{"ip":"47.84.102.160","total_events":63,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"30+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 30 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,591 bytes sent","bytes_sent":2591,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-04T20:28:39","last_seen":"2026-08-05T16:07:22","events_24h":0,"events_7d":2,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":8880,"proto":"tcp","label":"","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":3},{"port":8009,"proto":"tcp","label":"","count":3},{"port":10019,"proto":"tcp","label":"","count":2},{"port":7443,"proto":"tcp","label":"","count":2},{"port":12134,"proto":"tcp","label":"","count":2},{"port":12371,"proto":"tcp","label":"","count":2},{"port":3129,"proto":"tcp","label":"","count":2},{"port":12309,"proto":"tcp","label":"","count":2},{"port":9443,"proto":"tcp","label":"","count":2},{"port":10396,"proto":"tcp","label":"","count":2},{"port":8119,"proto":"tcp","label":"","count":2},{"port":801,"proto":"tcp","label":"","count":2},{"port":8041,"proto":"tcp","label":"","count":2},{"port":12172,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b","ge11nn0400_9c3956fad5da","ge11nn0400_ef4d07580f66","ge11nn0300_042112399351"]},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2654,"t13i131000_f57a46bbacb6_ab7e3b40a677":5431,"ge11nn0400_ef4d07580f66":2771,"ge11nn0300_042112399351":3348,"ge11nn0400_9c3956fad5da":1555,"ge11nn0400_17292dadbc7b":2159},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-05-16","count":3},{"date":"2026-05-17","count":3},{"date":"2026-05-18","count":2},{"date":"2026-05-21","count":2},{"date":"2026-05-30","count":2},{"date":"2026-06-01","count":2},{"date":"2026-06-02","count":2},{"date":"2026-06-12","count":2},{"date":"2026-06-15","count":2},{"date":"2026-06-18","count":2},{"date":"2026-06-20","count":4},{"date":"2026-06-23","count":2},{"date":"2026-06-28","count":2},{"date":"2026-07-07","count":2},{"date":"2026-07-08","count":2},{"date":"2026-07-10","count":2},{"date":"2026-07-18","count":1},{"date":"2026-07-25","count":2},{"date":"2026-07-31","count":2},{"date":"2026-08-05","count":2}],"recent_events":[{"timestamp":"2026-08-05T16:07:22","port":801,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:801\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3830310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"07155cf7-65f0-4f95-b947-387d62a3f21a","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":78},{"timestamp":"2026-08-05T16:06:52","port":801,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:801\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3830310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"c85f928c-2f7f-4ec0-868f-c2cb03ca005e","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":78},{"timestamp":"2026-07-31T16:46:23","port":8844,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8844\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383834340d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"0484ad74-e149-42c4-a8f0-d5b502e3f6e5","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-07-31T16:45:53","port":8844,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8844\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383834340d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b723e326-db4d-4704-9f63-ca1985921a2a","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-07-25T10:32:20","port":8124,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8124\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383132340d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"63c0e276-09d8-4cde-be35-b9f7ac3d91bc","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-07-25T10:31:50","port":8124,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8124\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383132340d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"956fff63-3265-4005-b179-4d639c3f4535","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-07-18T02:51:03","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"7bd4d58a-6294-46ae-97bc-f374bdfb2b6b","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-07-10T02:26:44","port":4242,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4242\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"5338b73b-9851-404f-9f91-11bcac10e177","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-07-10T02:26:14","port":4242,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4242\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"e61ac43f-3034-4fa2-bf4b-c19f3137c0e4","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-07-08T06:38:47","port":3129,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3129\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"d21d7091-5540-40c2-b5ba-34e8166f46d6","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":78}],"http_methods":[{"method":"GET","count":61}],"distinct_ports_total":30,"top_paths":[{"path":"/","count":61,"ports":30}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":29}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:801","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-08T06:10:15.155874+00:00"}