{"ip":"47.99.109.105","total_events":124,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"49+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 49 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,155 bytes sent","bytes_sent":8155,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-05T12:40:50","last_seen":"2026-09-05T12:48:34","events_24h":0,"events_7d":0,"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"top_ports":[{"port":10823,"proto":"tcp","label":"","count":14},{"port":11226,"proto":"tcp","label":"","count":8},{"port":5923,"proto":"tcp","label":"","count":8},{"port":20160,"proto":"tcp","label":"","count":7},{"port":9132,"proto":"tcp","label":"","count":7},{"port":32003,"proto":"tcp","label":"","count":7},{"port":61137,"proto":"tcp","label":"","count":4},{"port":61101,"proto":"tcp","label":"","count":4},{"port":21406,"proto":"tcp","label":"","count":4},{"port":18319,"proto":"tcp","label":"","count":3},{"port":5919,"proto":"tcp","label":"","count":3},{"port":9251,"proto":"tcp","label":"","count":3},{"port":28101,"proto":"tcp","label":"","count":3},{"port":52001,"proto":"tcp","label":"","count":3},{"port":40034,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i990600_a40d17a72bcb_4446390ac224"],"tls_client_hello":"","tls_ja3":["548f8886dcfeeab8d28d3346a63b70c5"],"http_akin":[]},"fingerprint_peers":{"t12i990600_a40d17a72bcb_4446390ac224":30},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-05","count":124}],"recent_events":[{"timestamp":"2026-09-05T12:48:34","port":4984,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000( ���\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002820d9cbdd0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"2f5eed30-ed28-4121-8efa-4a19687ad037","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:34","port":18319,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(1^��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028315e819a0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"d526e618-a17c-4fc6-8f4b-89c1619352e3","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:31","port":6518,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(6\u001f��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028361fc9cc0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"2e395420-3e49-4d99-b30f-fb9972076083","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:31","port":9251,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(B\u0014S/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000284214532f0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"793be562-3bd5-435f-b0f4-75a7c5d4e0d3","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:22","port":11226,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"afd1e6f5-404b-49c0-81fb-405cb0eea9ab","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":78},{"timestamp":"2026-09-05T12:48:22","port":4526,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u001b�B�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000281b9742ac0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"e0a8233f-2a9a-4168-aa93-6ed8c2524f61","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:21","port":40034,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000((Ӱ^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002828d3b05e0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"38b460df-ec65-49e2-bb49-4d76c100e09a","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:21","port":11226,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a47f915f-1cbd-4922-8e9d-1effad944ede","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-09-05T12:48:21","port":5919,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(#�2�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002823ee32f20000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ce0d5da7-8de9-4ab8-ab9c-5fa6c33023d3","seq":1,"duration_ms":102,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-05T12:48:21","port":21406,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(*`��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"800000282a60dbdf0000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"494021ce-4870-4cb0-b7ac-8aa957a7bdb4","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13}],"http_methods":[{"method":"GET","count":50},{"method":"POST","count":4},{"method":"OPTIONS","count":2}],"distinct_ports_total":49,"top_paths":[{"path":"/","count":31,"ports":18},{"path":"/nmaplowercheck1788612355","count":6,"ports":3},{"path":"/HNAP1","count":5,"ports":4},{"path":"/sdk","count":4,"ports":4},{"path":"/evox/about","count":4,"ports":3},{"path":"/NmapUpperCheck1788612355","count":2,"ports":2},{"path":"/nmaplowercheck1788612356","count":1,"ports":1},{"path":"/NmapUpperCheck1788612356","count":1,"ports":1},{"path":"/Nmap/folder/check1788612355","count":1,"ports":1},{"path":"/Nmap/folder/check1788612356","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T13:39:12.620349+00:00"}