{"ip":"47.84.104.254","total_events":88,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,534 bytes sent","bytes_sent":3534,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-01T21:26:36","last_seen":"2026-09-29T04:41:08","events_24h":0,"events_7d":5,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":9999,"proto":"tcp","label":"","count":5},{"port":8090,"proto":"tcp","label":"","count":4},{"port":5006,"proto":"tcp","label":"","count":4},{"port":5002,"proto":"tcp","label":"","count":3},{"port":990,"proto":"tcp","label":"FTPS","count":3},{"port":3005,"proto":"tcp","label":"","count":3},{"port":1025,"proto":"tcp","label":"","count":3},{"port":139,"proto":"tcp","label":"SMB","count":3},{"port":3071,"proto":"tcp","label":"","count":2},{"port":6005,"proto":"tcp","label":"","count":2},{"port":8666,"proto":"tcp","label":"","count":2},{"port":5630,"proto":"tcp","label":"","count":2},{"port":9663,"proto":"tcp","label":"","count":2},{"port":6466,"proto":"tcp","label":"","count":2},{"port":18040,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc03039b14150062848bc78d51e45130bae427a9be06940fa2bf91de3114282afd66822004cb9169543df6c16431bb95ae11b4c588d2593d40b183d80927b0cd9b0e31dc001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c0bb94630f8105d49534cb4a0dd29ccada7193e98b8b69aa943570825fb230530c833f11c6f440358950a4562b2af5c240d721618d557c36112f3bf2690d2bcc7944948a536c530116245c36a5088f6a4912c33380a0bb2479b470b3e17e9590996e823acf0c8f8fa4bf98e02821d080b9655db4bb9051945bda064ac83c20f2f54a2fe6bb0d50bdfb0b4b39e59741184aee70311e7011af152e630c60508c87adf3b574340853e8710e1423ed67c086b1a53598019589ae23cc758b2b35eca958eb435a678973c3a32d7ba13994624d025577e38868cc01582f64533d045080c217f387c9586c2320a081d676876a786711d77afd814386ec830faa02c1aba96f2cc14217372ea7368fa25bf00759204b08b6738e9cba6c87115cb8e043df1c0c183244ed9abe7629662456a40b3b539ab503ce08442760ce8ac86f10e47721f96c48f6a031951a53979ee9526460451c71444dd8f4691faaa8a6572370705ab58589d9c70ef9083d47d68c177012af3189fdf5184d74121c6706f82aa4b10108406021489c6bb9da233751cb47ec9cb2987609521c8a387ee20641b039aa09f84f4464a83ec6ae26655c215444d7998c1d7659fa3c0af403008e25b76e276f26d932d773260bd33c8c94bb680c05a4aa819e88b7ce3412e7471398b29b5182a4c70344a644313ba68f29d25d1bf5745e4cab59363effa4131f3c4355982e3e3677ed9bcbcd865b6d8923e5632617ea91311a6757f901a820cedac31607b7021c5b5510852dc38a3fd75233ecfa6236d04b5b904ba7f36ef87686fdb9633ea5c9f9024f99f9be4a17764ca737ad3b1010fbc130414f190472e9b57e5a29ae4dc121f7aa2f4244973338b2d522a88208086ac83184d54ff08408c2043791729d2a81cdcfd644698334930022cca83fc4d1674da8ab5c661758e411233772a77a3651ecb7a72b3c970774be985c17d25646747e69918567759316b8c87380cd70666d13e60d46ea20af206e84d41864f498447222661482e73ac405d21ee1d29f1ad4bddc9c3eab1a45a9103dc28a0a9e0839a7292ee9581ba0c393e8a865f2319d9f60224afa5660bb6fd828564bf4cfa1775a41e959d568c567707f1f9cb6d16aa8f966c05e0aa4a8d809d3c18e71452be4e6c7c9bc2c43a8c78062bd3537284ec97cd272a9f0b1314bc3a42552230c882c89567299f66a8cf1576dc6233b6cb16acab6842a2042cc9de3370836f07de636567090b8398731462091c1635b562046b03795e32992ea4974d4da5d7e7446f0ba627394459f2aa745b41888873a4777b81a945cf5749a8369512bda27d9f7b43c5293bf0b3ccf490cc8316e2eb22e7b454c12fb55fdac2647b3ce85a2137435c00f1c7a9e6221660596f8ea60f4c07de4f9129da8b89ea592a42ac7782a1106567d6232531b447725829f71090945592b09b22a004982330703f3d83bb86318ddab484b82775c8c9da1e460f0ec7e6d9b2fa6c30096dacb11e2854bc5c63c1470189c18cf356ea5c533c935403db34ac62c9e3748b0bc449b74819f40d45cb31109b583b0a8d691c7e7683597b2fb69736a33957a033c16739d058ccf719064e1c53834754e51626ade7647c4930528800e56a794363dedbf330f2e16a30ab989ec19fdca4ee0af2e591fe23a97d70dd5b545888a4e1d60dcf857685d1ba077b4b05a9eb2e2f2fcbbda85d3d84152001d00200dd5b545888a4e1d60dcf857685d1ba077b4b05a9eb2e2f2fcbbda85d3d84152","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b10lun000_00000000_334359b9","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4819,"t13i131000_f57a46bbacb6_f50d94e863eb":2741,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2532,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2069,"b11cun040_00040013_608dab68":4310,"b10lun000_00000000_334359b9":2215,"b11cun030_00040014_54d07b6d":3667},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2216}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-04","count":2},{"date":"2026-07-06","count":2},{"date":"2026-07-07","count":4},{"date":"2026-07-22","count":2},{"date":"2026-07-28","count":2},{"date":"2026-08-15","count":2},{"date":"2026-08-20","count":1},{"date":"2026-09-01","count":3},{"date":"2026-09-12","count":3},{"date":"2026-09-24","count":3},{"date":"2026-09-29","count":2}],"recent_events":[{"timestamp":"2026-09-29T04:41:08","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"b5e2a5f6-0ac9-484b-83a9-5bb58940f026","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-09-29T04:28:26","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"8a0a8b02-e123-4793-b38d-f6665122d220","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-09-24T22:33:26","port":994,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:994\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939340d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"fe6b8002-a0b2-47cb-a2ba-38a5fd2ab7f9","seq":1,"duration_ms":100,"bytes_in":80,"bytes_out":78},{"timestamp":"2026-09-24T11:00:02","port":2200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"3144afae-541e-4bad-81a1-cec9bbe3c547","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-24T10:59:43","port":2200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2200\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323230300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"9c7bd6b4-b1db-48e2-a4d7-2c3a527568d3","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":78},{"timestamp":"2026-09-12T10:08:42","port":1025,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1025\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313032350d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"9ad71892-be9f-4138-a583-ab76b47ff4ea","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-09-12T10:08:39","port":1025,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\\xd\\xaCSeq: 1\\xd\\xaUser-Agent: libmpv\\xd\\xa\\xd\\xa","payload_hex":"4f5054494f4e53202f20525453502f312e305c78645c7861435365713a20315c78645c7861557365722d4167656e743a206c69626d70765c78645c78615c78645c7861","method":"","user_agent":"","ja3":"","session":"236c5007-eca5-4a47-b938-e793ad73c967","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":78,"enriched":{"digest":"f3a191312f765bf8","label":"HTTP","strings":["OPTIONS / RTSP/1.0\\xd\\xaCSeq: 1\\xd\\xaUser-Agent: libmpv\\xd\\xa\\xd\\xa"]}},{"timestamp":"2026-09-12T10:08:25","port":1025,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n","payload_hex":"0d0a","method":"","user_agent":"","ja3":"","session":"ded0518f-9a4e-4479-b0c7-c505e201d5d0","seq":1,"duration_ms":100,"bytes_in":2,"bytes_out":13},{"timestamp":"2026-09-01T23:49:20","port":3005,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3005\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030350d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"eab12646-631f-454c-9df0-a42d7af6ac4f","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-09-01T23:49:00","port":3005,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3005\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030350d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"d4caa0fd-6139-4321-8978-766e294757d0","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":78}],"http_methods":[{"method":"GET","count":75},{"method":"OPTIONS","count":1}],"distinct_ports_total":40,"top_paths":[{"path":"/","count":76,"ports":40}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":34}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9443","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-30T17:18:23.461069+00:00"}