{"ip":"47.94.82.6","total_events":105,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"28+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 28 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,160 bytes sent","bytes_sent":11160,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-10T16:40:55","last_seen":"2026-09-10T16:45:12","events_24h":105,"events_7d":105,"geo":{"country_code":"CN","country_name":"China","region":"Beijing","city":"Beijing","lat":39.911,"lon":116.395,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":19306,"proto":"tcp","label":"","count":11},{"port":4701,"proto":"tcp","label":"","count":11},{"port":65,"proto":"tcp","label":"","count":11},{"port":15800,"proto":"tcp","label":"","count":10},{"port":41890,"proto":"tcp","label":"","count":10},{"port":15236,"proto":"tcp","label":"","count":10},{"port":2218,"proto":"tcp","label":"","count":9},{"port":12902,"proto":"tcp","label":"","count":4},{"port":8337,"proto":"tcp","label":"","count":3},{"port":3152,"proto":"tcp","label":"","count":3},{"port":23013,"proto":"tcp","label":"","count":3},{"port":18182,"proto":"tcp","label":"","count":2},{"port":1301,"proto":"tcp","label":"","count":2},{"port":8633,"proto":"tcp","label":"","count":2},{"port":8978,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"ja4h":["op10nn0000_000000000000","ge11nn0300_c91e9608e9b6","ge10nn0000_000000000000","po11nn0400_8faee35b2b18"]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":28,"op10nn0000_000000000000":1562,"ge11nn0300_c91e9608e9b6":21,"ge10nn0000_000000000000":2504,"po11nn0400_8faee35b2b18":4},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-10","count":105}],"recent_events":[{"timestamp":"2026-09-10T16:45:12","port":65,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"337d5b31-f1a8-4f52-89d8-eff1fcf65a01","seq":1,"duration_ms":996,"bytes_in":38,"bytes_out":75},{"timestamp":"2026-09-10T16:45:11","port":19306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"548f8886dcfeeab8d28d3346a63b70c5","session":"8b3cb2a4-a562-4718-8887-916d81ca2613","seq":1,"duration_ms":380,"bytes_in":18,"bytes_out":75},{"timestamp":"2026-09-10T16:45:05","port":15236,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"67a1ac7c-d094-433b-a7eb-ac1ed1b969b4","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":75},{"timestamp":"2026-09-10T16:44:58","port":15236,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8a8a18bc-b519-4fa2-a5c5-48ab3573d9aa","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":75},{"timestamp":"2026-09-10T16:44:58","port":18182,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(C\u00004g\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028430034670000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"857b2894-4365-4117-8eee-1cbd4e207b91","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":10,"enriched":{"digest":"e405e78971c24ea8","strings":["(C4g"]}},{"timestamp":"2026-09-10T16:44:56","port":65,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"43fe0db0-f2d7-4a3f-b067-3f4fb7ba4459","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":75},{"timestamp":"2026-09-10T16:44:56","port":23013,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(%A�;\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282541da3b0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"1b8c5858-740d-4c8e-ae91-6add5f0ff7ef","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":10},{"timestamp":"2026-09-10T16:44:54","port":1301,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(G��\"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002847b0f2220000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"47355909-5dc1-4b4e-b5f6-7c9f7976b8f3","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":10},{"timestamp":"2026-09-10T16:44:54","port":12902,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u001fNO�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000281f4e4fa80000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ccbf3523-8f2e-46b3-bf3d-ecc188964927","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":10},{"timestamp":"2026-09-10T16:44:53","port":41890,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"176757b1-2210-4cb3-9f7c-6d0375629174","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":75}],"http_methods":[{"method":"GET","count":55},{"method":"POST","count":7},{"method":"OPTIONS","count":1}],"distinct_ports_total":28,"top_paths":[{"path":"/","count":26,"ports":11},{"path":"/nmaplowercheck1789058614","count":9,"ports":7},{"path":"/Nmap/folder/check1789058614","count":8,"ports":6},{"path":"/sdk","count":7,"ports":7},{"path":"/NmapUpperCheck1789058614","count":7,"ports":6},{"path":"/evox/about","count":4,"ports":4},{"path":"/HNAP1","count":2,"ports":2}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-11T10:28:42.566397+00:00"}