{"ip":"47.84.100.224","total_events":76,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,852 bytes sent","bytes_sent":3852,"session_seconds":1,"persistent":false}},"first_seen":"2026-04-03T14:08:14","last_seen":"2026-09-28T06:13:54","events_24h":0,"events_7d":4,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":9443,"proto":"tcp","label":"","count":4},{"port":7777,"proto":"tcp","label":"Oracle","count":4},{"port":2000,"proto":"tcp","label":"","count":4},{"port":8081,"proto":"tcp","label":"","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":5005,"proto":"tcp","label":"","count":3},{"port":8009,"proto":"tcp","label":"","count":3},{"port":7373,"proto":"tcp","label":"","count":2},{"port":50338,"proto":"tcp","label":"","count":2},{"port":8011,"proto":"tcp","label":"","count":2},{"port":7087,"proto":"tcp","label":"","count":2},{"port":6789,"proto":"tcp","label":"","count":2},{"port":18059,"proto":"tcp","label":"","count":2},{"port":9992,"proto":"tcp","label":"","count":2},{"port":8006,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc03036f0e345706724620efceb728431ac51a41ec73f3ebe8eec84dde6b8324b1112120352010e3295df3f61660dd16869893f7652b55fa3593a53be6c7d6276d528f88001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c01959cf0b6c8340d18f3ee224255103ea999663127be26325cd710f93e1acfdd39ab80a6b873aa7bbe84402c15ef738437be1881bb1cfcdf148f813a6a0da6a91750e9d887ce7435160a610b873ae670cb731259c12c8c55230488cb5c9f16c709424371bc972037c469b91a8be798adf010aa5a764b097833bc85725c5cc211588bd68a77221b29787384299193646c9f3012187fcb6c6731e285a2eeb8946fdb5c260a0b565000e8365840b54a120a75dd6d7210869499a971bf32113ea2a5e88aa85a04cac36a92dae4885629b1f8ee92fa2017e08a10e6cb51f9c7947ad94869301be62b03010c0099419bba9307d1939ac955166d350665dfc7000d66ed6e0bea8f7373a532c463b5199275051a82f7c406e4eb82eda628db7722b96aaa5122a6cf77224d62c7b71811ee523c2494908e034234a2931f67b1d6d769a8caaa13d3016f78abd032c06c259480c72cbb1f75b7434860824c1ce7578cfca55e02600ed706587978cade8caf48c666ca21e93304f05320123f4547a8785e5686c8987ca28481219701baf0932e02b0f00d42914da7e2bc42f4c03b502ec83842c8a52cc414123632fb7a27542b393abc0a3e45605abc61f823aa520c296017e3ffc65c7c16668283dde92362ee66ed95175a54a4b93e83883c6120ea8aee1979440581435379b50f02c9947bdb34b82ee5c358fd5b07af300cc7c5aa94c3a9a331f3dd14e0e392cda7c29acf40aaaac754ff08d0300a10371336f6b2ad1398ca6f246e4912719f06125048726663ad4160626b8053d61c103f24ebd707a41f817e3da7c626439b3775b3bc9a87df4a42f54a88705138c8aba737262bd281fe266229c425d97d8aa3d6b08fce85f806130e7926e13fcc3cec67427800ecd33b969772ecd02c07956354b14a805740be9d30619628dc371a98e84bf3dd53316928c11b86d5b18427a0756c5405db3219330895961c62787eac82ae48d3e0cce74b663ea830d24455946a58453189e34b52817472efadc6b0a3c65fdbcc3f66c410abaa9851b9f7f61a5d17196e5fa920bc635b04a9cb3591fa2db385060107cf571c7288c5728735a81a9c9f86e18829cdd468cb111511d9c55caea96428b0907d4109e832483e7c200504814a571ecc093b40298d63362d711a0c136ba9957b28e182ef3f82b53041bd9872d9c76428c0957b9f220e4dc668b9a4ec61203814a212cf7a5c6d9b1a9d2c766aa916a418be13c3a72a8918a95516b677fb2982b80004cf658883c8908ee39c37aa7a48d716063b3820e916907f74146471790f7c3a85459304b9119a89a25781dc6799d01dcc3fd77ce02fb4c46314dd6189524abc567a5819cb0646373c012234113b70db3a6668d34c83e6705a076c0a1fa2fa01154a2c375018105042b9a5c554cd179a5020703d4ac5ac81267496391738132fd2b8a0388b46840af77f34aa88a092256cca5e2c1f7f96b23655716319f3e6192293bb19f4a42f4f97d9ee671ec2b2bfafc3c51a3a31a846881acc00ba4755fc940d53c230a4015c02133a2e93cc190cf7af2b9bfd9b64a060b41f16bfc01ca1bc6aa61e672b5ba5fa642cef6a042c3f07e38c567c3d8673cc7c78a5a08c245016d0ae4dde766bca9dab6b6b5f70015e9d90ed52458d09fa380a7582200a9898d42096ffcf127c654d7094673a1218e296c62489b8b80c6619b8dc5232aa5d143001d002042096ffcf127c654d7094673a1218e296c62489b8b80c6619b8dc5232aa5d143","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4838,"t13i131000_f57a46bbacb6_f50d94e863eb":2738,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2527,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2086,"b11cun040_00040013_608dab68":4305,"b11cun030_00040014_54d07b6d":3667},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4305},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3667}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-08","count":3},{"date":"2026-07-09","count":2},{"date":"2026-07-12","count":4},{"date":"2026-07-18","count":2},{"date":"2026-07-21","count":2},{"date":"2026-07-29","count":2},{"date":"2026-07-30","count":1},{"date":"2026-08-15","count":2},{"date":"2026-08-23","count":1},{"date":"2026-08-24","count":3},{"date":"2026-08-29","count":2},{"date":"2026-09-16","count":1},{"date":"2026-09-27","count":2},{"date":"2026-09-28","count":2}],"recent_events":[{"timestamp":"2026-09-28T06:13:54","port":7080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7080\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373038300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"ba9d7651-1cb8-42a7-ab4f-de6c822d1470","seq":1,"duration_ms":101,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-28T06:13:51","port":7080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:7080\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373038300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"","session":"41136b46-7f9d-4e9d-95a4-1fdf9d22eae6","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":78},{"timestamp":"2026-09-27T00:52:56","port":6789,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6789\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363738390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"ec0873da-5d55-43e6-9e13-1e03590b47cf","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-09-27T00:52:36","port":6789,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:6789\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363738390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"3b632965-96a0-4814-b606-f61ec3215bda","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-16T05:29:26","port":8809,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8809\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383830390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"ad77324a-b6db-4526-bef4-14d68bdf8ed8","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-08-29T22:37:30","port":8988,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8988\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383938380d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"9d5c31cf-57cb-4c71-beee-81cf6e089c49","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-08-29T22:31:58","port":8988,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8988\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383938380d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"76293ceb-df1c-4ae9-b1a2-7413a327ff05","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-08-24T19:48:09","port":2080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2080\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"010ef038-9c23-415f-b0ae-e93225efc176","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-08-24T19:47:49","port":2080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2080\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"992e77d0-c54e-430c-bd94-8330a851b42e","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-08-24T07:29:08","port":8143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8143\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383134330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"5e18c186-62c7-4c8c-b49d-3da31f9bfb94","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78}],"http_methods":[{"method":"GET","count":68}],"distinct_ports_total":35,"top_paths":[{"path":"/","count":68,"ports":35}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":28}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:7080","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T13:13:53.456925+00:00"}