{"ip":"104.28.243.197","data_as_of":"2026-10-28T05:34:07+00:00","observed":true,"total_events":1249,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 exploit-path hits","confidence":"high","network_type":"CDN","why":["12 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,059,745 bytes, which is sustained payload delivery.","Held a session open for 90s, against a median of well under a second.","Counts include 958 interactive session(s) as well as first-packet events.","Interactive sessions: 34 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"2,059,745 bytes sent, longest session 90s","bytes_sent":2059745,"session_seconds":90,"persistent":true},"basis":"combined"},"first_seen":"2026-10-23T03:00:56","last_seen":"2026-10-28T00:38:48","events_24h":192,"events_7d":1249,"interactive_sessions":958,"interactive_sessions_24h":293,"interactive_sessions_7d":958,"interactive_protocols":[{"protocol":"http","sessions":267},{"protocol":"cgminer-api","sessions":223},{"protocol":"telnet","sessions":130},{"protocol":"stratum","sessions":29},{"protocol":"socks5","sessions":13},{"protocol":"ssh","sessions":12},{"protocol":"modbus","sessions":6},{"protocol":"tls","sessions":4}],"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":958,"first_seen":"2026-10-23T03:00:56","last_seen":"2026-10-28T00:38:23","verdicts":[{"verdict":"scan","sessions":566},{"verdict":"unknown","sessions":339},{"verdict":"post-exploitation","sessions":34},{"verdict":"credential","sessions":19}],"personas":[{"persona":"miner@cgminer 4.11.1","sessions":252},{"persona":"linux-ubuntu@20.04","sessions":142},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2, plex@1.43.2.10687","sessions":142},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":118},{"persona":"proxy@squid/5.7","sessions":13},{"persona":"ics@Siemens S7-1200","sessions":6},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3, gitlab@19.4.2","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"cgminer-api","port":4028,"sessions":223},{"protocol":"telnet","port":23,"sessions":121},{"protocol":"http","port":4111,"sessions":41},{"protocol":"http","port":1534,"sessions":36},{"protocol":"http","port":4067,"sessions":30},{"protocol":"http","port":50051,"sessions":30},{"protocol":"http","port":4066,"sessions":30},{"protocol":"http","port":443,"sessions":28},{"protocol":"http","port":4068,"sessions":25},{"protocol":"tcp","port":4029,"sessions":22},{"protocol":"tcp","port":4433,"sessions":17},{"protocol":"tcp","port":4068,"sessions":15}],"logins":[{"username":"routeraudit.probe","password":"x","password_sent":true,"service":"stratum-authorize","outcome":"success","tries":18,"last_seen":"2026-10-28T00:28:11"},{"username":"admin","password":"user","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-28T00:27:30"},{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-27T01:29:25"},{"username":"admin","password":"","password_sent":true,"service":"ssh-password","outcome":"failure","tries":1,"last_seen":"2026-10-25T20:48:11"}],"commands":[{"ts":"2026-10-28T00:27:30","session_id":"20741734-0292-46d4-b8cf-1e2c1f032ce9","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-28T00:27:27","session_id":"648eac5c-253a-48c7-903a-36fc321d4a42","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T12:14:40","session_id":"f820760e-c384-47ab-ad2b-50f7aa2e4b86","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T01:29:25","session_id":"6e1bb288-0229-4d93-b113-14dd8631895c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T01:29:24","session_id":"4c8cabab-51c8-427d-9f8e-38e1d52ff793","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-25T20:48:12","session_id":"f3ea023b-54a2-496c-a2ae-3ac43a7ee00d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0}],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":566},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":24},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":6},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":25},{"technique_id":"T1496","technique_name":"Resource Hijacking","tactic_id":"TA0040","tactic_name":"Impact","sessions":43}]},"top_ports":[{"port":4028,"proto":"tcp","label":"","count":183,"sessions":223},{"port":4433,"proto":"tcp","label":"","count":181,"sessions":17},{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":121},{"port":4029,"proto":"tcp","label":"","count":94,"sessions":22},{"port":8889,"proto":"tcp","label":"","count":111,"sessions":4},{"port":4068,"proto":"tcp","label":"","count":69,"sessions":41},{"port":50051,"proto":"tcp","label":"","count":67,"sessions":39},{"port":4111,"proto":"tcp","label":"","count":49,"sessions":56},{"port":1534,"proto":"tcp","label":"","count":50,"sessions":52},{"port":8359,"proto":"tcp","label":"","count":90,"sessions":4},{"port":8444,"proto":"tcp","label":"","count":80,"sessions":11},{"port":4066,"proto":"tcp","label":"","count":41,"sessions":46},{"port":443,"proto":"tcp","label":"HTTPS","count":47,"sessions":28},{"port":8333,"proto":"tcp","label":"Bitcoin","count":56,"sessions":15},{"port":6080,"proto":"tcp","label":"","count":42,"sessions":0}],"fingerprints":{"ssh_hassh":["d055c93eb832f05741824c5d6eeb7251"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e","t13i301100_1d37bd780c83_ecd0401ec68b"],"tls_client_hello":"16030105f8010005f4030323e02984e840605499c81429036ee0839073c44ad7a3062c3ac805846af90acd20f3139aeb13eba23d654a838c7ddf8823dde2a89002096b9a4eaa4b6e52cc2c79003c130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f0100056fff01000100000b000403000102000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0285a6c08303910b43d79db4ea4805233b55205ab2c46514cea6aca46567e52f107c767323863458a621c6b264a0dd3c078e107f821555e19248da77d49f22d0ab948a91397c1d4779828be89a60d1fb78b82322c940cba5d787c5bc68ab3a516b35929ced911384379727455ad0cc43ed9cf7749ae6d681ac5532da266ab9c8b3579f5202623bfde96005444c57da47ac382c7d2a682a74147eae0429153542158cf6a43942ac88fc4eb5114a26c0a0b15aaaa82209341c0a283bc2406ea7535331451b414be49f8ab6e65be8bf0871d69324cec25d05380c2936bb6b888350335e039a7126baebc2b00d3b56e93206cf153cbc6c72b607a6bcc9bcbe24403d00416e683c0dd0bb9c0644d89e82dbc224df4389e7c9c7a46817d38b96683e6b4c03c343613ac42facd4f9329217330413b3ee94125b7099c865b3156004fb50c96f9984467fa54b6a024474b47b438617a625454cb86dedc5e4b87900b65b56efbbc16012bd328c31e329c5c84b83d6a1f3f3b91bf1c11197b76a2229c6ce03e3786949c301d9088110bf4399d5361b5d085e9785bfc873fa544b36129a67a1150e07a6310ea722ed4407c6406d410747b4a2bb455353d11c70f48637779b9cb085a2a3562306ab3db78ab6808c0b20b7de3d388f5f2a924c606c1aba5ac953d884806104057f8ec07c0a2b02d7b3fccc91ad5318589d7b44a554769f486e430cfb7523e89519c2c958e83d995fed4939dc0a709123d36b1a9ce551e61c6a4608c9a4e87073847c7c372324ccb39a99c3b667aa404e35a3b11403f3122c11ab9d828cc56215b6d9428d87866fb349890b1789edca2aee324c3e2c53aa1c029b09ba444797876820c33cf200000a2dbb57bd0bed4232d2f97ac18759e7c3868a9a9165dc46e61e5b8aa797a71799123152ba070cf9a4499a615ce87289a30a46f2b886966e5346a10415ec96d561c0bc93210f61b7b39f87625fbb085e7636ec940a885b6879ba21a38c4b0322033e0033670abec4b5a73a14edf74399024a2a1a45126e7786c902db28cc707f33afb0735d60a9c11371d5f521f5088125b321fe6c2cecbdc2f36e366b765885680072d32b1a049004b48bd874896ba0a4dd688aaff737ed5ec1554711817e86dc29336e58cb065965089766e0bf6205a791df7778cdda0813533af2aab7e06a255bb680611a585b1f57466f0c668479cd8d456d31135fcab6ebf29908337cc613534d635b99ddbbf114197e07476fd52228c678ee0e4064c7ba1f6d82c2e9927bb62172ca15c1e31a6e4831c972b79fdc7256e18350ce3bfa772c71cf2b96d930354ec17df80c0a247945f41aff5393024d0b284c000141b97e7e733355902aa388493120c5e78c612d08cce9790d4d4809bcbbe18752ab6c06788110a886b5b7a559d91a5acb813ae752a855b742e4a63884de34468e3bd928a64cc9a3b29bc9224f4335ce602d777794bb718f2eb86104c1d4307bcc1e97749ba0258094c8a20cf231078c699a1a2c13e72f83177532de523769eb54aeb4a5cade94d4ff9cc46d16c9f8782772b60e77206910b2afa375f63a42311e11fbeb0c7a7f34fb75961b1d7769f7bbfcfe1a4b8a8355f2aa4183895fa35347867cc766eaf1e8b29eb068b9ba4a8275ed1461533c43df151323857a140ca8d8ad4cdb95177ec10d3fc7af7bb27a2a409f717e83170455365ddb9496d001d0020159f2988600345336f83c80ee109f1af6de7f5b35016192beae2b3ff0953c457001b00050400010003","tls_ja3":["64415168a62acdefdaa061ac3ae40abc","2617ff3a2d7f879546f0aac7afc5f15c"],"http_akin":["b11cun040_08040012_7b8eef66","b11cun030_00040012_f983b7ce","b11cun050_00440412_e41ea0b6","b11cun051_00040015_df66fe0f_x7585"],"interactive":{"ssh_hassh":["d055c93eb832f05741824c5d6eeb7251"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e"],"tls_ja3":["64415168a62acdefdaa061ac3ae40abc"]}},"fingerprint_peers":{"t13i121000_a538d02d76d5_f6eeaf393d2e":4,"t13i301100_1d37bd780c83_ecd0401ec68b":32,"d055c93eb832f05741824c5d6eeb7251":4,"b11cun040_08040012_7b8eef66":7,"b11cun030_00040012_f983b7ce":15,"b11cun050_00440412_e41ea0b6":8,"b11cun051_00040015_df66fe0f_x7585":11},"akin_families":{"b11cun040_08040012_7b8eef66":{"head":"b11cun030_00040012_f983b7ce","shapes":2,"ips":15},"b11cun030_00040012_f983b7ce":{"head":"b11cun030_00040012_f983b7ce","shapes":2,"ips":15}},"user_agents":["GridScanner/1.0 (+abuse-contact: abuse@example.com) (+http://45.159.144.103.nip.io/opt-out)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) RouterAudit/1.0"],"timeline":[{"date":"2026-10-23","count":0,"sessions":188},{"date":"2026-10-25","count":664,"sessions":345},{"date":"2026-10-26","count":390,"sessions":75},{"date":"2026-10-27","count":190,"sessions":276},{"date":"2026-10-28","count":5,"sessions":74}],"recent_events":[{"timestamp":"2026-10-28T00:38:48","port":4029,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"get_miner_info\"}\n","payload_hex":"7b22636f6d6d616e64223a20226765745f6d696e65725f696e666f227d0a","method":"","user_agent":"","ja3":"","session":"7bdbfb0b-56d7-4ae0-990c-737850daea4a","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"d2e894f7f809ec7c","strings":["{\"command\": \"get_miner_info\"}"]}},{"timestamp":"2026-10-28T00:38:47","port":4029,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"stats\"}\n","payload_hex":"7b22636f6d6d616e64223a20227374617473227d0a","method":"","user_agent":"","ja3":"","session":"61518905-d5c1-4485-9161-b8017f014a93","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"737ebb6ac4b80ff3","strings":["{\"command\": \"stats\"}"]}},{"timestamp":"2026-10-28T00:38:44","port":4433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"miner_getstat1\"}\n","payload_hex":"7b22636f6d6d616e64223a20226d696e65725f6765747374617431227d0a","method":"","user_agent":"","ja3":"","session":"470ad810-69de-475e-8f35-1cab6c4700a4","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"7073379c2a3c280b","strings":["{\"command\": \"miner_getstat1\"}"]}},{"timestamp":"2026-10-28T00:38:43","port":4433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"get_miner_info\"}\n","payload_hex":"7b22636f6d6d616e64223a20226765745f6d696e65725f696e666f227d0a","method":"","user_agent":"","ja3":"","session":"bf04fcd4-4ccb-43d7-9c48-077940245c4d","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"d2e894f7f809ec7c","strings":["{\"command\": \"get_miner_info\"}"]}},{"timestamp":"2026-10-28T00:38:42","port":4433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"stats\"}\n","payload_hex":"7b22636f6d6d616e64223a20227374617473227d0a","method":"","user_agent":"","ja3":"","session":"15924cf5-e950-42b1-9b78-29ccd119e327","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"737ebb6ac4b80ff3","strings":["{\"command\": \"stats\"}"]}},{"timestamp":"2026-10-28T00:38:23","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"(\u0000\u0000\u0000{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","payload_hex":"280000007b22636d64223a226765742e6465766963652e696e666f222c22706172616d223a2273616c74227d","method":"","user_agent":"","ja3":"","session":"5a2af208-5e24-49e2-b6b2-a84ed38f864d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dfdfa2b4951e0788","strings":["{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","({\"cmd\":\"get.device.info\",\"param\":\"salt\"}"],"iocs":{"domains":["get.device.info"]}},"interactive":true},{"timestamp":"2026-10-28T00:37:58","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"(\u0000\u0000\u0000{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","payload_hex":"280000007b22636d64223a226765742e6465766963652e696e666f222c22706172616d223a2273616c74227d","method":"","user_agent":"","ja3":"","session":"3e0062fa-c1f5-41e5-b6ed-faf988b9b8a6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dfdfa2b4951e0788","strings":["{\"cmd\":\"get.device.info\",\"param\":\"salt\"}","({\"cmd\":\"get.device.info\",\"param\":\"salt\"}"],"iocs":{"domains":["get.device.info"]}},"interactive":true},{"timestamp":"2026-10-28T00:37:18","port":502,"proto":"tcp","app_proto":"modbus","app_protocol":"modbus","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0000\u0000\u0006\u0001\u0003\u0000\u0000\u0000\u0004","payload_hex":"000100000006010300000004","method":"","user_agent":"","ja3":"","session":"bcd44697-f1fe-445c-ac27-c54294f1f158-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-28T00:37:17","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\":\"poolpriority\",\"parameter\":\"1,0\"}","payload_hex":"7b22636f6d6d616e64223a22706f6f6c7072696f72697479222c22706172616d65746572223a22312c30227d","method":"","user_agent":"","ja3":"","session":"4beb8cc6-5462-47d0-9fff-c0e98910abe2-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"edf318702e8ec524","strings":["{\"command\":\"poolpriority\",\"parameter\":\"1,0\"}"]},"interactive":true},{"timestamp":"2026-10-28T00:37:17","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\":\"pools\"}","payload_hex":"7b22636f6d6d616e64223a22706f6f6c73227d","method":"","user_agent":"","ja3":"","session":"c99db0b8-1e47-4d90-890f-45808eab645f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6391ab0f50452470","strings":["{\"command\":\"pools\"}"]},"interactive":true}],"http_methods":[{"method":"GET","count":2266},{"method":"POST","count":116},{"method":"CONNECT","count":2}],"distinct_ports_total":105,"top_paths":[{"path":"/","count":456,"ports":24},{"path":"/get_minerinfo.cgi","count":119,"ports":21},{"path":"/get_home.cgi","count":112,"ports":20},{"path":"/user/login","count":78,"ports":21},{"path":"/cgi-bin/get_miner_conf.cgi","count":57,"ports":15},{"path":"/cgi-bin/get_system_info.cgi","count":57,"ports":19},{"path":"/cgi-bin/minerStatus.cgi","count":48,"ports":14},{"path":"/metrics","count":47,"ports":13},{"path":"/poolnode/user/login","count":46,"ports":13},{"path":"/api/meta","count":46,"ports":13},{"path":"/upnproot","count":46,"ports":12},{"path":"/description.xml","count":46,"ports":12},{"path":"/rootDesc","count":45,"ports":12},{"path":"/cgi-bin/get_miner_conf","count":44,"ports":11},{"path":"/rootDesc.xml","count":44,"ports":12}],"distinct_paths_total":107,"top_snis":[],"top_hosts":[{"value":"example.com","count":2},{"value":"x","count":1}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Renci.SshNet.SshClient.2026.0.0","count":5}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":34},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":6},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":25}]}