{"ip":"8.217.139.22","total_events":21,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["21 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 6,515 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,515 bytes sent","bytes_sent":6515,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-09T08:31:57","last_seen":"2026-09-09T16:24:15","events_24h":0,"events_7d":0,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":4},{"port":5060,"proto":"tcp","label":"SIP","count":3},{"port":8089,"proto":"tcp","label":"Splunk","count":2},{"port":6467,"proto":"tcp","label":"","count":2},{"port":3000,"proto":"tcp","label":"Web-alt","count":2},{"port":1717,"proto":"tcp","label":"","count":2},{"port":8889,"proto":"tcp","label":"","count":2},{"port":2083,"proto":"tcp","label":"","count":2},{"port":4567,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":["e1ad4e4aa69a43c843e10eeec3e1c880"],"tls_ja4":["t13i2412h1_df98b6d6dfe4_1b3407e2c936","t13i2412h2_df98b6d6dfe4_1b3407e2c936"],"tls_client_hello":"","tls_ja3":["410d9b65ff73443a9a062d12534d1ea7"],"http_akin":["b11cun040_00040016_4110f156","b11cun050_0004001e_377ad04d","b11cun050_0004001e_d490606f"]},"fingerprint_peers":{"t13i2412h1_df98b6d6dfe4_1b3407e2c936":112,"t13i2412h2_df98b6d6dfe4_1b3407e2c936":112,"e1ad4e4aa69a43c843e10eeec3e1c880":1,"b11cun040_00040016_4110f156":261,"b11cun050_0004001e_377ad04d":112,"b11cun050_0004001e_d490606f":76},"akin_families":{"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":8,"ips":261},"b11cun050_0004001e_377ad04d":{"head":"b11cun040_00040016_4110f156","shapes":8,"ips":261},"b11cun050_0004001e_d490606f":{"head":"b11cun040_00040016_4110f156","shapes":8,"ips":261}},"user_agents":["Openwave/ UCWEB7.0.2.37/28/999","Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;","Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"],"timeline":[{"date":"2026-09-09","count":21}],"recent_events":[{"timestamp":"2026-09-09T16:24:15","port":5060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:5060\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353036300d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"","session":"f51d2d46-374d-467f-8d6d-89fdb386d379","seq":1,"duration_ms":100,"bytes_in":143,"bytes_out":77},{"timestamp":"2026-09-09T16:24:14","port":5060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:5060\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353036300d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"","session":"f35c735e-781d-42d9-9efa-7b9ce4429c2f","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":77},{"timestamp":"2026-09-09T16:24:05","port":22,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"","session":"e5f3d2b9-829e-41f3-82af-f4684c914325","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":77},{"timestamp":"2026-09-09T16:24:04","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004l\f\u0014wC37m�yI8W���\u001b5�\u0000\u0000\u0001-curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c\u0000\u0000\u0000�ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp512,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,diffie-hellman-group-exchange-sha256\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�L\u001diKn�\u0016lܰq","payload_hex":"5353482d322e302d4f70656e5353480d0a0000046c0c14774333376df779493857e18bc81b35ea0000012d637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6578742d696e666f2d63000000d47373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703531322c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235360000009e6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d6362630000009e6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d6362630000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39360000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000ca4c1d694b6e91166cdcb071","method":"","user_agent":"","ja3":"","session":"22566124-406a-4e63-81ad-2cdad1eca50c","seq":1,"duration_ms":279,"bytes_in":1153,"bytes_out":12,"enriched":{"digest":"f1dcd27508a62299","label":"SSH","strings":["SSH-2.0-OpenSSH","wC37m","yI8W","-curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,c…","nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-09T16:24:04","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.16.31.219:37322;rport;branch=z9hG4bKlHCfoJQL2okV1YIoj0j6ckN5d\r\nMax-Forwards: 67\r\nFrom: \"VToYF4Bl\" <sip:user@<HONEYPOT>>;tag=oeUUNlt83nQDbbrktwAa\r\nTo: \"VToYF4Bl\" <sip:user@<HONEYPOT>>\r\nCall-ID: jH775vldYDg6LeA7O_LbzTzHqLrbrqvhBugCI4oHDrcwNYovzpP8rnhQ6XEa\r\nCSeq: 1234 OPTIONS\r\nUser-Agent: VToYF4Bl\r\nContact: \"VToYF4Bl\" <sip:user@172.16.31.219:37322>\r\nExpires: 300\r\nAllow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS\r\nAccept: application/sdp\r\nContent-Length:  0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e31362e33312e3231393a33373332323b72706f72743b6272616e63683d7a39684734624b6c4843666f4a514c326f6b563159496f6a306a36636b4e35640d0a4d61782d466f7277617264733a2036370d0a46726f6d3a202256546f594634426c22203c7369703a7573657240<HONEYPOT>3e3b7461673d6f6555554e6c7438336e51446262726b747741610d0a546f3a202256546f594634426c22203c7369703a7573657240<HONEYPOT>3e0d0a43616c6c2d49443a206a48373735766c64594467364c6541374f5f4c627a547a48714c7262727176684275674349346f48447263774e596f767a705038726e6851365845610d0a435365713a2031323334204f5054494f4e530d0a557365722d4167656e743a2056546f594634426c0d0a436f6e746163743a202256546f594634426c22203c7369703a75736572403137322e31362e33312e3231393a33373332323e0d0a457870697265733a203330300d0a416c6c6f773a20505241434b2c20494e564954452c2041434b2c204259452c2043414e43454c2c205550444154452c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c204f5054494f4e530d0a4163636570743a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a2020300d0a0d0a","method":"","user_agent":"","ja3":"","session":"fbb2bd01-7e37-40f1-99e5-b3d6ef40a2d2","seq":1,"duration_ms":100,"bytes_in":561,"bytes_out":77,"enriched":{"digest":"9c0d68969b093204","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.16.31.219:37322;rport;branch=z9hG4bKlHCfoJQL2okV1YIoj0j6ckN…","Max-Forwards: 67","From: \"VToYF4Bl\" <sip:user@<HONEYPOT>>;tag=oeUUNlt83nQDbbrktwAa","To: \"VToYF4Bl\" <sip:user@<HONEYPOT>>","Call-ID: jH775vldYDg6LeA7O_LbzTzHqLrbrqvhBugCI4oHDrcwNYovzpP8rnhQ6XEa","CSeq: 1234 OPTIONS","User-Agent: VToYF4Bl","Contact: \"VToYF4Bl\" <sip:user@172.16.31.219:37322>","Expires: 300"],"iocs":{"ips":["172.16.31.219"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-09T16:24:04","port":22,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"","session":"823620be-3ee8-46e9-ab41-b8450e1758e8","seq":1,"duration_ms":100,"bytes_in":196,"bytes_out":77},{"timestamp":"2026-09-09T16:24:03","port":4567,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:4567\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343536370d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c6170706c69636174696f6e2f7868746d6c2b786d6c2c206170706c69636174696f6e2f786d6c3b713d302e392c202a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"24704aa3-bd82-4567-9153-3b62ee7df5c6","seq":1,"duration_ms":101,"bytes_in":277,"bytes_out":77},{"timestamp":"2026-09-09T16:24:03","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004l\f\u0014n��`�؅\b%lF�\fġl\u0000\u0000\u0001-curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c\u0000\u0000\u0000�ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp512,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,diffie-hellman-group-exchange-sha256\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0018p@�+]��C���","payload_hex":"5353482d322e302d4f70656e5353480d0a0000046c0c146ea2b66081d88508256c46d20cc4a16c0000012d637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6578742d696e666f2d63000000d47373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703531322c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235360000009e6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d6362630000009e6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d6362630000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39360000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000187040d12b5d9dcf43ad92ee","method":"","user_agent":"","ja3":"","session":"cc145b29-4c92-465a-b37e-983dc4a6e24d","seq":1,"duration_ms":290,"bytes_in":1153,"bytes_out":12,"enriched":{"digest":"5b43eedb37e8b00f","label":"SSH","strings":["SSH-2.0-OpenSSH","-curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,c…","nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-09T16:24:03","port":4567,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:4567\",\"user-agent\":\"Openwave/ UCWEB7.0.2.37/28/999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343536370d0a557365722d4167656e743a204f70656e776176652f205543574542372e302e322e33372f32382f3939390d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Openwave/ UCWEB7.0.2.37/28/999","ja3":"410d9b65ff73443a9a062d12534d1ea7","session":"5b69952c-7fda-4f90-b5d6-49b6eea35b3d","seq":1,"duration_ms":100,"bytes_in":143,"bytes_out":77},{"timestamp":"2026-09-09T08:34:34","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204f706572612f392e3830202857696e646f7773204e5420362e313b20553b20656e292050726573746f2f322e382e3133312056657273696f6e2f31312e31310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11","ja3":"","session":"7c4e589e-b910-411b-81d2-f71a00ab985e","seq":1,"duration_ms":101,"bytes_in":176,"bytes_out":77}],"http_methods":[{"method":"GET","count":18}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":9,"ports":9},{"path":"/favicon.ico","count":9,"ports":9}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":3},{"value":"h2, http/1.1","count":3}],"banners":[{"value":"SSH-2.0-OpenSSH","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"deflate, gzip","notable":false},{"name":"Accept-Language","value":"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","notable":false},{"name":"Host","value":"<HONEYPOT>:5060","notable":false},{"name":"User-Agent","value":"Openwave/ UCWEB7.0.2.37/28/999","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-09-30T11:29:59.996988+00:00"}