{"ip":"217.60.77.75","total_events":5,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["5 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"531 bytes sent","bytes_sent":531,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-21T17:51:26","last_seen":"2026-09-25T11:18:47","events_24h":2,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"New York","lat":40.7589,"lon":-73.9913,"asn":203861,"org":"Miteflux Technologies Ltd"},"source_domain":"hosted-by.server.express","known_scanners":[],"scanner_tag":{"key":"peeringdb:as203861","label":"ServerExpress","category":"cdn","url":"https://www.peeringdb.com/asn/203861"},"cve_matches":[],"malware":[],"top_ports":[{"port":3391,"proto":"tcp","label":"","count":2},{"port":3443,"proto":"tcp","label":"","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":9043,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030105bb010005b70303c5c88b0934757105257f322c8f21e15be8fe59653ee7948ada7d315ae63129ef20db3a54de19994061212b404b6d3a9685c13061e063c6eeb6715fff2836b17014001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000554000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030010000b000908687474702f312e31002b0009080304030303020301003304ea04e811ec04c083fb9e865460fc216fcb804b20718422f22254526b07396e5728aa1cdcb472296bb93917b500b4ef95739474b8b63b8abf23477b37070317057640bccbd9055c5c9c61d30ab4a6b53ca7b0c97225a5182594f73143087307d914c023c489223e54f07947f73a042ca0ba282243664095b3769c916225e8138625a1ade83c564914b871b4f3b83f524404fbec7e6d70886751a9c84b453385314fa9722afb243d35cc08448cfa6058a0e849c2aac8db75c272dc8f75e63895c22cabf982d9ab8ed4625ed0bbadd5a25a5459497a7597a0c9907c5a293fec7c60f65167f136d7616def063e217a007ec361cf372ee078a2404a7a8d68a323a879abfb2a4cd76888e0650402c5ef682c62512a182965c8e543418079c7722479fc162c157fba2a8caccc2eab888c20609630fb39b228461a381cff6787411685bc6b0214f235a2b5af7f87c7fc01ca19013b2a1407918cc66799409a3aae99d9bd011543fff81e7d350aa9ec843238cca9f35e2d78bbe03aa1f3f3a60ef8c722fa8c2f08cfef6c2225143190001972c129a40998f7846207672ebfc0ae6681c28ce08183f7103f3467f100b9f4631f4bf57873c258fa9468fc6a376cbbc24cc3a03e4c9d66ea41ed8b4e9d5012dff006cb6c1b32d654df84c4b6cc34befa2bd860413418c236f45156789d0777c2ffb475fbf6667eb23392d66f85f74dd0a85dbafb7f9d215d606963453752321501a28b1d381c34888645e896301418705e018c4ac9bb7af87319f1a1beb63504fbcaec3a90202c797c4778750c409f3a50d9c854956b112b6997d5c682ade31399e23303d7199ea7186bf7715e90c10d162b394ca37f8139150b6d52a222e0d6cc7a1b1a329390ea5831b1070f853437462297c0da256f3b6f4944ca248026750a22d86380a588abaa81b62b0304be77bc46ba7a41035c59e096a99606ef414513207d6e6c557e1145c3b6903be53d7e9a8de6f6026d8a4902f4779c143bf3677cc0885ef8acb8ca99ab3ab3558a3a3eec80619aa8a7a2e3283fc56242595111e1c21ca1028481acd4c3158c6919ff8535d4d0a9d2d86c54e0618faa880184159d013cb3536457f364022202b0c167c6b23c5378be66205497d19e7235c0c41c11a6f63f65b026f3f90d8775b555b308d2306002d31f6861c44a6429e9057c93e9c60aecc7e7567ce54198bb353ada493a54b3a3a4b9c766036f435cc4aeb6109d297fe3b3afe23b8dfb67babb8548d45564f6ea02656a874553af2391188e99025529581853601001941f8759271353ce69c00dfb95a77431164a91b16237fd13c8e47c09623a3c0df81271f701b16abd70421dd7eb6d9cb81cb0fb428c0916b057cfb0da6e1590b1b70636177a687b5b5fab8a190711a6a8e41738a20afda56366a05b0682b846ec95a9871c343662b762b0e1a41b2c3bb872e3563c9901bc19200707cc46f8ba77a0392178cd35eb4fee043bfa55565ce0254c774f91d0a1b8d91d51ca9ac782c0bab64fe74401bfd0cb75c0899ec78427da69557048aadcb02496ba87c38605f2c4cc0ca0af200bc5c16ee1e65d26e0a317623fc4330b8af8ba4cc725dc57bf03cc3ce2dc517007979162a8c42285933a7abeb283f5643af34e80fcc4c7bdd1d4a61d0236e6acc223fcea5527ab13c2ddffcbc5b84c411d47d087a91cf15dd5f90e0be5c941f35772e0ea0a21e74516ce73001d0020cbc5b84c411d47d087a91cf15dd5f90e0be5c941f35772e0ea0a21e74516ce","tls_ja3":["faa162b5a653756fba26803ea81b362f"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"a11cun040_0000004e_608dab68":556,"t13i1310h1_f57a46bbacb6_e7c285222651":62},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-09-21","count":2},{"date":"2026-09-24","count":1},{"date":"2026-09-25","count":2}],"recent_events":[{"timestamp":"2026-09-25T11:18:47","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"030dd947-0d5b-4f1f-8d06-d86699b9e1ba","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-25T10:48:31","port":9043,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"192.3.118.146:9043\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a393034330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"8f998461-59c9-43d5-93d8-8e8c078aa6e6","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-24T10:17:16","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=IZU6PEXXGM6CQGEOCYG2WVERKR\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d495a553650455858474d36435147454f43594732575645524b520d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"7614e296-c54c-49dd-b572-164afbe4d653","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":12,"enriched":{"digest":"6d565749455bacfe","label":"RDP (X.224)","strings":["Cookie: mstshash=IZU6PEXXGM6CQGEOCYG2WVERKR"]}},{"timestamp":"2026-09-21T18:14:40","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=IMDEINZ7BLZLPQSVE6FKFJ2WYN\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d494d4445494e5a37424c5a4c505153564536464b464a3257594e0d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"6605091d-456c-4c7d-a437-e2898e1a31e0","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":12,"enriched":{"digest":"c2c73fa9d76b2e40","label":"RDP (X.224)","strings":["Cookie: mstshash=IMDEINZ7BLZLPQSVE6FKFJ2WYN"]}},{"timestamp":"2026-09-21T17:51:26","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000@;�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=HUBTQEU6HXHUNHW6Q6G5JHYGVQ\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000403be00000000000436f6f6b69653a206d737473686173683d4855425451455536485848554e485736513647354a48594756510d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"7dc99274-d336-469c-b0ca-22651d11170c","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":12,"enriched":{"digest":"7049f4a79a2f12f6","label":"RDP (X.224)","strings":["Cookie: mstshash=HUBTQEU6HXHUNHW6Q6G5JHYGVQ"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":1}],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-25T15:58:15.329972+00:00"}