{"ip":"47.74.51.79","data_as_of":"2026-10-23T08:53:12+00:00","observed":true,"total_events":129,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (hunter).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 6 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,288 bytes sent","bytes_sent":8288,"session_seconds":27,"persistent":false},"basis":"combined"},"first_seen":"2026-02-18T10:42:17","last_seen":"2026-10-21T06:39:10","events_24h":0,"events_7d":3,"interactive_sessions":6,"interactive_sessions_24h":0,"interactive_sessions_7d":6,"interactive_protocols":[{"protocol":"mongodb","sessions":4},{"protocol":"ssh","sessions":2}],"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":6,"first_seen":"2026-10-20T23:33:03","last_seen":"2026-10-21T06:39:10","verdicts":[{"verdict":"scan","sessions":4},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"mongodb@6.0.15","sessions":4},{"persona":"linux-ubuntu@20.04","sessions":2}],"services":[{"protocol":"mongodb","port":27017,"sessions":4},{"protocol":"ssh","port":22,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":38,"sessions":0},{"port":27017,"proto":"tcp","label":"MongoDB","count":29,"sessions":4},{"port":1433,"proto":"tcp","label":"MSSQL","count":19,"sessions":0},{"port":3306,"proto":"tcp","label":"MySQL","count":19,"sessions":0},{"port":22,"proto":"tcp","label":"SSH","count":15,"sessions":2},{"port":6379,"proto":"tcp","label":"Redis","count":9,"sessions":0}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677","t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030105d4010005d00303ade706df016a353af03d92c06bf96f9476d1ed9a209afc236d0d6ebbc7308dfa2047d03203fedaada392ebf57ee2108323eb9fd11b7500b56929a81d2dd820e69e001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056d000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c016086d3e0735c977847695c20f04c56129bf59bc423ed78d40b046a49a261e0c8dd8cb7ae1a9c1c30b5426986b7b89b07e63b8364661d956536d386eb170307dc983fe5259c8757ef9490f1b5a193e15579ed1828e5185ac085b5f7b2eb4d9c7a2e7b35710868be6855405bc6fcc803d01832963015768b952ca8ac5540191cc9fcc39454448cbcf1512bc52c51ef4c7de4ba43ce2508cf59cc27ab2bcc759096bad305c9c24345c740982288bc03a571c82e23990840b3eb80bba17b9fa269825bc6d634b303f727b3f51614f38481fd13b72bb8498e0b5bd667f9030cf830a682e22abd3cc5aa512221d1b2bda1c4a21088697f41377597a0accaa0c0a03c7b73c8b886c2fc36507784ccba535dac28691341e935977e165aa67d435e5c223061ac5a9f13de8fcb187961e3e447d3082c69b5a6cfd3440e279b01c673153793c72a495c6006d5f113ad1bb62be349dd0c04bf583b9f2f72a26b67b841611d83397eeb5cda15056ae649aca6667bc47cf45c933d4bb56fb9c19bc276d7f747e22b4557f3651bcc60acb039b3e853cd9b690c79966b7357e32d7581168257116197ce738cf5aba76463fa7814d56641f73c8325c424a8951b0e8f0c15db60714595323732878f6904b671845e7af6c96830b94493d8b5e71c35a3770557e566e33d7b814878302f671f159cc315b712427c162e855f84229a4a6b1364b2ddc864e22f6666cf1145be1c530f51232cc07bd0c9a5335733b315ff800b3896122732b606f8cc395102603652636e74c49e590a18b121ed22b16c533fb0a8a4ceac188d4b5a4d4009355afc9e550a721aa44ba311d2093faa880aff822c605a6784b31426932cef13d824743eb1623de34a20f0ac405423b4be37b9d45109b8b4f95f008b29b1108604d6df96d9e27cf14372ffd0c09e55336bd7139dca104cb97996aa99558d33f223c899a42b138a26faf889d5ff66045473db95b797986834c19b31c61810b974a7a336a9e72bfbd595741908a035191e3788e8508c124559008f7a4b1841d1e40bf4d1295d6606d9b6ca550f4879dfb0c93f26cacc878352c8ddfb917ed851ffd9bbf3a047bbbe651d15220fd4a3f83c2894d706736c7a928a3a7d6e8495595c9589402ce64aba7864b1cb69824978b76ea27525b9025e2804546355a2c4fe13474933a42da649e99e3c5f62c97566a52c9b5a4fc4a76497bc51e6819c97aaf8bc07828d77d38d3a6a026c8b2d57927897de9a39c96f81ed31c23dc31a2e8769bf9f91acb47b477a60e6c133eca78c9ff4c457bb594cc2586f9138f64d1acc146c2ea9448636032daa248078a2e0b0622f2d4c52f5676870a527267a77f833aa656109c142819008949b0300eb39cccfa0a362c6e88c578fd4781b8c88597474d0e23bcfc729d1a451bc19c0cdc23a76acc66176584f9d20d62ab02241106d731aa4a6aa84fd9ccb8a333ee0299e1b5506ff06a7f530a77b87a5477c509741cd156c6677279a34170422982f5281ad1a03a7d8b5fcd00cb0c820189b06282a4144bb4ccefe968e3995bc9bb965146b214d9addc563a5fbb6ef439a1da8c4b6324a965f56e83f5942294c63559326f66aa5526cb13c5be56b00ca8c124adc2aece461f1279061b34675810d95c0ec9ff2e0c6b07f90e2b90d9709b315084854d74999ffec5259d2c34b366fe473a381b44f1766666520a56f24b001d00209b315084854d74999ffec5259d2c34b366fe473a381b44f176666652","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d","19e29534fd49dd27d09234e639c4057e"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"]}},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":32,"t13i131000_f57a46bbacb6_ab7e3b40a677":3133,"t13i190800_9dc949149365_97f8aa674fd9":3234,"16443846184eafde36765c9bab2f4397":47,"b11cun040_00040013_608dab68":4341,"b11cun030_00040014_54d07b6d":3800},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":4,"ips":4340},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":3,"ips":3798}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-08-02","count":1,"sessions":0},{"date":"2026-08-04","count":2,"sessions":0},{"date":"2026-08-10","count":2,"sessions":0},{"date":"2026-08-20","count":2,"sessions":0},{"date":"2026-08-23","count":2,"sessions":0},{"date":"2026-08-26","count":3,"sessions":0},{"date":"2026-08-30","count":2,"sessions":0},{"date":"2026-09-02","count":1,"sessions":0},{"date":"2026-09-04","count":3,"sessions":0},{"date":"2026-09-05","count":2,"sessions":0},{"date":"2026-09-06","count":2,"sessions":0},{"date":"2026-09-08","count":3,"sessions":0},{"date":"2026-09-09","count":1,"sessions":0},{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-26","count":2,"sessions":0},{"date":"2026-09-27","count":2,"sessions":0},{"date":"2026-09-28","count":2,"sessions":0},{"date":"2026-09-29","count":3,"sessions":0},{"date":"2026-10-04","count":3,"sessions":0},{"date":"2026-10-07","count":2,"sessions":0},{"date":"2026-10-09","count":1,"sessions":0},{"date":"2026-10-10","count":2,"sessions":0},{"date":"2026-10-11","count":2,"sessions":0},{"date":"2026-10-12","count":3,"sessions":0},{"date":"2026-10-15","count":7,"sessions":0},{"date":"2026-10-16","count":3,"sessions":0},{"date":"2026-10-20","count":0,"sessions":2},{"date":"2026-10-21","count":0,"sessions":4}],"recent_events":[{"timestamp":"2026-10-21T06:38:44","port":27017,"proto":"tcp","app_proto":"mongodb","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"=\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000����\u0016\u0000\u0000\u0000\u0002buildInfo\u0000\u0002\u0000\u0000\u00001\u0000\u0000","payload_hex":"3d0000000700000000000000d40700000400000061646d696e2e24636d640000000000ffffffff16000000026275696c64496e666f0002000000310000","method":"","user_agent":"","ja3":"","session":"fc7fbb93-8639-46d6-9790-7af6f640556d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d4f7bf8d8f047cb0","strings":["admin.$cmd","buildInfo"]},"interactive":true},{"timestamp":"2026-10-21T06:38:44","port":27017,"proto":"tcp","app_proto":"mongodb","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0005�\u0001\u0000\u0005�\u0003\u0003�ȁ�L|B\u0000B�O()\u001c�i��{6q\u001ds��I�'� �a\",��A�ju��N\u0017s*6m�[�<=ϋh��50 �\u0000\u001a�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000�\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011�\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004�\u0004�\u0011�\u0004��1����)\u0010�r���c\u001cr\f~���MSY���M���Y�Oc%�r'[s\u001b�\n\u000f�ڙblO.���\u0012\u001d�XVP��gT-��\u000f\u0015�\u0002A�]�� j\u0007yW<��c4b\u0005�!��2���RO�*T�9!e�)}�6�cLt��I��\u001d�F}�>0L\u001f�Z$e\n8X(\u00182�0�\u00133\u0001�p\"5\nY\u0007�ʳ��d���\u0005.�b|��A�E�a��H��ba'�!F��`�\t�,�\u0014�%\u0002��l�2��\u0003lB�Bj��\u0002\\<� V\".̊\t2��e�+q6\u001b��k�a\f�J����9�P��,��\u0017\u0006+��\r�\u0002�<�a��`\u0017,V~g��(\t����'k����)z\u0007j~����(\u0006\u0004��\b�;�JYbOæ^��jkt���!_\u0007g\u0014�f\u0017�_I�r�2;��]5�.��\\��Q=⫸\f\u0006�`W �l�j� �UR�1\rX�L�1�,D�\u0016�7sT�T\"���Es��\u0016/�\\\u0017gUI~����w�\u000bs�\u0002�\u0001��\u0014�,��6�)�?;2F���9/r�)ʐ\b��§��C�V\f�\u0004�,E�cY�H��`��W�\u000e�%��`2������Fk��2\u0016쯹�BB����#߇0�\u0001\"2�zV��i��_5�:�\b\u0015�6q\t\u0007������:����\u001d�49���>��Lw1�\u001aD\u0017b��<�X�\u00023!\u001b'x�iRX��xy�\u001d��]��MXSNT��Y:�P�\f�D\u0001)ڻ5�S����a¸�z�9f�۬�I��ӛ�D�^za\u000f�Zyiy.����\u0014+�g`�\u0006M@�顩a��,�Ni���\u00125v\u000bS$�c\u001aR�[W\u0007tĐ�G:27017\r\nUser-Agent: curl/7.64.1\r\nAccept: */*\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a32373031370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"4c63fa8e-7d25-49a5-959e-030f7219b291-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e780f2da48da501a","label":"HTTP","strings":["GET / HTTP/1.1","Host: :27017","User-Agent: curl/7.64.1","Accept: */*"]},"interactive":true},{"timestamp":"2026-10-21T06:38:33","port":27017,"proto":"tcp","app_proto":"mongodb","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0000�\u0001\u0000\u0000�\u0003\u0003I\u0006����i�Y���e-�Ud]\u000e��b8�g��9dZ8f g��i���˰�\u0019Nֽ�g|p��","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":3389\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a333338390d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"afdd2088-375b-4e17-aacb-14802d6b53dd","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-10-16T22:47:31","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"host\":\":3389\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a333338390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"894e6cb0-5b21-477e-8566-85608e94394e","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-10-16T22:47:15","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"eba96090-b758-4ab0-8374-926a1ac65b61","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-15T19:33:11","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":3306\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a333330360d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"b14ed937-41b3-40a8-aef7-24224394adfa","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-10-15T19:32:41","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"host\":\":3306\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a333330360d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"2e32348f-930d-48f7-b608-6420c2bc56e9","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-10-15T10:23:01","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":3389\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a333338390d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"ea4552e7-6b60-4743-baa3-023032c8d874","seq":1,"duration_ms":101,"bytes_in":111,"bytes_out":76}],"http_methods":[{"method":"GET","count":101}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":101,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":44}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":":3389","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[]}