{"ip":"47.94.138.70","total_events":396,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"82+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 82 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"41,763 bytes sent","bytes_sent":41763,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-09T03:55:49","last_seen":"2026-09-09T04:06:04","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Beijing","city":"Beijing","lat":39.911,"lon":116.395,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":39200,"proto":"tcp","label":"","count":17},{"port":22079,"proto":"tcp","label":"","count":15},{"port":11834,"proto":"tcp","label":"","count":12},{"port":5245,"proto":"tcp","label":"","count":12},{"port":31027,"proto":"tcp","label":"","count":11},{"port":1588,"proto":"tcp","label":"","count":11},{"port":3225,"proto":"tcp","label":"","count":11},{"port":10407,"proto":"tcp","label":"","count":11},{"port":4488,"proto":"tcp","label":"","count":11},{"port":2365,"proto":"tcp","label":"","count":11},{"port":51391,"proto":"tcp","label":"","count":10},{"port":9777,"proto":"tcp","label":"","count":10},{"port":13970,"proto":"tcp","label":"","count":10},{"port":2389,"proto":"tcp","label":"","count":10},{"port":12600,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":30},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-09","count":396}],"recent_events":[{"timestamp":"2026-09-09T04:06:04","port":22079,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e13123de-2cac-4e90-82d6-1831c7a51eab","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:06:03","port":31027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"976aecb0-6338-4e43-b389-b8ffe662e530","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:05:53","port":22079,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e7be5cfe-78f4-4c03-8d24-2eee9c65c724","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-09T04:05:51","port":2140,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"02ff5fe7-4df1-4ce8-9a19-1dad5a61fe7c","seq":1,"duration_ms":331,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:05:49","port":22443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"4e8c4ba1-6753-4a2a-8ccb-c6d81d19f8d2","seq":1,"duration_ms":101,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:05:49","port":31027,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"6f94a56f-a128-4538-96e4-4eeb198e210b","seq":1,"duration_ms":985,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:05:47","port":22443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"f65c8189-a933-4e09-a593-f971856d31b0","seq":1,"duration_ms":1003,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-09T04:05:44","port":31027,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"28076a9b-b8a5-41a8-9e61-4a3b63977df7","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-09T04:05:41","port":6680,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"49ee57fe-e883-4fb4-9083-d5ee540f75de","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":77},{"timestamp":"2026-09-09T04:05:40","port":6680,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"70ff4123-4061-497b-bc55-bdcaaa295903","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77}],"http_methods":[{"method":"GET","count":239},{"method":"POST","count":25},{"method":"OPTIONS","count":6}],"distinct_ports_total":82,"top_paths":[{"path":"/","count":123,"ports":47},{"path":"/nmaplowercheck1788926439","count":33,"ports":30},{"path":"/NmapUpperCheck1788926439","count":27,"ports":24},{"path":"/Nmap/folder/check1788926439","count":26,"ports":22},{"path":"/sdk","count":25,"ports":24},{"path":"/evox/about","count":22,"ports":21},{"path":"/HNAP1","count":14,"ports":13}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-24T14:28:14.705104+00:00"}