{"ip":"8.221.136.6","data_as_of":"2026-10-23T08:52:24+00:00","observed":true,"total_events":130,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"hunter","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (hunter).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 3 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,132 bytes sent","bytes_sent":7132,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-02-23T16:37:15","last_seen":"2026-10-20T14:58:00","events_24h":0,"events_7d":5,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"ssh","sessions":2},{"protocol":"mssql","sessions":1}],"geo":{"country_code":"JP","country_name":"Japan","region":"Tokyo","city":"Tokyo","lat":35.6893,"lon":139.6899,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":["hunter"],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-19T12:37:46","last_seen":"2026-10-20T14:58:00","verdicts":[{"verdict":"unknown","sessions":2},{"verdict":"scan","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":2},{"persona":"mssql@15.0.4345.5","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":2},{"protocol":"mssql","port":1433,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":1433,"proto":"tcp","label":"MSSQL","count":43,"sessions":1},{"port":3389,"proto":"tcp","label":"RDP","count":28,"sessions":0},{"port":3306,"proto":"tcp","label":"MySQL","count":22,"sessions":0},{"port":27017,"proto":"tcp","label":"MongoDB","count":18,"sessions":0},{"port":6379,"proto":"tcp","label":"Redis","count":12,"sessions":0},{"port":22,"proto":"tcp","label":"SSH","count":7,"sessions":2}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105d4010005d0030335c9061da182ddf7f8971fca59aa8177b201e968b0c51d368c24af690773ed49204a9d0e91a2a4862bad36503d8f6ae1da59d65d7dc5b384ace6a43e41ce1aad22001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056d000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b00050403040303003304ea04e811ec04c017f70f6274733274b4bd05b7c9768df0aa05332607e6643d0c38caa18689d37555c8c312f365042b6245db672ee1b560d86100b3c40b4fea192ed97cbcd0b4aaa4a7737888ff3594407823ec6068d25685c9ca52e1cc00673cab42ec59e5b3ba40ec7bc08c8709a519e50b55b6c76f191a67c65a4b7e3907b35332236b6b38d204fc858b9b83be562577892a6d4280175b0248dd53bc5ed1858ad4095ac910bae85b52f505ff3849fac352ca54652c8583468a6428586a218a4d7b926950b38ddd15bcd0c14ee4fa421db503295b12efe750496b6475a5cad7b409d7b32734bc5bc754bf099c9cff5912bbf020c3a21e6f433b84996d2f782c0e94bb08827c61a04ee12c9b03437b707675c1a3462daa7a0971ae240826cd166c586b9010c4206cc5692d27a33df97721479a5e4834b1e11285a85fc400b6e7c060ee058e9d9b67060454b6a511f8e1b599e6a9dd06acf2da83aaec7147d3515e4772110b7bcd5032a953b01e5b95442cc64ed1627339c3c0350c100369507ca3ddc2816f347e7469a33d32b680b3a9e1332bb9d6149a882556736ea6e11c8894266af1c8dd1497bb794d72494794015435a98125da6518e555d4789cd3d41678557151c344f75829cb7a3681539c766caaf5c9289cd57bcac163f38c8a12eacedbc4b916c787d6e383b2a845e4b1c05b8c30179c0934e0695d0446fc7216b8aa8fe79cab6f80230a3a4b09c79dee822acfc733ad466640816784f338015cc66a416d5346406b09c81e69460b2b024a53804f7c286e22cee4fa226d207a1cc60f4dd07b7637a1e56c74077bca2131bf35f73e8eb35937c37a44bc4979b67fc9d576a6385b40dbcf64ab10527c79d1c8cb9c9682ff977b03926b013a1ee3caaee1208b14898ef9e4cc9f138e88b038f93440ea35cb3ecc641091bcad04a1795b7d81fc3998848b4d5468effc16d5175110c6686936a990b0c9099667f09034167b7247b66caf414df0fc2e954347bf2cc044e5ae9283230d11817bd07f65296fb7e988d74436feb7225cbc1608d015eb109f2f4128752c1d26c71a4646663803ad27713316c3bddbb6c10d8aa9287a3ae2d08776b761cac0182fa55f23f9832fd44919241cb070c1d7c4899b01c86d5916081035a9751d3278189a47405d01229f957e5db297ed718eafcb82cb116ed5621ab147505b3307044306ac809f05a88d7a388edb228a1b1895e0e3377f515719a94914c1a70fbbaf6496598c556c42a6b3850031e3cb440c8c0314b606d6a106be26a8ddd19382285d8b04632b2ac703677b38b8876dcb86f0c39f8a250c24d30054c57c26f80b49768ddd84088955915b975307b0814acc1ac8091443971151a8452a5ca0b031950c5607e320b3d688c27303b1fd43b1b21387969a8be6d52399ac3dfe4125ae5c0e1a35669d790e854c805f79caa1a7c29650274665a4ae93470f778f0598ae99593b6c5c6e68e7cd277512a54791a2760af016b24d07a48a31c831447b87e64228e366b0183d9ed01f0cb8827c89a294f53a2cd9048477117f900fc4913b49e977907702ea23452ce729332020e424aa32ea894516cf146383d1eb938c4abeaed92a3bcc425481aef4011a7fb6083b2a8a8d8c79121e9a7fc4b8a39bb3ebfb927cc4c5cdd055faafaff029c260a0aa6eadae9538b414106e08fac7ad078f0e6a3a7e2d9d7d810541e1b8a908811b001d0020aa6eadae9538b414106e08fac7ad078f0e6a3a7e2d9d7d810541e1b8","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3133,"16443846184eafde36765c9bab2f4397":47,"b11cun040_00040013_608dab68":4341,"b11cun030_00040014_54d07b6d":3800,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":32},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":4,"ips":4340},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":3,"ips":3798}},"user_agents":["curl/7.74.0","curl/7.64.1"],"timeline":[{"date":"2026-08-04","count":3,"sessions":0},{"date":"2026-08-05","count":2,"sessions":0},{"date":"2026-08-09","count":2,"sessions":0},{"date":"2026-08-25","count":8,"sessions":0},{"date":"2026-08-27","count":2,"sessions":0},{"date":"2026-08-30","count":2,"sessions":0},{"date":"2026-09-02","count":2,"sessions":0},{"date":"2026-09-11","count":3,"sessions":0},{"date":"2026-09-12","count":3,"sessions":0},{"date":"2026-09-16","count":3,"sessions":0},{"date":"2026-09-18","count":1,"sessions":0},{"date":"2026-09-21","count":3,"sessions":0},{"date":"2026-09-26","count":3,"sessions":0},{"date":"2026-10-12","count":5,"sessions":0},{"date":"2026-10-13","count":5,"sessions":0},{"date":"2026-10-18","count":2,"sessions":0},{"date":"2026-10-19","count":3,"sessions":2},{"date":"2026-10-20","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-20T14:57:57","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000C\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0006\u0001\u0000\u0016\u0000\u0001\u0005\u0000\u0017\u0000$�\t\u0004\u0000\u0000\u0000\u0000\u0000��*Qb��K���a����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201004300000000000010000601001600010500170024ff09040000000000fdd42a516287874b8edad561fddedfea0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"2fe7c9d9-aaa4-4163-93d1-8a1d81941b0b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-19T07:38:09","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3389\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333338390d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"40c6148e-1505-4994-a9e5-3f0571b2f507","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":76},{"timestamp":"2026-10-19T07:37:39","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3389\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333338390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"854f4e01-aadb-49a0-bb7d-9fa84bed98e0","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":76},{"timestamp":"2026-10-19T07:37:22","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"8bcde5c6-ac96-43c4-8da1-214fdf067b08","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-18T08:54:26","port":27017,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27017\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373031370d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"68d8eab2-16a3-4039-80ee-41885c624f73","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":76},{"timestamp":"2026-10-18T08:53:56","port":27017,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:27017\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373031370d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"2c11bd00-574d-49d6-938b-1a8d4c6b6ecc","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":76},{"timestamp":"2026-10-13T21:56:14","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3389\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333338390d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"4eb2af9c-4836-4473-97bc-23a3591ec416","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":76},{"timestamp":"2026-10-13T21:55:43","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3389\",\"user-agent\":\"curl/7.64.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333338390d0a557365722d4167656e743a206375726c2f372e36342e310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.64.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"eddf56e1-914c-423b-868d-9748e3c96c72","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":76},{"timestamp":"2026-10-13T21:55:27","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080003000000","method":"","user_agent":"","ja3":"","session":"4fa7495a-61fa-4eb1-9b5f-d5128a27d56b","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"fa962c48ab1145cc","label":"RDP (X.224)"}},{"timestamp":"2026-10-13T18:23:13","port":27017,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27017\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373031370d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"8c5b2f378e481f94b4f82c131798f4d4","session":"b23597a4-22a9-4b96-8df2-77fe946c4158","seq":1,"duration_ms":105,"bytes_in":112,"bytes_out":76}],"http_methods":[{"method":"GET","count":99}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":99,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":44}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3389","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[]}