{"ip":"47.250.81.7","data_as_of":"2026-10-23T08:53:18+00:00","observed":true,"total_events":140,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (hunter).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 3 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive login(s) succeeded."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,377 bytes sent","bytes_sent":7377,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-02-18T04:30:54","last_seen":"2026-10-22T20:59:13","events_24h":1,"events_7d":5,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"mysql","sessions":2},{"protocol":"redis","sessions":1}],"geo":{"country_code":"MY","country_name":"Malaysia","region":"Kuala Lumpur","city":"Kuala Lumpur","lat":3.1408,"lon":101.6852,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-16T23:47:36","last_seen":"2026-10-21T10:24:29","verdicts":[{"verdict":"scan","sessions":2},{"verdict":"credential","sessions":1}],"personas":[{"persona":"mysql@8.0.33","sessions":2},{"persona":"redis@6.2.14","sessions":1}],"services":[{"protocol":"mysql","port":3306,"sessions":2},{"protocol":"redis","port":6379,"sessions":1}],"logins":[{"username":"root","password":null,"password_sent":false,"service":"mysql-login","outcome":"success","tries":1,"last_seen":"2026-10-21T10:24:28"}],"commands":[],"downloads":[],"files":[{"sha256":"c88fc54bc43e2c1c554f84b1ae54caf8b2fb411f6c6e6a95ddfb29c2f90cd86d","name":"query","size":306,"mime_type":"text/plain","kind":"mysql-query","times":1,"first_seen":"2026-10-21T10:24:28","last_seen":"2026-10-21T10:24:28","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":36,"sessions":0},{"port":1433,"proto":"tcp","label":"MSSQL","count":33,"sessions":0},{"port":22,"proto":"tcp","label":"SSH","count":21,"sessions":0},{"port":3306,"proto":"tcp","label":"MySQL","count":17,"sessions":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":18,"sessions":0},{"port":6379,"proto":"tcp","label":"Redis","count":15,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105d4010005d00303a494c8ad86847f6276a99dd3c5d75c1623d4885c77282bc8742ce66aba230f7b2005523d12f3fe9888f3b91a0529c50067fd097a1e27be5f06691204562bfa2b0e001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056d000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c0c5d832cdfa43555002aa2366f601bca6b17ab53944e0ab9fa2b49fc979794e7525dac06cc3b68f12434de2da0e254c1683117207aaaba3d29de6e6ccd7c622313c570d0b27b8760296c029f7ca35d44a59d3a8c09456b956513a33e3bcbbf8996de65784da27deab4f0409ad25061cd70298a6f01a5b9b8e051c98755b6252036742b22a7da695033989df84a26d964a6dd8a573b1076bf46323e23b4560641bc539b24a4b9e5a4ddb433592f78225430be89c7041013dd742cd12f31ad8d1bfee246b6d8ac871c63d21e37e241801d501667386b585210e6ed4cc664639e2782f5be852285094a848aba9da4030d8a2347586e400b1fbbc985642cf55ba1a785233f4a81132ba8b2422b48593ba8fb809fac732b55812d5540222306f78aa4b3f05c41df2679e4304aad288a13b4973661dc5e9cb81b2592cb127a996197cf6cb4ab948fa2882e4234663b2bee6dc7362d50bd6b74ac57449cbe75ad82953cc26672d3742f42a566617541e824499a31f40655a729c2b56c1140e302a7110cb6d689a9de19df2790714a20f1bfc76b71048830a4ad30452c27a759eea92df0b1a50d9cd8265a4263ac5c1f8c271fc44816970d4e998fb432960f3a020349aa6829339a257b6691fad743581966dd1c2872418865c49aef356a676da684973c18b16856a485daae327f2c727223b64c61b066c8584f834c21ab67a825914d2bcc2f681c32205cabcb06126920e66b048657a4c2b648f1f22580d2c1f2057c542282e74458124a77215c8b7fd664a892b88e0e1c2c5b051d8d48cd93444de13768921072ff7a24c267dbd10ca72c1419401bae4042971c1af91cabbd4403e4ad8a1c1a9ac0e831e07c54d79c625388a5bffa7863523078460a2cf95677d461166bacadb62389c020fca02ce2a0b1d8496c49cc1571d491e94570f3df4108c88cadd40265a401a050447b5873d32b2a9e5682a48686118f1ae763aaf2c699251667389303b7961aef1cbceafa22e9b8434dc71703b42c57bfb93c6e24cb1c76e019742f74168099c5168acb296ea875e1a51f884258c571b8fc76cfe2654382c3136740ef777480c71898cb784d4ec2a90b54f9ca7b7193aabb4cc872cdc2e11043b4ed160a6815fb2e26326f0b308126933468cc1d60a076602d7345267293b01d87eca1925b0649f2944511de7464822331d54ba2d75beb7e7a98c385c397366a02a11e587549cd42cc32243a278172e359d43432cd17019d3538b12cc885b27a13e715bc01217716aa4f9ca506734684292c545ecb6b2f3803d5232122a5639069c6bd03df5c336a7916a4b94809d8b72b6c9a36ccc4cec540b87455ef9f568e49175c98b2cc1f4be5494769a025ffc2568adf89509aa34f7ba87568a32e8c8adfc827fc53ca1f44912a1a2ae57c154cfc84480981a76642b73d31a63fa00d48b2aa3e5c8e66a5b2cf7863836a263478bc8d5770621014af95329b15f934b96abd210aac4053d9b014e5095837643e673b1d5f6b1847bc919fc0d1c287c927b46a7887bcf264b82b31946f283a9207ad9013b6252ae57565ebc81b34e85ae8cac7110c421ec94ab6ff211ed4369f10546eab3a9f557a4cf594506064dc91b18147fc6e7a97b6e083bcd2e1e92b8a6cd71dab77d244b653092ddb4f0a508cd902ca01397b4a6d30ced1620069e3f0f1ee9e27aa1c572ff19cdfb39d1a241ee5e001d00202ca01397b4a6d30ced1620069e3f0f1ee9e27aa1c572ff19cdfb39d1","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":32,"t13i131000_f57a46bbacb6_ab7e3b40a677":3133,"b11cun040_00040013_608dab68":4341,"b11cun030_00040014_54d07b6d":3800},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":4,"ips":4340},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":3,"ips":3798}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-25","count":3,"sessions":0},{"date":"2026-07-27","count":5,"sessions":0},{"date":"2026-07-28","count":2,"sessions":0},{"date":"2026-08-21","count":3,"sessions":0},{"date":"2026-08-25","count":3,"sessions":0},{"date":"2026-08-29","count":1,"sessions":0},{"date":"2026-09-03","count":2,"sessions":0},{"date":"2026-09-13","count":3,"sessions":0},{"date":"2026-09-16","count":2,"sessions":0},{"date":"2026-09-24","count":2,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-08","count":3,"sessions":0},{"date":"2026-10-10","count":3,"sessions":0},{"date":"2026-10-16","count":0,"sessions":1},{"date":"2026-10-18","count":4,"sessions":0},{"date":"2026-10-21","count":0,"sessions":2},{"date":"2026-10-22","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-22T20:59:13","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"help\r\ninfo\r\n","payload_hex":"68656c700d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"1ad2d4b5-8571-40fb-a901-ca832cda3260","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":5,"enriched":{"digest":"f4b1c4ef7eae9ecd","strings":["help","info"]}},{"timestamp":"2026-10-21T10:24:29","port":3306,"proto":"tcp","app_proto":"mysql","app_protocol":"mysql","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"4\u0001\u0000\u0000\u0003SELECT `TABLE_SCHEMA` as 'database', `TABLE_NAME` as 'table', `TABLE_ROWS` as 'rows' , `DATA_LENGTH` as 'size', `AVG_ROW_LENGTH` as 'avg_row_size' FROM `TABLES` where `TABLE_SCHEMA` <> 'information_schema' and `TABLE_SCHEMA` <> 'mysql' and `TABLE_SCHEMA` <> 'performance_schema' and `TABLE_SCHEMA` <> 'sys';","payload_hex":"340100000353454c45435420605441424c455f534348454d416020617320276461746162617365272c20605441424c455f4e414d456020617320277461626c65272c20605441424c455f524f5753602061732027726f777327202c2060444154415f4c454e47544860206173202773697a65272c20604156475f524f575f4c454e4754486020617320276176675f726f775f73697a65272046524f4d20605441424c45536020776865726520605441424c455f534348454d4160203c3e2027696e666f726d6174696f6e5f736368656d612720616e6420605441424c455f534348454d4160203c3e20276d7973716c2720616e6420605441424c455f534348454d4160203c3e2027706572666f726d616e63655f736368656d612720616e6420605441424c455f534348454d4160203c3e2027737973273b","method":"","user_agent":"","ja3":"","session":"ee76e3ef-8d90-4002-ac9a-4be7293cec27-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4d64aee08a30d537","strings":["SELECT `TABLE_SCHEMA` as 'database', `TABLE_NAME` as 'table', `TABLE_ROWS` as 'r…"]},"interactive":true},{"timestamp":"2026-10-21T10:24:28","port":3306,"proto":"tcp","app_proto":"mysql","app_protocol":"mysql","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u000e","payload_hex":"010000000e","method":"","user_agent":"","ja3":"","session":"ee76e3ef-8d90-4002-ac9a-4be7293cec27-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T10:24:28","port":3306,"proto":"tcp","app_proto":"mysql","app_protocol":"mysql","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"O\u0000\u0000\u0001��\n\u0000\u0000\u0000\u0000\u0000-\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000root\u0000\u0000information_schema\u0000mysql_native_password\u0000","payload_hex":"4f0000018da20a00000000002d0000000000000000000000000000000000000000000000726f6f740000696e666f726d6174696f6e5f736368656d61006d7973716c5f6e61746976655f70617373776f726400","method":"","user_agent":"","ja3":"","session":"ee76e3ef-8d90-4002-ac9a-4be7293cec27-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"39a3ec7a272942a5","strings":["root","information_schema","mysql_native_password","-rootinformation_schemamysql_native_password"]},"interactive":true},{"timestamp":"2026-10-21T10:24:28","port":3306,"proto":"tcp","app_proto":"mysql","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0000�\u0001\u0000\u0000�\u0003\u0003I\u0006����i�Y���e-�Ud]\u000e��b8�g��9dZ8f g��i���˰�\u0019Nֽ�g|p��<Z��T���8'O;\u0000&�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0000�\u0000�\u0000/\u00005�\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003�\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 �<'�Vʑ��t���m-�߅��@���+33�:�H","payload_hex":"16030100ee010000ea03034906b2f9bc9969c059fbf8ba652d8355645d0e8db76238b467c6dd39645a38662067c18169b3f6f2cbb0a9194ed6bd95677c70fce93c5aa19054b7e9a538274f3b0026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020ed3c27cf56ca91f2b5749adcf77f6d2de6df85dac640a8b9c22b3333d43ab648","method":"","user_agent":"","ja3":"","session":"e3928645-25c3-48a6-910e-ec5171f8e61a-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"01603be45f3d3502","label":"TLS/SSL","strings":["9dZ8f g","8'O;","8'O;&"]},"interactive":true},{"timestamp":"2026-10-18T12:27:32","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"help\r\ninfo\r\n","payload_hex":"68656c700d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"e1358747-9772-42f6-b6a2-4567cbc0e89c","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":5,"enriched":{"digest":"f4b1c4ef7eae9ecd","strings":["help","info"]}},{"timestamp":"2026-10-18T07:47:09","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"c6165f81-9e7c-484f-9c5b-2d61a45c6779","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-10-18T07:46:38","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1433\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"882a6be6-b2ab-4d22-8df3-cc82b05eae7e","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-10-18T07:46:22","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000C\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0006\u0001\u0000\u0016\u0000\u0001\u0005\u0000\u0017\u0000$�\t\u0004\u0000\u0000\u0000\u0000\u0000��*Qb��K���a����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201004300000000000010000601001600010500170024ff09040000000000fdd42a516287874b8edad561fddedfea0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"a2dbdc23-9911-4e36-9bed-e60d29cc0249","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":11},{"timestamp":"2026-10-16T23:47:35","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"help\r\ninfo\r\n","payload_hex":"68656c700d0a696e666f0d0a","method":"","user_agent":"","ja3":"","session":"a130ce90-1abc-49c9-873d-8620ab4f0b8f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f4b1c4ef7eae9ecd","strings":["help","info"]},"interactive":true}],"http_methods":[{"method":"GET","count":107}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":107,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":47}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:1433","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":2},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}