{"ip":"47.84.117.91","observed":true,"total_events":73,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,538 bytes sent","bytes_sent":4538,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-03-31T01:10:00","last_seen":"2026-10-14T21:37:07","events_24h":4,"events_7d":4,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":2000,"proto":"tcp","label":"","count":3},{"port":9000,"proto":"tcp","label":"Web-alt","count":3},{"port":1212,"proto":"tcp","label":"","count":2},{"port":8600,"proto":"tcp","label":"","count":2},{"port":25003,"proto":"tcp","label":"","count":2},{"port":10342,"proto":"tcp","label":"","count":2},{"port":9413,"proto":"tcp","label":"","count":2},{"port":9248,"proto":"tcp","label":"","count":2},{"port":9952,"proto":"tcp","label":"","count":2},{"port":8180,"proto":"tcp","label":"","count":2},{"port":6605,"proto":"tcp","label":"","count":2},{"port":11920,"proto":"tcp","label":"","count":2},{"port":51005,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":8569,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i131000_f57a46bbacb6_ab7e3b40a677","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc03034264bb7d56130944d3cad93b2ebd71a6dd36b3597837cb3734aebe1a3a5121ed20a1618f1e31d7c4eb4d2a68eab5ac2d2bb917a66e1171cb2a5efbdea5245d8011001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c001c67f324461d8559272abacf7c02ba155820777c583101402bca9827310bea6027ea330b3e4867fc85e364736d3aa274561b074e115f2301f59001754e8a4cc9340a5240cd9571445e61032cb80625290c0ca0e07d386a2d0ccc033c40c848d2b3a82648a89e9b8271356715bf5aa8de5ab4bf635e4ec1d6d225d2a004e9d196f5745986e439efea05ea53810593ca55e97385e702bc4f446ce7b740e252fd07998250055e712a6ea0051d0b610c525863da2b56b346aecf3cac01928bab5cc40a47e7d082db19b01d6faac4be28fdf62b927558116f54587e2bdbbc214b48bad2aaa82239b84779684331c54c0c4b619f74691b1175a275e429b731052c739d026d951a827a34c8cccb8519a8d0259a435bbb9eb37121aeaa8363738db522ff6339bea86b72caa0056a77dab197d8f7ca927842098370913035968ac897d90aa2d7b65d2969208f05b4baa68c6a9a4051974bae1c56e3c57339a5b10d0c398644ccdd2b82291ac8bb0293b1853564aad8c85656cf24891c110980022ae636414d32b46e790cdb93610176ae701a245c836f7b43ead347f9bb43c80aa5015a0c031e20a691427ed06751b360e8e832ae73602da1566559c6e0dc55450c90f1630a8ed195571b5adb6d60d54e79712cb90b55916e02486f5b488f2020249013f98a532c377697eda49af91aae852676d115525d01da2a6329b692d5df3365a3ab1181a4f6c935aa6072d935701f2284844aaaba1621e3ac937f480718e1a011bb53ea34b8dc2e41053abb1eb3544e030a9ac2489fadb89183062e2d27bf4b27c29f7cca419122f288c6523aec120343f58c639a94e3c4bacfa231f46693dd8e2026f96525da838d92417767aca08c3800b77aa4e01cf9ee03709779b2fbaa830f8c87a1198d6838caab6ab3dca44ded28dcce28e5f639ff98842aff9c2e7112f5dc1c83fd817ea31cbfe19a8524521b7683736a58eded94b88894a4c2c5a8d136830731ab880bbcd5307b9eb84bd5b5bab082de34632f488cc9df5b6c0783e80073d2c861747e470e486b3c1895247d130e41a301b1b2938f74dd362bba5157a42db15ced6a4b55a1de55bc3eb88ab9ba11df92b49a22943bb302ebb4131a489149cdc43ec25601086582ed52cc914cd66c669c8b3cf62515986a2487cd09daa509f037b26bbd1939339cdef459ce914a91f901ad9bcc27e00a202f00734d86caa43bd37a6a67fa83483791b80f45bcc8354d244101144442c2753f7f3012a26a8fb3032604981ed72ababf58c978a4b66534a7de2c274d31a1855946c345b4198a7fb71b16a6b843430bab222aec204a638a0b891918406ab75e4901e54122c614c8fabb31e7af5a249b76886f8b7c0c9151fa4c956e81bd3e6cea33b7dd60260dbd6a5af15582148382e998ed8687ffbca51dee75f9276441770990c2209c51abb89c05639ebc9fa370cbbb6c055230d90f2cbd00b965c348e663977cd610181737f5098a96d052896432fb228c007921d65d8c0f2287f8df831def9c8cbb22455786491615691a6984807b87469667199253e14aad8b98a0b202ba3a9af24c44f28847adda72e26a671d4b7a705a041f143976e338670f5cc21e87d74a5456c81f1962ab8d5cc5ad5e937734fa851bb7ad6c48c3e8bc73dc43f4b34a712f7fda22d57e173f24ad67251028a58915b4a59dd2764904747b9a8bdb5f99c1a17001d0020fda22d57e173f24ad67251028a58915b4a59dd2764904747b9a8bdb5f99c1a17","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2811,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2606,"t13i131000_f57a46bbacb6_ab7e3b40a677":3147,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":29,"b11cun040_00040013_608dab68":4371,"b11cun030_00040014_54d07b6d":3719},"akin_families":{},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-17","count":2},{"date":"2026-07-18","count":2},{"date":"2026-07-26","count":2},{"date":"2026-07-27","count":2},{"date":"2026-07-28","count":2},{"date":"2026-08-13","count":2},{"date":"2026-08-30","count":1},{"date":"2026-09-16","count":2},{"date":"2026-09-22","count":4},{"date":"2026-10-14","count":4}],"recent_events":[{"timestamp":"2026-10-14T21:37:07","port":82,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:82\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"b34b105b-c21d-4895-86f0-58e3e447eea2","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":77},{"timestamp":"2026-10-14T21:36:46","port":82,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:82\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"50899017-88b8-453f-bdb0-e613a9658d68","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":77},{"timestamp":"2026-10-14T20:49:03","port":1212,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1212\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313231320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"14054dd5-9171-47b2-af57-414f2875801b","seq":1,"duration_ms":101,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-10-14T20:48:43","port":1212,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1212\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313231320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"67ba1780-21cb-4c2a-8581-3d081a0fcf05","seq":1,"duration_ms":101,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-22T14:05:07","port":10030,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10030\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303033300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"4e8ca080-150b-4fed-8107-6b82b78e17f0","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":77},{"timestamp":"2026-09-22T14:03:10","port":10030,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:10030\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303033300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"1345c065-408a-473a-a516-e292d286d12a","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":77},{"timestamp":"2026-09-22T10:12:30","port":3120,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3120\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"a49f6c84-b9dc-45d0-960e-c42a658c5b44","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-22T10:10:42","port":3120,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3120\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333132300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"976d958d-2fb8-459d-beb0-446ba37fdcd8","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-16T05:33:25","port":8569,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8569\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383536390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"5df6be74-5809-4bd4-80b5-45f803d5ef27","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":77},{"timestamp":"2026-09-16T05:33:06","port":8569,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8569\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383536390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"50015bdb-350b-4599-b1e5-a576dfc406aa","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":77}],"http_methods":[{"method":"GET","count":71}],"distinct_ports_total":36,"top_paths":[{"path":"/","count":71,"ports":36}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":34}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:82","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-15T08:16:48.139943+00:00"}