{"ip":"47.84.102.79","total_events":70,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"34+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 34 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,452 bytes sent","bytes_sent":4452,"session_seconds":2,"persistent":false}},"first_seen":"2026-04-10T00:09:21","last_seen":"2026-08-11T17:01:22","events_24h":0,"events_7d":4,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":8871,"proto":"tcp","label":"","count":4},{"port":9000,"proto":"tcp","label":"Web-alt","count":3},{"port":6020,"proto":"tcp","label":"","count":3},{"port":3129,"proto":"tcp","label":"","count":2},{"port":8193,"proto":"tcp","label":"","count":2},{"port":16888,"proto":"tcp","label":"","count":2},{"port":8122,"proto":"tcp","label":"","count":2},{"port":12317,"proto":"tcp","label":"","count":2},{"port":60023,"proto":"tcp","label":"","count":2},{"port":8410,"proto":"tcp","label":"","count":2},{"port":10443,"proto":"tcp","label":"","count":2},{"port":9095,"proto":"tcp","label":"","count":2},{"port":12351,"proto":"tcp","label":"","count":2},{"port":30479,"proto":"tcp","label":"","count":2},{"port":10041,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b","ge11nn0400_9c3956fad5da","ge11nn0400_ef4d07580f66","ge11nn0300_042112399351"]},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2662,"t13i131000_f57a46bbacb6_ab7e3b40a677":5327,"ge11nn0400_ef4d07580f66":2777,"ge11nn0300_042112399351":3334,"ge11nn0400_9c3956fad5da":1492,"ge11nn0400_17292dadbc7b":2832},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-06-03","count":2},{"date":"2026-06-06","count":4},{"date":"2026-06-11","count":2},{"date":"2026-06-15","count":2},{"date":"2026-06-17","count":2},{"date":"2026-06-18","count":2},{"date":"2026-06-23","count":2},{"date":"2026-06-24","count":3},{"date":"2026-07-06","count":2},{"date":"2026-07-09","count":2},{"date":"2026-07-16","count":2},{"date":"2026-07-18","count":2},{"date":"2026-07-21","count":2},{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":6},{"date":"2026-07-28","count":2},{"date":"2026-07-31","count":4},{"date":"2026-08-01","count":2},{"date":"2026-08-08","count":2},{"date":"2026-08-11","count":2}],"recent_events":[{"timestamp":"2026-08-11T17:01:22","port":8088,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"8c5fee27-b8cf-4875-9e7b-2611e6fb4a27","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-08-11T17:01:01","port":8088,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"53c2e62c-c841-4743-acf2-19d330859661","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-08-08T06:13:44","port":16888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:16888\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363838380d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"3499394f-f793-4d48-9b6d-a8fd98c88e07","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-08-08T06:13:13","port":16888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:16888\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363838380d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"3ee1f540-2aba-4d77-8dd1-766b4cce08f2","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":77},{"timestamp":"2026-08-01T05:13:06","port":10041,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10041\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303034310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"f52cce50-d1f1-4bbd-8a36-861a11da3a45","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-08-01T05:12:36","port":10041,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:10041\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303034310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"5713d566-3649-478a-bc40-bc7ea3986160","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":77},{"timestamp":"2026-07-31T22:25:04","port":30479,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30479\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303437390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"dc58766e-fe99-4126-8500-02e3f1a26120","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-07-31T22:24:34","port":30479,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:30479\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303437390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"34eaf33b-d1cb-4b88-8402-b9971e3bc0c5","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":77},{"timestamp":"2026-07-31T07:07:42","port":60023,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:60023\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303032330d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"98d2b179-c5b2-442a-a212-8f23413cc51c","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-07-31T07:07:11","port":60023,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:60023\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303032330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"16034963-396f-4f8c-93eb-ed4310277749","seq":1,"duration_ms":101,"bytes_in":82,"bytes_out":77}],"http_methods":[{"method":"GET","count":66}],"distinct_ports_total":34,"top_paths":[{"path":"/","count":66,"ports":34}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":31}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8088","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-14T16:55:23.014680+00:00"}