{"ip":"8.216.8.106","total_events":79,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (hunter).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,449 bytes sent","bytes_sent":3449,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-10T09:19:20","last_seen":"2026-09-11T03:19:49","events_24h":2,"events_7d":8,"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":3},{"port":6009,"proto":"tcp","label":"","count":3},{"port":102,"proto":"tcp","label":"","count":3},{"port":8118,"proto":"tcp","label":"","count":2},{"port":8181,"proto":"tcp","label":"","count":2},{"port":8079,"proto":"tcp","label":"","count":2},{"port":9310,"proto":"tcp","label":"","count":2},{"port":5239,"proto":"tcp","label":"","count":2},{"port":8462,"proto":"tcp","label":"","count":2},{"port":8006,"proto":"tcp","label":"","count":2},{"port":2101,"proto":"tcp","label":"","count":2},{"port":10026,"proto":"tcp","label":"","count":2},{"port":8449,"proto":"tcp","label":"","count":2},{"port":9004,"proto":"tcp","label":"","count":2},{"port":32400,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_f50d94e863eb","t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge10nn0000_000000000000","ge11nn0400_17292dadbc7b","ge11nn0400_ef4d07580f66","ge11nn0300_042112399351"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":631,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2684,"t13i131000_f57a46bbacb6_ab7e3b40a677":5367,"ge10nn0000_000000000000":2506,"ge11nn0400_17292dadbc7b":1478,"ge11nn0300_042112399351":3429,"t13i1311h2_f57a46bbacb6_f50d94e863eb":593,"ge11nn0400_ef4d07580f66":2751},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-06-17","count":2},{"date":"2026-06-26","count":2},{"date":"2026-07-03","count":3},{"date":"2026-07-05","count":2},{"date":"2026-07-15","count":2},{"date":"2026-07-30","count":2},{"date":"2026-07-31","count":2},{"date":"2026-08-04","count":2},{"date":"2026-08-08","count":2},{"date":"2026-08-13","count":2},{"date":"2026-08-17","count":2},{"date":"2026-08-19","count":4},{"date":"2026-09-04","count":2},{"date":"2026-09-09","count":4},{"date":"2026-09-11","count":2}],"recent_events":[{"timestamp":"2026-09-11T03:19:49","port":5239,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5239\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353233390d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"a500c805-dacd-4666-a64e-c7df0c4b30cd","seq":1,"duration_ms":101,"bytes_in":112,"bytes_out":76},{"timestamp":"2026-09-11T03:19:29","port":5239,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:5239\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353233390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"e912de18-4225-46d9-b813-736a61206f78","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":76},{"timestamp":"2026-09-09T04:44:41","port":10333,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10333\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303333330d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"9a6e884f-d87a-4726-b783-d17d5596aa55","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":76},{"timestamp":"2026-09-09T04:44:21","port":10333,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:10333\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303333330d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"d6a43ee0-32fb-4ec6-93c7-e3c4d256c65a","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":76},{"timestamp":"2026-09-09T03:17:15","port":2101,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2101\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323130310d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"caf3f582-7c78-4c11-9a71-f2716feaa927","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-09-09T03:16:55","port":2101,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2101\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323130310d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b2d8fdc7-356d-4505-9ca5-08736ad0df62","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-09-04T18:53:59","port":9000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"579c5435-b46e-495d-8dc3-e273cd53092c","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-09-04T18:53:39","port":9000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"844751e4-ed2c-4d7f-bbae-04077d542e98","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-08-19T08:45:21","port":8007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8007\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030370d0a557365722d4167656e743a206375726c2f372e37342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"9871b457-8d76-4c20-af7a-994d0c3ba4d9","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-08-19T08:45:01","port":8007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8007\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"e840eb78-a378-4789-afd1-c6c16e9063a0","seq":1,"duration_ms":101,"bytes_in":81,"bytes_out":76}],"http_methods":[{"method":"GET","count":75}],"distinct_ports_total":42,"top_paths":[{"path":"/","count":75,"ports":42}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":32}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5239","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-11T10:37:22.139550+00:00"}