{"ip":"8.217.154.116","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,959 bytes sent","bytes_sent":1959,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-09T08:32:32","last_seen":"2026-09-09T16:27:20","events_24h":0,"events_7d":0,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":3},{"port":8083,"proto":"tcp","label":"","count":2},{"port":50001,"proto":"tcp","label":"","count":2},{"port":2077,"proto":"tcp","label":"","count":2},{"port":5985,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["89be98bbd4f065fe510fca4893cf8d9b"],"http_akin":["b11cun040_00040016_4110f156","b11cuq060_00450811_68e7e286","b11cun050_0004001e_d490606f"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3158,"b11cun040_00040016_4110f156":290,"b11cun050_0004001e_d490606f":75,"b11cuq060_00450811_68e7e286":5},"akin_families":{"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":9,"ips":290},"b11cun050_0004001e_d490606f":{"head":"b11cun040_00040016_4110f156","shapes":9,"ips":290}},"user_agents":["Microsoft WinRM Client","Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16"],"timeline":[{"date":"2026-09-09","count":10}],"recent_events":[{"timestamp":"2026-09-09T16:27:20","port":3389,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000\u0007�\b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\n\u0000cE\u0000\u0000\u0000\u000f","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d535350000100000007820800000000000000000000000000000000000a0063450000000f","method":"","user_agent":"","ja3":"89be98bbd4f065fe510fca4893cf8d9b","session":"7bb12076-b12a-4bac-a9e7-1d6de5f3e5ab","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":13,"enriched":{"digest":"70e1f7dd9d2ec72c","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-09T16:27:19","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000&!�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=\r\n\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"0300002621e00000000000436f6f6b69653a206d737473686173683d0d0a0100080001000000","method":"","user_agent":"","ja3":"","session":"b738e74e-ff66-44e9-a308-6ff17bab6a4a","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":13,"enriched":{"digest":"ccc28ad00d927959","label":"RDP (X.224)","strings":["Cookie: mstshash="]}},{"timestamp":"2026-09-09T16:27:03","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000&!�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=\r\n\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"0300002621e00000000000436f6f6b69653a206d737473686173683d0d0a0100080001000000","method":"","user_agent":"","ja3":"","session":"d855da2b-9131-4ca6-9493-d886a0e06f73","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":13,"enriched":{"digest":"ccc28ad00d927959","label":"RDP (X.224)","strings":["Cookie: mstshash="]}},{"timestamp":"2026-09-09T16:26:58","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\",\"connection\":\"Keep-Alive\",\"content-length\":\"0\",\"content-type\":\"application/soap+xml;charset=UTF-8\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Microsoft WinRM Client\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f736f61702b786d6c3b636861727365743d5554462d380d0a557365722d4167656e743a204d6963726f736f66742057696e524d20436c69656e740d0a417574686f72697a6174696f6e3a204e65676f746961746520546c524d54564e545541414241414141423449496f6741414141414141414141414141414141414141414147416245644141414144773d3d0d0a486f73743a20<HONEYPOT>3a353938350d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"POST","user_agent":"Microsoft WinRM Client","ja3":"","session":"746aa650-4e00-4fa4-a18c-68b49e1d4dcd","seq":1,"duration_ms":100,"bytes_in":261,"bytes_out":78},{"timestamp":"2026-09-09T08:32:33","port":50001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:50001\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"83616f69-6183-4098-b6c2-bd480ca778b0","seq":1,"duration_ms":100,"bytes_in":289,"bytes_out":78},{"timestamp":"2026-09-09T08:32:33","port":8083,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:8083\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"e80fbbed-b97b-4d7f-a9b3-16406f3158a9","seq":1,"duration_ms":101,"bytes_in":233,"bytes_out":78},{"timestamp":"2026-09-09T08:32:33","port":2077,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:2077\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323037370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"3ab4144d-d61a-4b5c-9db4-34438d6e162f","seq":1,"duration_ms":100,"bytes_in":233,"bytes_out":78},{"timestamp":"2026-09-09T08:32:33","port":50001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"host\":\"<HONEYPOT>:50001\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"f26466d4-3877-4e8b-afd8-6bfe719c416d","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":78},{"timestamp":"2026-09-09T08:32:32","port":8083,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:8083\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"9825e6ee-64db-499e-9f21-cf5a781c9b1f","seq":1,"duration_ms":100,"bytes_in":288,"bytes_out":78},{"timestamp":"2026-09-09T08:32:32","port":2077,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"deflate, gzip\",\"accept-language\":\"zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\",\"host\":\"<HONEYPOT>:2077\",\"user-agent\":\"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323037370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b2057696e646f7773204e5420362e313b20656e2d555329204170706c655765624b69742f3533342e313620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f31302e302e3634382e313333205361666172692f3533342e31360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69700d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e392c656e3b713d302e382c656e2d47423b713d302e372c656e2d55533b713d302e360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16","ja3":"","session":"10a1cb26-451b-4222-b131-381b7160986b","seq":1,"duration_ms":101,"bytes_in":288,"bytes_out":78}],"http_methods":[{"method":"GET","count":6},{"method":"POST","count":1}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/favicon.ico","count":3,"ports":3},{"path":"/wsman","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Authorization","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Authorization","value":"Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==","notable":true},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Content-Type","value":"application/soap+xml;charset=UTF-8","notable":true},{"name":"Host","value":"<HONEYPOT>:5985","notable":false},{"name":"User-Agent","value":"Microsoft WinRM Client","notable":false}],"distinct_sets":3,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-01T21:35:32.135097+00:00"}