AS37963 — ALIBABA-CN-NET Hangzhou Alibaba
Attacker network profile
Observed by OffSeq honeypot sensors · last 30 days · last seen 10 minutes ago · first observed 2026-09-25 (29 days ago)
149,589
Attacks
349
Distinct source IPs
Attacks from this network most often target T1021.005 VNC.
OffSeq honeypot sensors recorded 149,589 attacks from 349 distinct hosts within AS37963in the last 30 days. Source addresses are aggregated to /16 networks — Mirage never publishes an individual attacker IP.
Techniques
- T1021.005 VNC91,466
- T1110 Brute Force11,158
- T1190 Exploit Public-Facing Application1,062
- T1046 Network Service Discovery589
- T1595 Active Scanning438
- T1552 Unsecured Credentials66
- T1210 Exploitation of Remote Services46
- T1059 Command and Scripting Interpreter25
- T1595.002 Vulnerability Scanning23
- T1498.002 Reflection Amplification22
- T1078 Valid Accounts21
- T1552.001 Credentials In Files6