{"ip":"103.83.87.203","observed":true,"total_events":28686,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive login(s) succeeded","confidence":"high","network_type":"residential ISP","why":["1 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access, not a probe.","The first-packet sensors recorded 28,686 event(s) from this address as well.","Not in any known-scanner range.","Sent 33,219,450 bytes: sustained payload delivery, not a single opportunistic request.","Held a session open for 142s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"33,219,450 bytes sent, longest session 142s","bytes_sent":33219450,"session_seconds":142,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-15T09:31:22","last_seen":"2026-10-15T15:49:31","events_24h":28686,"events_7d":28686,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"TR","country_name":"Türkiye","region":"Istanbul","city":"Istanbul","lat":40.9915,"lon":29.1373,"asn":44382,"org":"Fiba Cloud Operation Company, LLC"},"source_domain":"zi14.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as44382","label":"FibaCloud","category":"isp","url":"https://www.peeringdb.com/asn/44382"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T09:31:22","last_seen":"2026-10-15T09:31:22","verdicts":[{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[{"username":"root","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T09:30:41"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":28686,"sessions":1}],"fingerprints":{"ssh_hassh":["a7a87fbe86774c2e40cc4a7ea2ab1b3c"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["a7a87fbe86774c2e40cc4a7ea2ab1b3c"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"a7a87fbe86774c2e40cc4a7ea2ab1b3c":4},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":28686,"sessions":1}],"recent_events":[{"timestamp":"2026-10-15T15:49:31","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"2f014cd1-0124-4bdc-b863-fe7d37fede23","seq":1,"duration_ms":2101,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-15T15:49:06","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n\u0000\u0000\u0002�\n\u0014ѹe�$F\t�g\u001a�C3��M\u0000\u0000\u0000~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0000\u000fssh-rsa,ssh-dss\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��_ö�\f\u0006��","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a000002e40a14d1b965bc24460998671af6433399f14d0000007e6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000000f7373682d7273612c7373682d647373000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d636263000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d63626300000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d00000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d000000046e6f6e65000000046e6f6e6500000000000000000000000000fc855fc3b6da0c06bfd5","method":"","user_agent":"","ja3":"","session":"35323318-6d8f-4a8e-ada9-2045aff274f4","seq":1,"duration_ms":767,"bytes_in":767,"bytes_out":13,"enriched":{"digest":"ddb10005255b7ede","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0","~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-…","ssh-rsa,ssh-dss","aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-c…","qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ri…","none","M~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie…"],"iocs":{"domains":["lysator.liu.se"]}}},{"timestamp":"2026-10-15T15:48:44","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n\u0000\u0000\u0002�\n\u0014\"��~��D�U��W��\u001b�\u0000\u0000\u0000~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0000\u000fssh-rsa,ssh-dss\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000P\u0013��{.H\u0018\u0013�","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a000002e40a142284bc7eb49444e955fd8657e3d91bb40000007e6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000000f7373682d7273612c7373682d647373000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d636263000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d63626300000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d00000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d000000046e6f6e65000000046e6f6e65000000000000000000000000005013dfcb7b2e481813e3","method":"","user_agent":"","ja3":"","session":"851a6ccd-2f83-42ef-8d92-be358d53b45c","seq":1,"duration_ms":1534,"bytes_in":767,"bytes_out":13,"enriched":{"digest":"7d0728ce126802a9","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0","~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-…","ssh-rsa,ssh-dss","aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-c…","qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ri…","none","noneP"],"iocs":{"domains":["lysator.liu.se"]}}},{"timestamp":"2026-10-15T15:48:20","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n\u0000\u0000\u0002�\n\u0014�MS��L4W��6V�\bs�\u0000\u0000\u0000~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0000\u000fssh-rsa,ssh-dss\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��)ʒ�\u001cla�","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a000002e40a14e44d53ccdc4c3457dafd3656a40873ec0000007e6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000000f7373682d7273612c7373682d647373000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d636263000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d63626300000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d00000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d000000046e6f6e65000000046e6f6e650000000000000000000000000096b329ca92871c6c61f6","method":"","user_agent":"","ja3":"","session":"ee98d86c-d6d8-4b42-809f-25eb18772b38","seq":1,"duration_ms":664,"bytes_in":767,"bytes_out":13,"enriched":{"digest":"6cd1d93cd33c64b0","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0","~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-…","ssh-rsa,ssh-dss","aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-c…","qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ri…","none"],"iocs":{"domains":["lysator.liu.se"]}}},{"timestamp":"2026-10-15T15:47:56","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n\u0000\u0000\u0002�\n\u0014��\u000b�gߊBo\u0003A�&B�'\u0000\u0000\u0000~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0000\u000fssh-rsa,ssh-dss\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000G_��'\u0006m�\u000bb","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a000002e40a14eee70be767df8a426f0341c8264295270000007e6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000000f7373682d7273612c7373682d647373000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d636263000000926165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c626c6f77666973682d6362632c617263666f75723132382c617263666f75722c636173743132382d6362632c336465732d63626300000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d00000071686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39362c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d000000046e6f6e65000000046e6f6e6500000000000000000000000000475fea8b27066d940b62","method":"","user_agent":"","ja3":"","session":"2b0e12a3-1713-4e10-a3c4-313fbbb26921","seq":1,"duration_ms":1590,"bytes_in":767,"bytes_out":13,"enriched":{"digest":"1328a47b248f41c1","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0","~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-…","ssh-rsa,ssh-dss","aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-c…","qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ri…","none","'~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie…","noneG_"],"iocs":{"domains":["lysator.liu.se"]}}},{"timestamp":"2026-10-15T13:55:58","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"cf7b644a-6b70-447b-832f-862647b28691","seq":1,"duration_ms":2101,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-15T12:32:34","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"c1db8c74-0b1b-4aef-8224-892824f63c73","seq":1,"duration_ms":0,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-15T12:31:54","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"076ccc2d-65b1-4d23-aca4-4e6bafbaf102","seq":1,"duration_ms":2101,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-15T12:31:54","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"043f1a93-4bd4-48b7-9b04-f7c5511a74d0","seq":1,"duration_ms":2100,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}},{"timestamp":"2026-10-15T12:31:54","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.8.0\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e382e300d0a","method":"","user_agent":"","ja3":"","session":"113ff915-9fc0-4c18-9d2e-c0578e9cff72","seq":1,"duration_ms":2101,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"02944ef2032253aa","label":"SSH","strings":["SSH-2.0-libssh2_1.8.0"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.8.0","count":11673}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}],"data_as_of":"2026-10-15T18:57:26.176027+00:00"}