{"ip":"47.88.15.30","total_events":84,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,653 bytes sent","bytes_sent":4653,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-10T06:54:38","last_seen":"2026-09-19T14:01:57","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"","lat":34.0544,"lon":-118.244,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":9999,"proto":"tcp","label":"","count":5},{"port":2222,"proto":"tcp","label":"SSH-alt","count":5},{"port":8554,"proto":"tcp","label":"","count":3},{"port":18000,"proto":"tcp","label":"","count":3},{"port":9044,"proto":"tcp","label":"","count":2},{"port":7170,"proto":"tcp","label":"","count":2},{"port":9041,"proto":"tcp","label":"","count":2},{"port":12246,"proto":"tcp","label":"","count":2},{"port":8097,"proto":"tcp","label":"","count":2},{"port":15800,"proto":"tcp","label":"","count":2},{"port":9231,"proto":"tcp","label":"","count":2},{"port":9088,"proto":"tcp","label":"","count":2},{"port":50997,"proto":"tcp","label":"","count":2},{"port":8082,"proto":"tcp","label":"","count":2},{"port":9218,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b","ge11nn0400_9c3956fad5da","ge11nn0400_ef4d07580f66","ge11nn0300_042112399351"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2420,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2211,"t13i131000_f57a46bbacb6_ab7e3b40a677":5190,"ge11nn0400_17292dadbc7b":1619,"ge11nn0400_9c3956fad5da":1527,"ge11nn0400_ef4d07580f66":2736,"ge11nn0300_042112399351":3416,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2558},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-06-28","count":2},{"date":"2026-07-02","count":2},{"date":"2026-07-03","count":2},{"date":"2026-07-15","count":2},{"date":"2026-07-23","count":2},{"date":"2026-07-27","count":2},{"date":"2026-07-29","count":2},{"date":"2026-08-06","count":2},{"date":"2026-08-12","count":4},{"date":"2026-08-18","count":2},{"date":"2026-08-19","count":2},{"date":"2026-08-23","count":2},{"date":"2026-08-26","count":2},{"date":"2026-08-27","count":2},{"date":"2026-09-02","count":4},{"date":"2026-09-11","count":2},{"date":"2026-09-19","count":2}],"recent_events":[{"timestamp":"2026-09-19T14:01:57","port":5495,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5495\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353439350d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"38693cee-4392-4b28-91a6-ff5455ce4a3f","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-09-19T14:01:37","port":5495,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:5495\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353439350d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b32bbd77-a704-47e2-b4af-28a6e5b37b12","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-09-11T22:14:58","port":51001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:51001\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313030310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"d141f038-6224-44bd-8584-4c726b7736bc","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":76},{"timestamp":"2026-09-11T22:14:38","port":51001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:51001\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313030310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"73a1b4b7-cfbb-4c47-8ae7-b699c0eabb0a","seq":1,"duration_ms":102,"bytes_in":82,"bytes_out":76},{"timestamp":"2026-09-02T22:57:26","port":5431,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5431\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353433310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"6c1da9f0-7adb-460f-bca5-19d44795b6aa","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-09-02T22:57:06","port":5431,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:5431\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353433310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"040497b7-f025-48b0-a1f1-65bd5bda6f91","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-09-02T04:36:55","port":9218,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9218\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393231380d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"6d3ec00b-3fb4-4e2d-b1f9-c90626269f1f","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-09-02T04:36:35","port":9218,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9218\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393231380d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b189ae29-9078-4670-96dd-a3437df9b1f2","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-08-27T14:11:32","port":8436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8436\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383433360d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"42e0f1f0-b6df-4d90-be4b-65a7d7824915","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-08-27T14:11:12","port":8436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8436\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383433360d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"0ea97f74-0c93-420d-bb2b-d2e8a4f49f1e","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76}],"http_methods":[{"method":"GET","count":77}],"distinct_ports_total":38,"top_paths":[{"path":"/","count":77,"ports":38}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":38}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5495","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-21T11:33:18.097610+00:00"}