{"ip":"217.60.77.62","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,964 bytes sent","bytes_sent":1964,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T16:13:40","last_seen":"2026-09-25T13:39:12","events_24h":2,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"New York","lat":40.7589,"lon":-73.9913,"asn":203861,"org":"Miteflux Technologies Ltd"},"source_domain":"hosted-by.server.express","known_scanners":[],"scanner_tag":{"key":"peeringdb:as203861","label":"ServerExpress","category":"cdn","url":"https://www.peeringdb.com/asn/203861"},"cve_matches":[],"malware":[],"top_ports":[{"port":8081,"proto":"tcp","label":"","count":2},{"port":389,"proto":"tcp","label":"LDAP","count":2},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":9043,"proto":"tcp","label":"","count":1},{"port":6443,"proto":"tcp","label":"k8s API","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105bb010005b7030372c5a1f6288ef3f0baaf5cbee15e320c7e68390df7c42cfc523d63aaedf9a6a220c2b04807b0ba51eb1e51c32e7d3479919eb168c594cf25b8a29713ee95149a56001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000554000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030010000b000908687474702f312e31002b0009080304030303020301003304ea04e811ec04c0b81a00b11318f3b60aaaf592d4f826de4c33bd7b40cf9410b4085a8350abe628ce93494ac1c16b152c8e92f49c2296ad887cb7e4a0b2c0b06037d92210c1bbae100010c14b9269bca12661e9d7934872c4b41234b4875a51dc7043ab90d46838e6f3906cf17518b09b5964b3ef0b1eb019b292144a11306fafab16e9a20588316106f38ad8e24fd1404d64bb1b4be41241e6c9293976712bc05ae25dee88ce57414aff5254755b583a9b46a505a84f3681b308926ef5c2bd55cd6f28c6d8a49fc87a76d7c53f36655fd245c362c298fce251d1760a6fb09f77340633d29e0a38abada464ab35adf8436165f93f5bf26f9925bd07d2a55967b853ea86d9263a85fa3d7a786c00c5ae8194bb71a171cea7b41e3bc71b6c64bb1615f1eb6a0703600ec64080b67f4d457034614314c79f022359d89346f5c624645a1d4ec94fec1a486ed560c7b43aeb9abccc3092b1f75fe799126aac4b2281c473324007882fd8921b60bc490d9a041eba7d74bb0aee03977206ae91888c3021a242213a0b96cc54c52e2e1c3bea4c7c5f508cb6752bbf34972e5615fd275a9f665b19f9ca1b35976a28b71bd4744486bef20c21f62115019570f9db1c4b9c8c8a019b3fc74afe03b9dc3c49a86390c23b8ff85a327e50878a03b9d8e821fe975e50e92273aac998d05e54f6220802252f06c98758870e049481bc94b4500ce9c09a6087537b02bf4d98af0dfa313eb93c2da9b779264ca0fc461034c49aa67cfd481840224c8e54322fd5c643e477806499ce5a5d600152a5dcb605d6aacab929ecd942f20793d62b8d018977956abac5012aab6773eb79603831463e9ca19ad1c774024f447acafdd26523546239e41b8fd1b0f5830318f49b093907bdd19506025a2ba1336844b7aeca5d19a4a3a6ab69e0711f10c877a1b4297ff5669eb66d2a5078570b60e5f38e0feb018ad770ec3a5eb193baf4e70869ac006ba6762ea9876d46133ee9bc0aa0afeb1b0db4d7adde7708865a8c613bc72db7513e1401c4564e3c604375c2597c7a6bc9ca2cd32909693a521beb878a3008f51c937f8648daa53a52dbb1c3a1be2fba2e145c81b142081fc60ae9a5193afc63cd3c3e260b8dfdc837fa8a0bf0e794641c602bd890aa8b7a80b09391e311da396bb341832b087d35d6837d70be0f66891cea07419c819ac734f9591394c21d3606935d54b537ba7985da0f61fb41d60203b255cf2049aeed9cb484e93217461e4b8965f7fc00b0922d852909b1c16823c848d8e464c95b5c94585dea705cb0a03388c541314a3a7a602e77f6656fb0370451a1334822a7060c3e962d576284a501af8e3ab65f376365c2623e05be95f73967cb335241baffa3288cab052977bce81ca2b0360f6b1c1ff3a84018838ced316e8d72ce23284d834c8950abb7487250a829c5dc662e25238a08ab364d3120fadb4153f262ae40ab0370003ff519bfd9a6d3e073ccda7d4117423b51c6493c29a1a99737ea58787912e08469bf697e4d93b6bcb99510d5a32959aebd8b3b16baa029eb4b786c309b9b15616920d8321ab2f2ae835244b7c9a74d78ba3a4a048d6a0a1ed6b32e74bd8f6cabbcd35aab3b4d7e0b9f4be79401a85ec2fa8da3f02bd930cdc2cac334781f091a05cca4c608f6924e13be65f8a21ce66ede4773efa13d4d2be3f15aae660e26e3f708a33d0bdee3f6230eb7a4e04b30001d00206ede4773efa13d4d2be3f15aae660e26e3f708a33d0bdee3f6230eb7a4e04b","tls_ja3":["faa162b5a653756fba26803ea81b362f"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":62,"e54ef3ec27fe1fea7ab64d3fa05359fd":513,"a11cun040_0000004e_608dab68":558},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-09-16","count":2},{"date":"2026-09-17","count":2},{"date":"2026-09-24","count":2},{"date":"2026-09-25","count":2}],"recent_events":[{"timestamp":"2026-09-25T13:39:12","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"883b498e-ba5f-4020-ab7a-c39cd4e7781d","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-25T09:20:16","port":9043,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9043\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393034330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"5a98285b-61af-464b-8d2c-6c6fed9aaa7d","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-24T10:45:05","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014r��s3���ӳ�����\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\f<ɮ��","payload_hex":"5353482d322e302d476f0d0a0000049c061472fe9a7333bccfebd3b3fb85d2fdd47f00000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000000c3cc9aea5f5","method":"","user_agent":"","ja3":"","session":"07eb7be6-91d3-45dd-8b83-6af6d97a0d0b","seq":1,"duration_ms":122,"bytes_in":1196,"bytes_out":12,"enriched":{"digest":"db398d256416ff48","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-24T08:24:34","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=QDBT7E6UKWSAWXQ5EVDYNDFDFJ\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d51444254374536554b57534157585135455644594e444644464a0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"6e8e75c1-9c7b-4032-b4ad-34c8b012e818","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":12,"enriched":{"digest":"ccd6af4c670b252c","label":"RDP (X.224)","strings":["Cookie: mstshash=QDBT7E6UKWSAWXQ5EVDYNDFDFJ"]}},{"timestamp":"2026-09-17T12:51:26","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"e74430be-fb90-481a-a6fb-b127de7bc081","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":12},{"timestamp":"2026-09-17T12:44:23","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"8b23c31e-51ba-44e4-84f8-8cb16d8ba86a","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":12},{"timestamp":"2026-09-16T16:19:58","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"53fe1a29-b5b1-4e4e-8a49-1ff3f12cd865","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-16T16:13:40","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"8f7cda3f-84db-42cd-b669-c5fdc273f64a","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":77}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":4,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:6443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-25T19:48:19.926736+00:00"}