{"ip":"104.28.211.197","data_as_of":"2026-10-29T07:06:59+00:00","observed":true,"total_events":2391,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 exploit-path hits","confidence":"high","network_type":"CDN","why":["12 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 4,448,318 bytes, which is sustained payload delivery.","Held a session open for 90s, against a median of well under a second.","Counts include 1,137 interactive session(s) as well as first-packet events.","Interactive sessions: 25 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"4,448,318 bytes sent, longest session 90s","bytes_sent":4448318,"session_seconds":90,"persistent":true},"basis":"combined"},"first_seen":"2026-10-23T03:00:57","last_seen":"2026-10-29T06:59:38","events_24h":5,"events_7d":2391,"interactive_sessions":1137,"interactive_sessions_24h":39,"interactive_sessions_7d":1137,"interactive_protocols":[{"protocol":"http","sessions":306},{"protocol":"cgminer-api","sessions":289},{"protocol":"telnet","sessions":150},{"protocol":"stratum","sessions":22},{"protocol":"ssh","sessions":19},{"protocol":"socks5","sessions":16},{"protocol":"modbus","sessions":5},{"protocol":"kerberos","sessions":4},{"protocol":"tls","sessions":2},{"protocol":"http-proxy","sessions":1}],"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1137,"first_seen":"2026-10-23T03:00:57","last_seen":"2026-10-28T12:48:40","verdicts":[{"verdict":"scan","sessions":704},{"verdict":"unknown","sessions":395},{"verdict":"post-exploitation","sessions":25},{"verdict":"credential","sessions":13}],"personas":[{"persona":"miner@cgminer 4.11.1","sessions":311},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2, plex@1.43.2.10687","sessions":182},{"persona":"linux-ubuntu@20.04","sessions":169},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":112},{"persona":"proxy@squid/5.7","sessions":17},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, mikrotik@6.49.10, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":6},{"persona":"ics@Siemens S7-1200","sessions":5},{"persona":"kerberos@Windows Server 2019","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3, gitlab@19.4.2","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"cgminer-api","port":4028,"sessions":289},{"protocol":"telnet","port":23,"sessions":136},{"protocol":"http","port":4066,"sessions":56},{"protocol":"http","port":4068,"sessions":40},{"protocol":"http","port":4067,"sessions":39},{"protocol":"http","port":4111,"sessions":39},{"protocol":"http","port":1534,"sessions":37},{"protocol":"tcp","port":4066,"sessions":23},{"protocol":"tcp","port":1534,"sessions":22},{"protocol":"http","port":50051,"sessions":19},{"protocol":"tcp","port":4068,"sessions":17},{"protocol":"tcp","port":4029,"sessions":16}],"logins":[{"username":"routeraudit.probe","password":"x","password_sent":true,"service":"stratum-authorize","outcome":"success","tries":12,"last_seen":"2026-10-28T12:45:47"},{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-27T12:58:29"},{"username":"admin","password":"user","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-28T06:34:48"},{"username":"admin","password":"","password_sent":true,"service":"ssh-password","outcome":"failure","tries":1,"last_seen":"2026-10-25T20:48:10"}],"commands":[{"ts":"2026-10-28T06:34:48","session_id":"c9874df9-974e-45a7-8819-72f4652eac03","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T18:25:08","session_id":"d3feb35b-6b03-4a81-83ca-87bb58b81bcc","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T12:58:29","session_id":"3b802bb6-4661-415a-afe9-8a98bdf143df","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T12:14:38","session_id":"4be8552a-bf5e-4125-aaf1-f74fa286c553","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-26T15:00:27","session_id":"db2f05e9-1d78-430f-a1bb-683607282f7d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-26T15:00:26","session_id":"c555ee90-1e3b-4299-b06f-f57ae91ddab9","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-25T20:48:11","session_id":"88a8d3e6-da7f-42de-bce6-52474123c6dd","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0}],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":704},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":19},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":7},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":20},{"technique_id":"T1496","technique_name":"Resource Hijacking","tactic_id":"TA0040","tactic_name":"Impact","sessions":29}]},"top_ports":[{"port":4028,"proto":"tcp","label":"","count":311,"sessions":289},{"port":4433,"proto":"tcp","label":"","count":318,"sessions":16},{"port":1534,"proto":"tcp","label":"","count":218,"sessions":61},{"port":4111,"proto":"tcp","label":"","count":202,"sessions":59},{"port":4066,"proto":"tcp","label":"","count":157,"sessions":80},{"port":4029,"proto":"tcp","label":"","count":211,"sessions":16},{"port":4067,"proto":"tcp","label":"","count":164,"sessions":52},{"port":4068,"proto":"tcp","label":"","count":123,"sessions":59},{"port":8333,"proto":"tcp","label":"Bitcoin","count":139,"sessions":9},{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":136},{"port":50051,"proto":"tcp","label":"","count":99,"sessions":33},{"port":8444,"proto":"tcp","label":"","count":114,"sessions":15},{"port":8359,"proto":"tcp","label":"","count":105,"sessions":7},{"port":8889,"proto":"tcp","label":"","count":84,"sessions":1},{"port":443,"proto":"tcp","label":"HTTPS","count":47,"sessions":3}],"fingerprints":{"ssh_hassh":["d055c93eb832f05741824c5d6eeb7251"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e"],"tls_client_hello":"1603010103010000ff03037abea25fae672137b996166b26baf3ad07835d5d56772e424e8ca4deb23e420b20e5d9cf3c07f3b1c145e7871060c2ee4dcec85e2097a105ed4c66702c2389cc0a0018130213031301c02cc02bc030c02fc024c023c028c02700ff0100009e000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000005000501000000000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020dfd042380b97fbe544e9c9dbcdef7b103d5b92e4ff3909c7b3f6b7788dcd46","tls_ja3":["64415168a62acdefdaa061ac3ae40abc"],"http_akin":["b11cun040_08040012_7b8eef66","b11cun030_00040012_f983b7ce","b11cuq050_00050812_e41ea0b6","b11cun051_00040015_df66fe0f_x7585"],"interactive":{"ssh_hassh":["d055c93eb832f05741824c5d6eeb7251"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e"],"tls_ja3":["64415168a62acdefdaa061ac3ae40abc"]}},"fingerprint_peers":{"t13i121000_a538d02d76d5_f6eeaf393d2e":4,"d055c93eb832f05741824c5d6eeb7251":4,"b11cun040_08040012_7b8eef66":7,"b11cun030_00040012_f983b7ce":15,"b11cun051_00040015_df66fe0f_x7585":16,"b11cuq050_00050812_e41ea0b6":3},"akin_families":{"b11cun040_08040012_7b8eef66":{"head":"b11cun030_00040012_f983b7ce","shapes":2,"ips":15},"b11cun030_00040012_f983b7ce":{"head":"b11cun030_00040012_f983b7ce","shapes":2,"ips":15},"b11cuq050_00050812_e41ea0b6":{"head":"b11cuq060_00850812_1a0049ff","shapes":2,"ips":10}},"user_agents":["GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) RouterAudit/1.0"],"timeline":[{"date":"2026-10-23","count":0,"sessions":71},{"date":"2026-10-25","count":605,"sessions":354},{"date":"2026-10-26","count":476,"sessions":77},{"date":"2026-10-27","count":1299,"sessions":431},{"date":"2026-10-28","count":9,"sessions":204},{"date":"2026-10-29","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-29T06:59:38","port":4028,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"summary\"}\n","payload_hex":"7b22636f6d6d616e64223a202273756d6d617279227d0a","method":"","user_agent":"","ja3":"","session":"7f614ab3-f759-4ff8-8fc5-b76fee8e1506","seq":1,"duration_ms":101,"bytes_in":23,"bytes_out":14,"enriched":{"digest":"5140f4837dd2cfdd","strings":["{\"command\": \"summary\"}"]}},{"timestamp":"2026-10-29T04:14:57","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"from\":\"abuse-optout@example.com\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20477269645363616e6e65722f312e3020282b61627573652d636f6e746163743a206162757365406578616d706c652e636f6d2920282b687474703a2f2f34352e3135392e3134342e3130332e6e69702e696f2f6f70742d6f7574290d0a46726f6d3a2061627573652d6f70746f7574406578616d706c652e636f6d0d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)","ja3":"","session":"626b3993-9fe4-4ce0-a7e5-fe9de894ac47","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-10-28T23:34:12","port":4028,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"stats\"}\n","payload_hex":"7b22636f6d6d616e64223a20227374617473227d0a","method":"","user_agent":"","ja3":"","session":"b251ae4f-ff50-496a-9a14-ef1af837df7d","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"737ebb6ac4b80ff3","strings":["{\"command\": \"stats\"}"]}},{"timestamp":"2026-10-28T21:08:11","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"from\":\"abuse-optout@example.com\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20477269645363616e6e65722f312e3020282b61627573652d636f6e746163743a206162757365406578616d706c652e636f6d2920282b687474703a2f2f34352e3135392e3134342e3130332e6e69702e696f2f6f70742d6f7574290d0a46726f6d3a2061627573652d6f70746f7574406578616d706c652e636f6d0d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)","ja3":"","session":"9543f369-e76f-4899-b51a-b61da2763dd9","seq":1,"duration_ms":101,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-10-28T12:48:40","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"(\u0000\u0000\u0000{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","payload_hex":"280000007b22636d64223a226765742e6465766963652e696e666f222c22706172616d223a2273616c74227d","method":"","user_agent":"","ja3":"","session":"4d7e2f9a-8574-4a5c-86d1-b2b3f00f255c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dfdfa2b4951e0788","strings":["{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","({\"cmd\":\"get.device.info\",\"param\":\"salt\"}"],"iocs":{"domains":["get.device.info"]}},"interactive":true},{"timestamp":"2026-10-28T12:48:06","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\":\"pools\"}","payload_hex":"7b22636f6d6d616e64223a22706f6f6c73227d","method":"","user_agent":"","ja3":"","session":"c9ba7c8b-1198-439f-8d51-117fd30550d5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6391ab0f50452470","strings":["{\"command\":\"pools\"}"]},"interactive":true},{"timestamp":"2026-10-28T12:47:53","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\u0000\u0000\u0000{\"cmd\":\"login\",\"username\":\"\",\"password\":\"miner\"}","payload_hex":"300000007b22636d64223a226c6f67696e222c22757365726e616d65223a22222c2270617373776f7264223a226d696e6572227d","method":"","user_agent":"","ja3":"","session":"a7694c4f-44a1-42c6-a86c-08e6c0990589-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f86ab28bd592e8fe","strings":["{\"cmd\":\"login\",\"username\":\"\",\"password\":\"miner\"}","0{\"cmd\":\"login\",\"username\":\"\",\"password\":\"miner\"}"]},"interactive":true},{"timestamp":"2026-10-28T12:47:41","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\u0000\u0000\u0000{\"cmd\":\"login\",\"username\":\"\",\"password\":\"Admin\"}","payload_hex":"300000007b22636d64223a226c6f67696e222c22757365726e616d65223a22222c2270617373776f7264223a2241646d696e227d","method":"","user_agent":"","ja3":"","session":"28f89b93-9d08-47a6-b72a-8f25d0c76b1f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d2a3578984ec2779","strings":["{\"cmd\":\"login\",\"username\":\"\",\"password\":\"Admin\"}","0{\"cmd\":\"login\",\"username\":\"\",\"password\":\"Admin\"}"]},"interactive":true},{"timestamp":"2026-10-28T12:47:23","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"2\u0000\u0000\u0000{\"cmd\":\"login\",\"username\":\"\",\"password\":\"support\"}","payload_hex":"320000007b22636d64223a226c6f67696e222c22757365726e616d65223a22222c2270617373776f7264223a22737570706f7274227d","method":"","user_agent":"","ja3":"","session":"425dac04-2c24-4f6e-a37d-a5365a23e6b6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3a412a1f0ed58fe4","strings":["{\"cmd\":\"login\",\"username\":\"\",\"password\":\"support\"}","2{\"cmd\":\"login\",\"username\":\"\",\"password\":\"support\"}"]},"interactive":true},{"timestamp":"2026-10-28T12:47:17","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"2\u0000\u0000\u0000{\"cmd\":\"login\",\"username\":\"\",\"password\":\"default\"}","payload_hex":"320000007b22636d64223a226c6f67696e222c22757365726e616d65223a22222c2270617373776f7264223a2264656661756c74227d","method":"","user_agent":"","ja3":"","session":"88194507-86b6-4aa6-a507-1fd72492a527-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8749253017f6806e","strings":["{\"cmd\":\"login\",\"username\":\"\",\"password\":\"default\"}","2{\"cmd\":\"login\",\"username\":\"\",\"password\":\"default\"}"]},"interactive":true}],"http_methods":[{"method":"GET","count":3588},{"method":"POST","count":205},{"method":"CONNECT","count":4}],"distinct_ports_total":126,"top_paths":[{"path":"/","count":866,"ports":31},{"path":"/get_home.cgi","count":162,"ports":28},{"path":"/get_minerinfo.cgi","count":155,"ports":28},{"path":"/user/login","count":92,"ports":27},{"path":"/cgi-bin/get_system_info.cgi","count":77,"ports":29},{"path":"/cgi-bin/get_blade_info.cgi","count":76,"ports":16},{"path":"/login.cgi","count":72,"ports":15},{"path":"/cgi/login","count":71,"ports":15},{"path":"/login.html","count":70,"ports":15},{"path":"/cgi-bin/luci","count":69,"ports":15},{"path":"/uir/loginpage.htm","count":69,"ports":15},{"path":"/loginpage.htm","count":69,"ports":15},{"path":"/login.htm","count":68,"ports":15},{"path":"/goform/login","count":68,"ports":15},{"path":"/api/meta","count":67,"ports":16}],"distinct_paths_total":154,"top_snis":[],"top_hosts":[{"value":"example.com","count":4},{"value":"x","count":4}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Renci.SshNet.SshClient.2026.0.0","count":9}],"credentials":[],"header_profile":{"signature":["Accept","Connection","From","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"From","value":"abuse-optout@example.com","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":25},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":7},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":20}]}