{"ip":"47.91.29.254","total_events":100,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,839 bytes sent","bytes_sent":3839,"session_seconds":1,"persistent":false}},"first_seen":"2026-03-11T09:45:33","last_seen":"2026-09-29T17:34:45","events_24h":2,"events_7d":10,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":6000,"proto":"tcp","label":"X11","count":7},{"port":10001,"proto":"tcp","label":"","count":5},{"port":3200,"proto":"tcp","label":"","count":4},{"port":3001,"proto":"tcp","label":"","count":3},{"port":49154,"proto":"tcp","label":"","count":3},{"port":15001,"proto":"tcp","label":"","count":3},{"port":8044,"proto":"tcp","label":"","count":2},{"port":1968,"proto":"tcp","label":"","count":2},{"port":10390,"proto":"tcp","label":"","count":2},{"port":12380,"proto":"tcp","label":"","count":2},{"port":8238,"proto":"tcp","label":"","count":2},{"port":8466,"proto":"tcp","label":"","count":2},{"port":8813,"proto":"tcp","label":"","count":2},{"port":801,"proto":"tcp","label":"","count":2},{"port":8316,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc03038c90153c3d6a756384a088a859cce40e45cc6c150938e269cd8582596d59fc532074669b2b3725d9513db9228b13ae49aaab5f247fd5c774893e198c17220ea112001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c0e919048c13123e887748bc35f121936119b432513f5b411970f69a359991444b6cddc251ca61b5bcfccd119977c1538071bb65b65705029a6fd2c1c0253216c7585edf8a8042f299df02c6fed692e6311ef329aaffdc9145b09c2df06f38077d67bb419bb34582c0566caa9a73f8581987b1781432cfd8185722b87b7bc9f98334c21c1cb6708b0a0285a1d851736bc292da6c4d3753274a983b103bf1470b9210780d49679d104129a1890bf7a397d204c8a46d1e9688d24a7b3b88c091b51f9c837476a9bad228762b390b8d870538a02623bb6c08282343cc421c0387b3674498ec94ed8712b5f2afce211a6cf42b8ae4b89c329f36a012cfe057e0e41a13ba398a573430e821b24958c275442fc36e2a9529eb6517a105136de6cc5134a369c23ede465f72026f6121c4457591b5ec091b7249a9dbb3c9b6a0e3164b1954220b2b0c04ab0111f4b020a86f785321466a4923daa6451c7f9145770c90961b08505481802978ad3920684932c15c7458a40059acf89130bb38ea827e09649dab927966b4cfd70021f2b58900bc8a6b75b5ecb489029728f999a5b90789132b91afbb0870087d23b6a2e66acea379b56e37a25c13a17f47025adac6ed29a095833a24d955a12463404912b053051b7265ff79a358b00567b34b1900772394c43baa485f04891f833c9b373fa420c244113013712af7635984d00caa95021d322578920d389c67e0f12b8b77825340ae6e49b4127215a0d459b67a2df2a04dc245b07c34cd9fa22e8f509a1b78938dc43b2853b112210342e34430aa9b698683d4792370536b1dd129b3b131decc93cf98446cc226e1767044fb68bf2934483a0147a22e8122a9cdd058728939f8933f198b730e978a8b5339d00c710fc3a5b5a58ebc96cc57db47e6ba5635f57bb80b91a7a436df921780dab969c80c32db637235652c400992ea3e4168336df2cce45498400c98353b421fe7a521cb83a132be29a80a6d808c76033524f5ac8d7155ee93684ef3ae9a4116b18037f2761755951c95456095d695c18b7169c99288c6043af02cdc58b9f68904763933e02c41314287da7288a55ac47284390b38a5fcd9ca410a0a831a9c8fb077f9c09a6ed7142ce4615ca16dba8cce70bc82d877523f207ea9821211973e0a053cce5638e71608f4b0880d0ba0783a0d94908596b49f657510ca26cdaa61ad80c421cf235c9d964b916226a93bafb90326e8a339f77aa787e429165b0fcb530f0e1cb7af76cc95248684d22c1d12934aa836f349a55148360a2b1226a391ea8c18c252afe115cc5994488da422f99c2e68847dcb69a1e2fc598f61311326c36dc7107c9b63b0896617b36007515393f305e15428b0a55efec406b6f0ce4d930e76dc1091367642a8163578acb73000f2d672d678c8d0225c39765dfcea22f7dcb3786a75c747a78fb4c1e4826a8f9a5517122541b8a4511a1442a04bbe0b5092026dea0286bf07a8cb0b28abec039d21071341ccf153642f98186db78fd69490159418d036826afaaf4c34545b4b69cbd116c849c6c2e2bb641c4f2919c83b5c38e2e100e0e4408df5c061a96abc7507b394a204c42b23c94d493b886b2460c379ad4aac9de354c384d9c43f9f80e03fdd9219724e7fd706b5659ec509ff1f14bb9b5cd7cdf29ca11806dc80fb698e20a8c0629d57131ab7dc5fe3a500536b10b71a501e36001d0020f29ca11806dc80fb698e20a8c0629d57131ab7dc5fe3a500536b10b71a501e36","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun030_00000049_54d07b6d","a11cun040_0000004e_36fbce14"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4890,"t13i131000_f57a46bbacb6_f50d94e863eb":2732,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2519,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2142,"a11cun030_00000049_54d07b6d":2662,"a11cun040_0000004e_36fbce14":1948},"akin_families":{"a11cun030_00000049_54d07b6d":{"head":"a11cun030_00000049_54d07b6d","shapes":2,"ips":2664},"a11cun040_0000004e_36fbce14":{"head":"a11cun040_0000004e_36fbce14","shapes":4,"ips":1950}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-06","count":2},{"date":"2026-07-26","count":1},{"date":"2026-08-04","count":3},{"date":"2026-08-05","count":3},{"date":"2026-08-12","count":2},{"date":"2026-08-23","count":2},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":2},{"date":"2026-09-14","count":2},{"date":"2026-09-25","count":2},{"date":"2026-09-26","count":4},{"date":"2026-09-27","count":2},{"date":"2026-09-29","count":2}],"recent_events":[{"timestamp":"2026-09-29T17:34:45","port":3119,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3119\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333131390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"dfb99711-820a-4dbd-bf12-806daf090336","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-29T17:34:25","port":3119,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3119\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333131390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"a032857f-eae3-40c7-b7da-c1e9904c0c9c","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-27T04:30:46","port":8082,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"c64fec55-4e01-4f18-9179-9baf06a681f1","seq":1,"duration_ms":701,"bytes_in":110,"bytes_out":77},{"timestamp":"2026-09-27T04:30:26","port":8082,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"f32d4b81-265a-4f6b-b3f3-f068a016c981","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":77},{"timestamp":"2026-09-26T15:26:41","port":3200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"147c7194-f635-44d2-8048-9eef4d831e00","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-09-26T15:25:54","port":3200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3200\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333230300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"","session":"75589bca-6b69-4c22-a18f-88f5dcf3b741","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-09-26T15:25:40","port":3200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000V���#\u0000\u0000\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000V\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0003sap730_4016_1\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000;\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0006\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0001","payload_hex":"00000056abcde123000000000000005600000056060100000000000600000000000400000000000100040000000000037361703733305f343031365f3100000000020000003b0000000500000003000000060000000400000001","method":"","user_agent":"","ja3":"","session":"19c9c7c9-a978-4131-89d3-69662c759a19","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":12,"enriched":{"digest":"55db656ae3adf715","strings":["sap730_4016_1"]}},{"timestamp":"2026-09-26T15:25:27","port":3200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0001=����\n\u0000\u0000\u0000\u0000\u0000\u0000�������������������u\u0000\u0000\u0000\u0000����\u0000-                                        win10-client\u0000##\r\u0004##\u000e\u0000\u0000\u0000\u0000\u0000                    0\u00004\u0000_\u0000C\u0000����s\u0000s\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0004\u0002\u0000\f\u0000\u0001�h\u0000\u0000\u0004L\u0000\u0000\u000b�\u0010\u0004\u000b\u0000 ��\rx�7��\u0019n�%�\u0015��s���Q���,!\u0004\u0000\u0000\u0000\u0000\u0010\u0004\r\u0000\u0010\u0000\u0000\u0000\"\u0000\u0000\u0000�\u0000\u0000\u0000\"\u0000\u0000\u0000�\u0010\u0004\u0004\u0000\b\u0000\u0016\u0000\u0007\u0000\u0010\u0000\u0007\u0010\u0004\u0017\u0000\u0002\u0000\u0000\u0010\u0004\u0016\u0000\u0002\u0000\f\u0010\u0004'\u0000\u0002EN,","payload_hex":"0000013dffffffff0a000000000000ffffffffffffffffffffffffffffffffffffff7500000000ffffffff002d2020202020202020202020202020202020202020202020202020202020202020202020202020202077696e31302d636c69656e740023230d0423230e00000000002020202020202020202020202020202020202020300034005f004300ffffffff73007300010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000100402000c000187680000044c00000bb810040b0020ff7ffa0d78b737def6196e9325bf1597ef73feebdb51fd91ce2c21040000000010040d001000000022000000d900000022000000d910040400080016000700100007100417000200001004160002000c1004270002454e2c","method":"","user_agent":"","ja3":"","session":"ec1d15d2-298d-4cf6-8b5a-7f55dee1f9c0","seq":1,"duration_ms":100,"bytes_in":322,"bytes_out":12,"enriched":{"digest":"1b549c425bba8e87","strings":["-                                        win10-client","-                                        win10-client##","04_C"]}},{"timestamp":"2026-09-25T19:05:45","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1337\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313333370d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"fd452454-b738-4915-ad61-a8cb7eab0120","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-09-25T19:02:22","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313333370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"ee2064c7-894d-4216-9126-0f27d309669b","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":77}],"http_methods":[{"method":"GET","count":87}],"distinct_ports_total":47,"top_paths":[{"path":"/","count":87,"ports":47}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":39}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3119","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-29T21:27:09.142748+00:00"}