Yeah, its running a website. All ports are on default deny except 22, 80, 443, and 9050. 9050 is for the onion version of the site, and 80 auto-redirects to the https version of the site. 22 is rate limited to help protect against brute-force attacks. The requests are coming from multiple IPs, some of them are 117.72.47.192, 172.71.184.89, and 162.158.87.100. the one that sent that specific packet is 82.147.85.33 and no user agent is provided. Most of the malicious packets have user agents attached, but that specific one doesn’t I also am seeing another weird one sent by 138.197.16.14

"238\x00ll|'|'|SGFjS2VkX0Q3NUU2QUFB|'|'|WIN-QZN7FJ7D1O|'|'|Administrator|'|'|19-11-28|'|'||'|'|Win 10 Pro x64|'|'|No|'|'|S17|'|'|..|'|'|SW5ib3ggLSBPdXRsb29rIERhdGEgRmlsZSAtIE1pY3Jvc29mdCBPdXRsb29rAA==|'|'|" 400 166 "-" "-"