{"ip":"8.216.4.78","total_events":81,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,700 bytes sent","bytes_sent":4700,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-08T14:46:33","last_seen":"2026-09-24T15:33:16","events_24h":0,"events_7d":2,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":5},{"port":10021,"proto":"tcp","label":"","count":2},{"port":9497,"proto":"tcp","label":"","count":2},{"port":10071,"proto":"tcp","label":"","count":2},{"port":8854,"proto":"tcp","label":"","count":2},{"port":3080,"proto":"tcp","label":"","count":2},{"port":10003,"proto":"tcp","label":"","count":2},{"port":9148,"proto":"tcp","label":"","count":2},{"port":2096,"proto":"tcp","label":"","count":2},{"port":8001,"proto":"tcp","label":"","count":2},{"port":7775,"proto":"tcp","label":"","count":2},{"port":12183,"proto":"tcp","label":"","count":2},{"port":9081,"proto":"tcp","label":"","count":2},{"port":49152,"proto":"tcp","label":"","count":2},{"port":9999,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105e0010005dc0303a6399127becb739732d887e258064f472c64e7ed4ff1e8fd8a0f4edc87ea2b5520c3fb88ed9178cbdd0492ddd5a79bcff4fe81408f3f5a550161072c258579a039001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000579000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e0904090509060804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c00721bf89bb2b3ccc6717236bcd2a297273a992b029e4a79d615447ef7060f9415c0136b25247cfdef5be09b7cda4218211da1bd7989a9b70a18410ad47f05006b8853013b6e997a54419b18e70ad4b8a392781297b66919b7b9b7cfb7c1097a167fac2b9c842337ccce3241abcb2bc297492477682711a6394b20bd11c70de172a9b95cbc4b5570b3997e90c917ad9476280211e137b8679a0439742eaab35196c0322ebbf52a2357b503d85e03c71243d5532185f74883976334c1bc9512356fc821215f74c2980b5a4dc1caf3230303c7961a820fdb77b36f2298621058310ccc522cb16cc95098c711af270c1d1085709aca035845c31ca3707636661685529ae814b98a501c84385c78de04e2e61b6e8eb0f49162f81310ebae5a301922dd33cc2ada2b940b4c4abf63d98ba5ab9416158353666c228e52a452e9bb71db230b5c9ca5ef95325a4709aa71a4cf877a840798e605679770876b6a16b37b43bb0a8c93aac34121f21928bcd2a08bc079cf1c0a5f1c9c109d36c8217786354614ee8b0b7fa64f7cc78a1b9944d50631061cea04ca33a0ab11ca68c6ae4aec2658dd9bb6b05684e44e1a4c221caaab7961eb8cd73f42f68bb9000b38abaea652855466e284614b95f54babd5a950f48db8ebec77d85265581495b25c03e9822b49a814fe238841b64c89c3c09352001e967cffde8bc3c6038f61559804847353b18e5f72b13c33fd15ca3e341879f850f901b8c5f4984ffb2339bf16f47f71cf83c818d826b440299cfa0487f128760659a2e3528062b43f38c766b3236ddf46c83389f7b5a02dee77cc5ccb15c1787b460c12ea5200df87d2e2142c57b366a91be9e009a366c487a5a34749294978251b5bba9fe3a9d6a1a76c74325f2bc4243a508989b7573d8676fab4b2f319035493e2341b02f59219fa625b72609712596b8b94a9c245c0596525c600ec2819b3c849cd205475b6a60323603ef5c45e6da3c1ffb154e2286fb4116d7c35bb5149079193ce6bc342198a5b410b1366c5b8653bcf57897eec65809627cd1cc5900904a656a59a6d1952e0b9d2fa3856368a0adbc48a03575745079ce687832111b26f84dab64cc9944c0f1d572c27a132376b58ac6afc876c6b3a0626406aeba204fe5c133c729210d5251665167fba8b33be6c6ba48c99489b5a6aa430e75cac38840907505225b9355963a0a1249793536f4a2a70f6c871e7bcc7f358eba113f4f3a1a7c5b1c5adb12ac0b773e12bafc935b6d743dc0e26861026d12c7b512920cfb2528226232355a643d7513afd994bcb9939809926786c9f2f15d9ba405063491ca103af52c58aaa0b8820c5a4b3bc0d88aacef80642efa218485a204975782a5ac666b7a65dc7429a4c92f226ee5b23a49300a83caa16793cc6aa279fdc79894862678817cd46bbf5c53134c8c47cf509015ac61d3ebb34238245016571548257da7a8e6d234ee717d305981fb094026b8578be1b91fd920c64134e043c46947ccc070c4906094caf46cdce76c354a02cda90c117683f01016933914c491361324b008fa34d1c17c32407d93a4207c30041d2b8b598b5f1ad695460ca722005ffda21eb5536cfe88c0608bc2cd61c41a476dc5e5aabb0dd4e4f9cafe7d4b86007aad7fe7d65f5cd06cd02b3d9b768b38d82062c32522b75ca36247c9cb0b090757c4ab79f02a06bef12a6cd4ae6d08001d002038d82062c32522b75ca36247c9cb0b090757c4ab79f02a06bef12a6cd4ae6d08","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun040_00040015_4c87b06e","b11cun030_00040014_54d07b6d"]},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2071,"t13i131000_f57a46bbacb6_f50d94e863eb":2740,"t13i1311h2_f57a46bbacb6_f50d94e863eb":2531,"t13i131000_f57a46bbacb6_ab7e3b40a677":4820,"b11cun040_00040013_608dab68":4305,"b11cun040_00040015_4c87b06e":1522,"b11cun030_00040014_54d07b6d":3667},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":3,"ips":4305},"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":4,"ips":1522},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3667}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-07-08","count":2},{"date":"2026-07-09","count":4},{"date":"2026-07-16","count":5},{"date":"2026-07-18","count":2},{"date":"2026-07-21","count":2},{"date":"2026-07-30","count":2},{"date":"2026-08-06","count":6},{"date":"2026-08-11","count":2},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":1},{"date":"2026-08-16","count":2},{"date":"2026-08-22","count":1},{"date":"2026-08-29","count":2},{"date":"2026-09-08","count":2},{"date":"2026-09-13","count":2},{"date":"2026-09-18","count":1},{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T15:33:16","port":3080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3080\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333038300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"25b193f5-3232-4873-9b9e-67e50e159925","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":75},{"timestamp":"2026-09-24T15:32:57","port":3080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3080\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333038300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"7224b580-b627-41c1-a209-6d53d025d3cd","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":75},{"timestamp":"2026-09-18T07:57:35","port":1002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1002\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313030320d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"425ce913-e242-4515-9b40-9e520bbc0bc1","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":75},{"timestamp":"2026-09-13T13:07:10","port":7775,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7775\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373737350d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"cd4a02e7-142f-471b-930d-91cbbadaba01","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":75},{"timestamp":"2026-09-13T13:06:50","port":7775,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:7775\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373737350d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"ecfa0f6e-96dc-47ad-bdab-1822027150af","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":75},{"timestamp":"2026-09-08T18:15:41","port":2096,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2096\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039360d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"6a6e7f93-6918-4dda-8886-5454c027a374","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":75},{"timestamp":"2026-09-08T18:10:47","port":2096,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2096\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039360d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"53c6501d-42a4-4ac9-9170-0fb6ece08d71","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":75},{"timestamp":"2026-08-29T05:03:07","port":9999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"9a7d1743-095a-40e5-a7fe-424cec6f7a8d","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":75},{"timestamp":"2026-08-29T05:02:47","port":9999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b09f9c8b-817a-43e1-89d9-c25dca0a2777","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":75},{"timestamp":"2026-08-22T16:13:29","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"e7fc626a-279c-4852-86ab-44532f8cb0bd","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":75}],"http_methods":[{"method":"GET","count":77}],"distinct_ports_total":45,"top_paths":[{"path":"/","count":77,"ports":45}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":32}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3080","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T16:06:30.872613+00:00"}