ad9fa1bb0bc91017bac3ebfae7b957bdfb6e102fe65313a71393a66696e645f6e6f6465313a74323a6161313a79313a7165","sni":"","session":"f3b8d862-9652-4d14-83d7-2d49a22bc2fd","bytes_in":92,"source_verified":false,"enriched":{"digest":"4d8af6244fbe4740","strings":["d1:ad2:id20:","a<MJ}","6:target20:","e1:q9:find_node1:t2:aa1:y1:qe"]}},{"timestamp":"2026-10-19T07:32:28","port":3702,"src_port":49009,"proto":"udp","app_proto":"","app_protocol":"soap","summary":"<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<soap:Envelope xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:wsd=\"http://schemas.xmlsoap.org/ws/2005/04/discovery\">\n<soap:Header>\n<wsa:To>urn:schemas-xmlsoap-org:ws:2005:04:discovery</wsa:To>\n<wsa:Action>http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</wsa:Action>\n<wsa:MessageID>urn:uuid:dd4b37e5-265d-e828-8d8f-0f4014dd33d0</wsa:MessageID>\n</soap:Header>\n<soap:Body>\n<wsd:Probe>\n<wsd:Types></wsd:Types>\n</wsd:Probe>\n</soap:Body>\n</soap:Envelope>","payload_hex":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d38223f3e0a3c736f61703a456e76656c6f706520786d6c6e733a736f61703d22687474703a2f2f7777772e77332e6f72672f323030332f30352f736f61702d656e76656c6f70652220786d6c6e733a7773613d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f77732f323030342f30382f61646472657373696e672220786d6c6e733a7773643d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f77732f323030352f30342f646973636f76657279223e0a3c736f61703a4865616465723e0a3c7773613a546f3e75726e3a736368656d61732d786d6c736f61702d6f72673a77733a323030353a30343a646973636f766572793c2f7773613a546f3e0a3c7773613a416374696f6e3e687474703a2f2f736368656d61732e786d6c736f61702e6f72672f77732f323030352f30342f646973636f766572792f50726f62653c2f7773613a416374696f6e3e0a3c7773613a4d65737361676549443e75726e3a757569643a64643462333765352d323635642d653832382d386438662d3066343031346464333364303c2f7773613a4d65737361676549443e0a3c2f736f61703a4865616465723e0a3c736f61703a426f64793e0a3c7773643a50726f62653e0a3c7773643a54797065733e3c2f7773643a54797065733e0a3c2f7773643a50726f62653e0a3c2f736f61703a426f64793e0a3c2f736f61703a456e76656c6f70653e","sni":"","session":"c2b8d064-0162-4ffc-9024-c23345716d8d","bytes_in":566,"source_verified":false,"enriched":{"digest":"62ef386dacf767e0","label":"SOAP/XML","strings":["<?xml version=\"1.0\" encoding=\"utf-8\"?>","<soap:Envelope xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsa=\"h…","<soap:Header>","<wsa:To>urn:schemas-xmlsoap-org:ws:2005:04:discovery</wsa:To>","<wsa:Action>http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</wsa:Action>","<wsa:MessageID>urn:uuid:dd4b37e5-265d-e828-8d8f-0f4014dd33d0</wsa:MessageID>","</soap:Header>","<soap:Body>","<wsd:Probe>","<wsd:Types></wsd:Types>"],"iocs":{"urls":["http://www.w3.org/2003/05/soap-envelope","http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe"],"domains":["www.w3.org","schemas.xmlsoap.org"],"paths":["/www.w3.org/2003/05/soap-envelope","/schemas.xmlsoap.org/ws/2005/04/discovery/Probe"]}}},{"timestamp":"2026-10-19T07:32:26","port":32769,"src_port":53027,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"4dc6db09-3805-423e-b739-6ed0a4eaa637","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:32:20","port":500,"src_port":49600,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0011\"3DUfw\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000�\u0001\u0001\u0000\u0004\u0003\u0000\u0000$\u0001\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000\u0000\u0001\u0003\u0000\u0000$\u0002\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000\u0000\u0001\u0003\u0000\u0000$\u0003\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000\u0000\u0001\u0000\u0000\u0000$\u0004\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000\u0000\u0001","payload_hex":"001122334455667700000000000000000110020000000000000000c0000000a400000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400000001030000240201000080010005800200018003000180040002800b0001000c000400000001030000240301000080010001800200028003000180040002800b0001000c000400000001000000240401000080010001800200018003000180040002800b0001000c000400000001","sni":"","session":"b43a3fd2-8282-4711-ac80-b576fd8c3c1b","bytes_in":192,"source_verified":false,"enriched":{"digest":"0f9e3b0e1d1e99a2","strings":["\"3DUfw"]}},{"timestamp":"2026-10-19T07:32:20","port":500,"src_port":49599,"proto":"udp","app_proto":"","app_protocol":"","summary":"8d�x\u0001��ˏ\u0000\u0000\u0000\u0000\u0000","payload_hex":"3864c17801b89bcb8f0000000000","sni":"","session":"8fab9f4f-2ec0-4193-ab07-f07bc087cd02","bytes_in":14,"source_verified":false},{"timestamp":"2026-10-19T07:32:20","port":500,"src_port":49598,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"58d9f812-1c6b-4faf-94c8-a5d0aace451c","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:32:18","port":111,"src_port":52964,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"490589ae-ef43-4cb1-bf47-1742ba3f796d","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:32:14","port":53,"src_port":51454,"proto":"udp","app_proto":"dns","app_protocol":"dns","summary":"DNS query TXT/CH version.bind","payload_hex":"0006010000010000000000000776657273696f6e0462696e640000100003","sni":"","session":"87008bc4-19ae-4cf6-b1ab-910d2f1f459b","bytes_in":30,"source_verified":false,"dns":{"kind":"query","name":"version.bind","type":"TXT","class":"CH"}},{"timestamp":"2026-10-19T07:32:13","port":137,"src_port":50281,"proto":"udp","app_proto":"netbios","app_protocol":"netbios","summary":"NetBIOS node status query *","payload_hex":"80f00010000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"9ae8cb75-e635-4774-a505-006d714d7900","bytes_in":50,"source_verified":false,"enriched":{"digest":"5e140ecfd11c0972","strings":["NetBIOS node status query *"]}},{"timestamp":"2026-10-19T07:31:41","port":32771,"src_port":51555,"proto":"udp","app_proto":"","app_protocol":"","summary":"r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"72fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","sni":"","session":"06d530ee-d8b1-4ce8-ad13-363bf5beb917","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-19T07:31:38","port":4433,"src_port":50766,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"b1d2d946-1635-4afe-a2ab-a786b36e20d6","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-19T07:31:37","port":5060,"src_port":50290,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/UDP nm;branch=foo;rport\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f554450206e6d3b6272616e63683d666f6f3b72706f72740d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","sni":"","session":"52636853-49ca-40ee-9866-719d36302829","bytes_in":229,"source_verified":false,"enriched":{"digest":"f5d10315f5a94a91","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/UDP nm;branch=foo;rport","From: <sip:nm@nm>;tag=root","To: <sip:nm2@nm2>","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: <sip:nm@nm>","Accept: application/sdp"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-19T07:31:23","port":623,"src_port":52096,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0006\u0000�\u0006\u0000\u0000\u0011��\u0000\u0000\u0000","payload_hex":"0600ff06000011be80000000","sni":"","session":"07844d35-4622-4806-96dd-9c0348259c08","bytes_in":12,"source_verified":false},{"timestamp":"2026-10-19T07:31:23","port":623,"src_port":52095,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0006\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018ȁ\u00008�\u0004�","payload_hex":"0600ff07000000000000000000092018c88100388e04b5","sni":"","session":"16df667d-b439-427d-8d87-f5282d3b32c7","bytes_in":23,"source_verified":false},{"timestamp":"2026-10-19T07:31:21","port":5353,"src_port":49271,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\u0000\u0004�\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�O#Kq�R�","payload_hex":"e30004fa000100000001000000000000000000000000000000000000000000000000000000000000c54f234b71b152f3","sni":"","session":"37a81bdc-184c-4136-902a-cb173bbde984","bytes_in":48,"source_verified":false,"enriched":{"digest":"3aab7ca6d5f67dc9","strings":["O#Kq"]}},{"timestamp":"2026-10-19T07:31:05","port":27964,"src_port":49708,"proto":"udp","app_proto":"","app_protocol":"","summary":"����getstatus","payload_hex":"ffffffff676574737461747573","sni":"","session":"be0702b1-f05d-4ced-995e-7ce838921ee5","bytes_in":13,"source_verified":false,"enriched":{"digest":"f77239a7d672ed0c","strings":["getstatus"]}},{"timestamp":"2026-10-19T07:31:05","port":27964,"src_port":49707,"proto":"udp","app_proto":"","app_protocol":"","summary":"����getstatus","payload_hex":"ffffffff676574737461747573","sni":"","session":"0506ba42-cdd6-4ae2-bf35-e336297738ef","bytes_in":13,"source_verified":false,"enriched":{"digest":"f77239a7d672ed0c","strings":["getstatus"]}},{"timestamp":"2026-10-19T07:31:01","port":123,"src_port":53247,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"�\u0000\u0004�\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�O#Kq�R�","payload_hex":"e30004fa000100000001000000000000000000000000000000000000000000000000000000000000c54f234b71b152f3","sni":"","session":"4c5dc428-200a-4c35-b7db-a59411e31e15","bytes_in":48,"source_verified":false,"enriched":{"digest":"3aab7ca6d5f67dc9","strings":["O#Kq"]}},{"timestamp":"2026-10-19T07:30:32","port":47808,"src_port":49157,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\n\u0000\u0011\u0001\u0004\u0000\u0005\u0001\f\f\u0002?��\u0019y","payload_hex":"810a001101040005010c0c023fffff1979","sni":"","session":"cf6e6090-6a0f-4775-8e34-216418104772","bytes_in":17,"source_verified":false}]},"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":8123,"proto":"tcp","label":"","count":5},{"port":1723,"proto":"tcp","label":"PPTP","count":4},{"port":37777,"proto":"tcp","label":"","count":4},{"port":50808,"proto":"tcp","label":"","count":3},{"port":21659,"proto":"tcp","label":"","count":3},{"port":17431,"proto":"tcp","label":"","count":3},{"port":17641,"proto":"tcp","label":"","count":3},{"port":23459,"proto":"tcp","label":"","count":3},{"port":33333,"proto":"tcp","label":"","count":3},{"port":65003,"proto":"tcp","label":"","count":3},{"port":20008,"proto":"tcp","label":"","count":3},{"port":30021,"proto":"tcp","label":"","count":3},{"port":48223,"proto":"tcp","label":"","count":3},{"port":55756,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651","t13i1515h2_8daaf6152771_02713d6af862"],"tls_client_hello":"16030101fa010001f60303dd944dea6d7ca685a46f7534380ee3055aaa946858fbb810abe8c0a8db36adc820b45d04e8f883a653604e23619989fa46c26f23d17b69f942e6964f2a4823b5f10020caca130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f00350100018deaea0000001b0003020002001700000010000e000c02683208687474702f312e31000500050100000000446900050003026832000a000a00081a1a001d00170018002d0002010100120000000b000201000033002b00291a1a000100001d0020a9ec06beca19334eca7ddc66a9cbc44b90308ad5a4f0ad98b90e6907964d817900230000002b000706fafa03040303ff01000100000d0012001004030804040105030805050108060601fe0d00da0000010001de0020e96b745d9ca64ac2c22702ff8cb29e24e78c4c1a3b663518e710d93b92981c7700b0140037f5c7f104a2c0cbdb8b2d8900752a04c88487c9131b048de1722070f57ad844b21b4138683f518db9bf17f6e30e1d7538c19cb38a8d995cf6061bf600abf5ae8276f93402a435f17ba4cd4bbeb9d40680f6f1d5d1db42d7e5a1b0ddb2a36fc827341ab08992dea8bf0cf31d560b774478936c81916f6f12e4bbb73ed835a89a5ee33c64c98a714163164e712aed60fd9671ebabe7e55f29d0d73420cd696765f17cd014a93c13749bbde0023273aaaa000100","tls_ja3":["3a7c3ab4942ca37651ae56dbf02d8187","faa162b5a653756fba26803ea81b362f","b5aaff07d87569b4b3000558cd1e019d","1878289ecf002eb266cd60cfe95b2b60"],"http_akin":["b11cun060_0004001f_561f323a","b11cun030_00040014_eb31c4e4","b10cun000_00000000_334359b9"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i1515h2_8daaf6152771_02713d6af862":54,"b11cun030_00040014_eb31c4e4":43,"b10cun000_00000000_334359b9":2534,"t13i1310h1_f57a46bbacb6_e7c285222651":28,"b11cun060_0004001f_561f323a":448},"akin_families":{"b11cun060_0004001f_561f323a":{"head":"b11cun060_0004001f_561f323a","shapes":3,"ips":448}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-02","count":3},{"date":"2026-10-19","count":2531}],"recent_events":[{"timestamp":"2026-10-19T07:34:11","port":28081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,image/apng,*/*;q=0.8\",\"host\":\"<HONEYPOT>:28081\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32383038310d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"","session":"887d38b3-2621-486f-97ce-7839c692a8da","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":18519,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,image/apng,*/*;q=0.8\",\"host\":\"<HONEYPOT>:18519\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383531390d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"","session":"abab4436-5e79-4e78-a5f6-6bf16a833192","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":65006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,image/apng,*/*;q=0.8\",\"host\":\"<HONEYPOT>:65006\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353030360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"","session":"578b0df2-36a6-4cfa-82d0-5d4a6ce4f35d","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":51109,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,image/apng,*/*;q=0.8\",\"host\":\"<HONEYPOT>:51109\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313130390d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"","session":"f7a76d39-38ea-410a-ac52-41af4f5f8a38","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":28081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:28081\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32383038310d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"","session":"56811a47-8bc8-4058-ad0b-c4cab69653f3","seq":1,"duration_ms":100,"bytes_in":354,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":18519,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:18519\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383531390d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"","session":"80ed6c5b-0592-42b9-bad6-a65cdff20000","seq":1,"duration_ms":100,"bytes_in":354,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":65006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:65006\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353030360d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"","session":"34d75e6f-56bc-47ba-badf-4ffb5ef3f0f5","seq":1,"duration_ms":100,"bytes_in":354,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":51109,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:51109\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313130390d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"","session":"17652d0f-d1fd-493a-ac03-09c8ff2661cd","seq":1,"duration_ms":100,"bytes_in":354,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":28081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"2136ce9e-3d6e-4af0-aeae-cb0a9ce2c5c1","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-10-19T07:34:11","port":18519,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c69eb1aa-7d7b-4dd5-acdd-a09ea2a409d0","seq":1,"duration_ms":102,"bytes_in":18,"bytes_out":77}],"http_methods":[{"method":"GET","count":2459}],"distinct_ports_total":887,"top_paths":[{"path":"/","count":1638,"ports":819},{"path":"/favicon.ico","count":819,"ports":818},{"path":"/v1/agent/self","count":1,"ports":1},{"path":"/?query=SELECT+VERSION%28%29","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":10},{"value":"http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:28081","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[]}