{"ip":"47.89.193.98","total_events":105,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,820 bytes sent","bytes_sent":6820,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-02T17:57:15","last_seen":"2026-09-28T23:23:22","events_24h":0,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"","lat":34.0544,"lon":-118.244,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":30120,"proto":"tcp","label":"","count":4},{"port":6666,"proto":"tcp","label":"","count":4},{"port":3120,"proto":"tcp","label":"","count":4},{"port":515,"proto":"tcp","label":"","count":3},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":3},{"port":102,"proto":"tcp","label":"","count":3},{"port":11082,"proto":"tcp","label":"","count":2},{"port":53482,"proto":"tcp","label":"","count":2},{"port":8001,"proto":"tcp","label":"","count":2},{"port":9107,"proto":"tcp","label":"","count":2},{"port":6010,"proto":"tcp","label":"","count":2},{"port":9010,"proto":"tcp","label":"","count":2},{"port":12323,"proto":"tcp","label":"","count":2},{"port":10704,"proto":"tcp","label":"","count":2},{"port":4431,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc03037542d8d5035bb98a8cebfa6fb73eddff2d7aef45a246b0d9d3ce448e5e48b29a20ede0a694539311af008552f2e69cc6ef2c32d664dc8e94e81cd034dce96a00a4001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c081b3701d7a2410c42cb8133f6e973903da7625833300cbbb71f809528c8e3c25a1393817f188296f0c95df7a40bf921f7f28b23d95252a5463b6105db3d6186a4028b2b01bdf3c07328224da31ad7ca760b1c5a7b59a7802226e1c98217690ac8798c6c552aacc58caed69bfcb7b41127a3b5095ce2e84704cb70a0a843610fc7f9cd4b892140ba8fc856208385535c8357a7b9937466dd0a787ac120489407d2076de9b92bbe0c362a6c297f8398ee846ffaaaaebb1141434ae96a708098362b51091e163611435211204cd5bf734e8945bc4654f919bb1e879cbb74334d1f72976570decb2b0819ca2653839652669f0bc97aebabb738a79b08ab3bf5409b8a62dd43a485237a5cf4aa9a766cdd03a95a4b6170bb455d0a61213c47b83520223033db8841689256e420bc0ecc9069de3cd422687a7174e76a6559b6833e493aa64516952d63d9627764ba8cd91056c3f8bbc41f38183f9ab425c738bbc122203a40d4353b6d45550645f52e1b7856849734ca8951527b8875ccf738602f2329820747d5882ac2c597f960502808cf5498c9e56b150062da74c1adc925d16146302bc0de9654be3b737d602729b04157282ccb8b45b044b120e6b6af6d95f7dc901975c129fc05e7649a0ae931980e58dc29a751328102b6925c6a1c5ee729cb400cee639bda128ad9e446a92566f86887935934db9fb3e62f30bec357fad28825858a5e73bb6a8d9009d9c7bfdc0007ef07f4ef4063f18bfd53c4be843480d11c2d8e9110edc113c764c5c052ea6c8395bbc90effab1d12373432307c4433719561b7917532060549737aef4ca49cfe45bb37aa93d9b2527414a72269c99759aa4c24444782a7df9b4af88ce08d715b10c4961e9ac892c76315b6e54376b2857aacf2295e7316f2e2720691b84011014aef847cc124b44e5292771cea6d1abfa71868673ac23b492124a475cc05ca471a88599bdd6165d7e1849f879884ba725816826993039848c3c59071f8a455f66dc2221588b2d01765583a640e88130077bd91647b46c57f8fc89ba8a9142b289a387ab99d9a337ba18ac87297376bacad72e1bfb234e069a19b6ad2c2a0d01539c94a38d187026dc7b22a3721c75196b2b5271f2f741ecb36b258c4a7074003c2a2f7db585c36218cec108bbf936fbd4ad5d34b1eec9738ff5aff5d867270414412a33c0e8a08ad160d0781080f1a80981b3837370be09704c5a8cbd00a45f9a73e5b1b7a57b2e1c4117a8bb63501ba2a0fa22b690394d81924be33592934e3ecb4d66485e657a98992697e2e041d1292e43da7d4b93cd4248ce245b1dacf63bbb83786da7646543676fb44f03e8018fb541378acfc4c2a5d1babbb58773e9c586df77c1cfe32a16e127fd540762c911d76136751ab27560028d4356a5d66172d999d63ca55ce097dab3ba4fdb6e2d7158ed9b23eee94ae9fba799bc725fbc5ad342b9618b25122bb634d973a5b8c57c674292b95335e0989ed0972e2614561431d4b771435cc2c990aa6a04109dcb69d18c7352b5062e997f97e530fee743f6dcb3cf826fabb0ad8f11721210b9b4f20a3b043d8a6b76c0521c4bd91cab29647ccbb2da69bdac8501cbf2cab0806b20ca84c31b9843d4fa3abdb082876e3b8fd823b016f70f9360f5c159ee512f8d4804bce75f89b7fc0dc55941d40f36866ce07349088c976951e84d4a915fd25d001d00204804bce75f89b7fc0dc55941d40f36866ce07349088c976951e84d4a915fd25d","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun040_00040015_4c87b06e","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4842,"t13i131000_f57a46bbacb6_f50d94e863eb":2738,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2526,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2086,"b11cun040_00040013_608dab68":4300,"b11cun040_00040015_4c87b06e":1521,"b11cun030_00040014_54d07b6d":3667},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4301},"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":4,"ips":1521},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3667}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-03","count":3},{"date":"2026-07-12","count":2},{"date":"2026-07-13","count":2},{"date":"2026-07-14","count":2},{"date":"2026-07-16","count":2},{"date":"2026-07-22","count":4},{"date":"2026-07-25","count":2},{"date":"2026-07-28","count":2},{"date":"2026-08-03","count":2},{"date":"2026-08-06","count":2},{"date":"2026-08-07","count":2},{"date":"2026-08-12","count":2},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":2},{"date":"2026-08-18","count":2},{"date":"2026-08-21","count":2},{"date":"2026-08-25","count":2},{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":2},{"date":"2026-09-14","count":7},{"date":"2026-09-16","count":2},{"date":"2026-09-19","count":2},{"date":"2026-09-23","count":2},{"date":"2026-09-28","count":4}],"recent_events":[{"timestamp":"2026-09-28T23:23:22","port":11082,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11082\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313038320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"8a03f7ff-1d2e-44c0-8d54-d36226da077e","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-28T23:23:02","port":11082,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:11082\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313038320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"7fb2e96e-1216-4a2d-a691-1c4e842e6cab","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-28T13:19:00","port":30120,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30120\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303132300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"dc643895-3c20-4791-90c3-e59b9ccdb857","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-28T13:18:40","port":30120,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:30120\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303132300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"0899fed8-796f-40e4-be2d-d293e3f3527d","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-23T22:39:55","port":5269,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5269\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353236390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"092e000f-3819-4ccf-bb1f-1dbe88223b21","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-23T22:39:35","port":5269,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:5269\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353236390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"388a7e12-a468-4e1b-8722-e4b87bcc702b","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-19T08:21:54","port":8002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8002\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"cb0784d6-79ad-4e9e-a831-9585621f1525","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":77},{"timestamp":"2026-09-19T08:21:34","port":8002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8002\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"26ecd17f-73ff-4e91-afc2-2275097613c3","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":77},{"timestamp":"2026-09-16T13:32:57","port":12519,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12519\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323531390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"1454f309-9690-4092-b18a-7946e1a9b119","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-09-16T13:32:37","port":12519,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:12519\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323531390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"127b3f17-8296-48d1-93fe-24fc33761b7b","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":77}],"http_methods":[{"method":"GET","count":100}],"distinct_ports_total":48,"top_paths":[{"path":"/","count":100,"ports":48}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":49}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:11082","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T12:22:25.566358+00:00"}