{"ip":"47.84.105.165","total_events":54,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,775 bytes sent","bytes_sent":3775,"session_seconds":1,"persistent":false}},"first_seen":"2026-03-30T05:59:01","last_seen":"2026-09-23T23:05:38","events_24h":2,"events_7d":4,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":18080,"proto":"tcp","label":"","count":4},{"port":9013,"proto":"tcp","label":"","count":2},{"port":9330,"proto":"tcp","label":"","count":2},{"port":5060,"proto":"tcp","label":"SIP","count":2},{"port":12509,"proto":"tcp","label":"","count":2},{"port":8879,"proto":"tcp","label":"","count":2},{"port":12204,"proto":"tcp","label":"","count":2},{"port":8410,"proto":"tcp","label":"","count":2},{"port":12332,"proto":"tcp","label":"","count":2},{"port":7537,"proto":"tcp","label":"","count":2},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":2},{"port":12507,"proto":"tcp","label":"","count":2},{"port":461,"proto":"tcp","label":"","count":2},{"port":9792,"proto":"tcp","label":"","count":2},{"port":4080,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc0303662dd92b5624ab5aea0a1e915e121fb63b5ca5ae24d8aabbce7b6ba2036bc4c920d09f6160ea66f21d63a659f84fe3c31e44f99d4a1f0c774119ca5a50372b263f001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c06947c2be603d89a3bd439a7836f42ac2e8322388bf5510a8fa3c6fa4508498241c1c9a0e5d91c4869756ce2c08da004bc15655e21304958170813148ef157e96e95d25181fd3378552ea2f9bf35cd7f841f99971fd4b5b58765a847105e95b19ff665fa5f5409c04851b385f4040a8452a261f417af01769e63497befa03ebe1133ff4967b6c4b73e8719d608c7a285bd146251f239230f912f6458026cbc7ba833267d60b9c434ad3535ae460790491155bd5abe4637db8458f7d35188ac1b2a5b52df1e33ad8a83f96491f2e497122969d5c7871370b28c4d693b8a23e369b578e4b278e01350ac649b1752a2c411f09dba9ab5011da75942ab025bc624f59b696aa4bae3c2393fa196c573127b9395532a0ad8c074acfd75ac7575ece792e717052734aa0cbe50188e00d143c962df983be5859ab1ba93a6408c2d82ecaa501092a943794ad0509731e378a92f58415268ba11b7ec3b5734090740ac37453667bc5b314fa198a62f880f4d5a22ec102c0cc7c50671161130bbfdc580a8b3469cb4352552a4eb6305e1b72a896409ea06324f68e37989e9388624045cef7040a52819aa2e9aa31e41a459c393c3abeb3122d0b9c0264706702085b6fe496980116d9da69bd76291ea26c9f68ace09445853bb140d88b39c6ab5623c95a1b4881863cb4ba82c1fa2a1a2296d3e644d057952e0c7d4994af67a36354aaccc54c334dfabd10c9b8e0b1192cd12f819b3d334940560078ebf1c799584a8b05608e0b63d4046fea9a2d96f30617f5c98cca8cd69766e4e373e0b251a60c29aa29ce38a9b7f4870957c410eea47ef264708ff876126a7911217726c4cbe35351771a497bc2ce84e7af997c0baa950163f931f9e387eed71a1783cb80164b551b9f71b73e5776bd1c203f99ea74f37a51ee92030afab20adc3fc3a922863227d8337d5dcc652278559b04ca7ac9581d87956ba002dbd935c3b3307e357abd991eef555ced81bd04673132705fd39707f2b154ee022512c774a115428db78366c9a3f1a3cf05f9a21279a61a0bbfc9a537df4c0a9e0bbbfd78b39585067e80296d939ba601a6a54104e9ba02af7773c9595e271ca5a3a08d9d6780e9c24452c4a2b09b1e5cfa2f0687b97680915241b591b7824f2550855111d6babfa9531c83017d1269b09b379c30ba6d5049520b5b107b590c5fda154d3b41338b3a84968b3f842a907917e55809b47c666ba1525121993aa2542b151f737601db74bc57d94fa26a5fd8d79b9a65939629cb10d67ab9cc02822bb508cac4f54a182dabcc8275103cf9b932d55fed671c33323e63bbc63b1576e23c527200ad72772e6123b6e6e25044973f82e676d75b623697ac625b8eb17601d6b7397ada3d11813635f1990dacb3f92358fabb5efc3b182f51aacac302afca7e0ff019dfe27e224671206a7a7afcb434442022b7466a3a360000b68f7c5232b9ab3fc885d998281a1a7a73113b513cb49ba75dc0da888d13497475bf4ea298a27485ab1c8ab6ccc12c183e62319026ac6b0827549f523cbfaa0f1c90118077458c78895d6c2ef05b5d4a799b19201ffe44ade7f99e1d81b5c1ac625767a56e1b5ea76759850c304ba7a690a0900b6c7cfb7788b1e90bf62279bd685411d26d301bb89d5a401d396cd3674a65a08087472bdc8e25fbb38e27d4e4ea7d49333144a284c92d5758a8863d4b9fc411001d00208087472bdc8e25fbb38e27d4e4ea7d49333144a284c92d5758a8863d4b9fc411","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_00000049_54d07b6d","a11cun040_0000004e_36fbce14"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5075,"t13i131000_f57a46bbacb6_f50d94e863eb":2572,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2352,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2473,"a11cun030_00000049_54d07b6d":1156,"a11cun040_0000004e_36fbce14":740},"akin_families":{},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-06-30","count":2},{"date":"2026-07-12","count":2},{"date":"2026-07-25","count":2},{"date":"2026-07-27","count":4},{"date":"2026-07-30","count":2},{"date":"2026-08-12","count":2},{"date":"2026-08-19","count":1},{"date":"2026-08-20","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-27","count":2},{"date":"2026-09-03","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-18","count":2},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T23:05:38","port":30007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"192.3.118.146:30007\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a33303030370d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"596bb71f-079e-4a73-8ad6-b2b449b71cbd","seq":1,"duration_ms":961,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-09-23T23:05:16","port":30007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept\":\"*/*\",\"host\":\"192.3.118.146:30007\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a33303030370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"641a9991-fa8b-4aae-bec4-573a29114823","seq":1,"duration_ms":101,"bytes_in":83,"bytes_out":78},{"timestamp":"2026-09-18T04:32:51","port":8879,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8879\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383837390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"c1dc8221-cddd-436e-9f8d-83e729fe0761","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-09-18T04:32:48","port":8879,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8879\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383837390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"","session":"58dce8f5-dbd6-4541-bced-ba8260542033","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-06T11:39:07","port":7537,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7537\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373533370d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"aa85b224-812d-412b-9336-9b8be0a4291a","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-09-06T11:38:48","port":7537,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:7537\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373533370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"47efee2b-18cd-4ee9-b4c2-e76e206c656f","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-09-03T21:42:34","port":2080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2080\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"ef57e346-0043-40af-b2a8-6a2075713098","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-08-27T01:19:07","port":20001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20001\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303030310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"ac1ed413-af86-459a-b105-3521c1bd6a96","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-08-27T01:18:47","port":20001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:20001\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303030310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"c4d63476-e691-4ff0-87b1-0e4310a7956a","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":78},{"timestamp":"2026-08-21T11:23:57","port":12332,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12332\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323333320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"6bf40888-06a4-40c3-b7d7-4b81f3586ade","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":78}],"http_methods":[{"method":"GET","count":51}],"distinct_ports_total":27,"top_paths":[{"path":"/","count":51,"ports":27}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":2}],"top_alpns":[{"value":"h2, http/1.1","count":23}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"192.3.118.146:30007","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T14:02:24.081827+00:00"}