{"ip":"109.120.179.192","data_as_of":"2026-10-27T09:04:05+00:00","observed":true,"total_events":8819,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 exploit-path hits","confidence":"high","network_type":"network service provider","why":["12 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 11,111,870 bytes, which is sustained payload delivery.","Counts include 12,088 interactive session(s) as well as first-packet events.","Interactive sessions: 66 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,111,870 bytes sent","bytes_sent":11111870,"session_seconds":51,"persistent":false},"basis":"combined"},"first_seen":"2026-10-22T02:28:26","last_seen":"2026-10-27T01:29:47","events_24h":3,"events_7d":8819,"interactive_sessions":12088,"interactive_sessions_24h":24,"interactive_sessions_7d":12088,"interactive_protocols":[{"protocol":"http","sessions":553},{"protocol":"cgminer-api","sessions":346},{"protocol":"telnet","sessions":69},{"protocol":"socks5","sessions":65},{"protocol":"stratum","sessions":54},{"protocol":"ssh","sessions":35},{"protocol":"tls","sessions":24},{"protocol":"dns","sessions":13},{"protocol":"rdp","sessions":9},{"protocol":"kerberos","sessions":9},{"protocol":"memcached","sessions":7},{"protocol":"ftp","sessions":7},{"protocol":"http-proxy","sessions":7},{"protocol":"modbus","sessions":4},{"protocol":"afp","sessions":1},{"protocol":"socks4","sessions":1},{"protocol":"xmpp","sessions":1},{"protocol":"atg","sessions":1},{"protocol":"imap","sessions":1},{"protocol":"snmp","sessions":1},{"protocol":"sunrpc","sessions":1},{"protocol":"minecraft","sessions":1},{"protocol":"iec104","sessions":1},{"protocol":"smb","sessions":1},{"protocol":"msrpc","sessions":1},{"protocol":"ldap","sessions":1},{"protocol":"rtsp","sessions":1}],"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":210644,"org":"Aeza Group LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as210644","label":"Aéza","category":"isp","url":"https://www.peeringdb.com/asn/210644"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":29,"protocols":[{"protocol":"udp","events":29}],"ports":[{"port":161,"events":25},{"port":123,"events":4}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-22T14:06:15","last_seen":"2026-10-26T15:38:12","recent":[{"timestamp":"2026-10-26T15:38:12","port":161,"src_port":47618,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006huawei��Kd�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006687561776569a0e94b64ff000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"6f26b65d-316b-4d5f-b346-6adad7afdec7","bytes_in":60,"source_verified":false,"enriched":{"digest":"2d2443afb6bdb1b5","strings":["huawei"]}},{"timestamp":"2026-10-26T15:38:04","port":161,"src_port":47618,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007default���P�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000764656661756c74a0adbc50a6000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"f8cef4c8-07fe-4099-aeaa-a21d876f964c","bytes_in":61,"source_verified":false,"enriched":{"digest":"935809da1883d92c","strings":["default"]}},{"timestamp":"2026-10-26T15:37:56","port":161,"src_port":47618,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006router�`-�U\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006726f75746572a0602d8d55000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"41d95445-3dc5-4262-88b8-516ecf19bcf7","bytes_in":60,"source_verified":false,"enriched":{"digest":"b3f1a50a722d5d45","strings":["router"]}},{"timestamp":"2026-10-26T15:37:48","port":161,"src_port":47618,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007manager�$��\u001c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000076d616e61676572a0249eb81c000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"b6e644a3-e81d-475e-91ac-cdf00b311554","bytes_in":61,"source_verified":false,"enriched":{"digest":"9924458ad2726e82","strings":["manager"]}},{"timestamp":"2026-10-26T15:37:36","port":161,"src_port":47618,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006public�\u0018�\u001cL\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000067075626c6963a018f01c4c000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"e166e559-6502-4691-a50b-e7507399d140","bytes_in":60,"source_verified":false,"enriched":{"digest":"87c1b2ec662a975b","strings":["public"]}},{"timestamp":"2026-10-26T15:37:18","port":123,"src_port":42167,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","sni":"","session":"d2316b9e-473d-4c89-8842-979754e02cfd","bytes_in":48,"source_verified":false},{"timestamp":"2026-10-25T16:08:29","port":161,"src_port":58302,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006huawei��]��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006687561776569a0e25dc8fc000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"52460d42-c366-4a90-a83e-5c0d2773be87","bytes_in":60,"source_verified":false,"enriched":{"digest":"d9228a7976b4f6f9","strings":["huawei"]}},{"timestamp":"2026-10-25T16:08:21","port":161,"src_port":58302,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007default���<�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000764656661756c74a0a6a93ca2000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"165e9572-252d-4b7b-8d4e-37c102bc58c2","bytes_in":61,"source_verified":false,"enriched":{"digest":"f09b1d99cdf8bced","strings":["default"]}},{"timestamp":"2026-10-25T16:08:13","port":161,"src_port":58302,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006router�k8!V\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006726f75746572a06b382156000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"10858cc9-89b7-435d-91c8-b0e004807386","bytes_in":60,"source_verified":false,"enriched":{"digest":"c91d15086b4480f6","strings":["router","k8!V"]}},{"timestamp":"2026-10-25T16:08:05","port":161,"src_port":58302,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007manager�/�T\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000076d616e61676572a02f8b5400000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"6e3c0fca-411d-443f-ac50-73c8d17562e5","bytes_in":61,"source_verified":false,"enriched":{"digest":"36602a5ee5ed0562","strings":["manager"]}},{"timestamp":"2026-10-25T16:07:55","port":123,"src_port":40490,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","sni":"","session":"e040ed2f-a373-43e4-8d6a-1978eeb95204","bytes_in":48,"source_verified":false},{"timestamp":"2026-10-25T16:07:53","port":161,"src_port":58302,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006public�\u0013�xR\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000067075626c6963a013e57852000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"641e36ac-6175-4a39-86dd-ba1edec9820d","bytes_in":60,"source_verified":false,"enriched":{"digest":"c9fc98019266dc39","strings":["public"]}},{"timestamp":"2026-10-25T04:42:13","port":161,"src_port":35780,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006huawei���v�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006687561776569a0e0ca769d000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"aebe92a0-767b-490c-a390-90608be78d75","bytes_in":60,"source_verified":false,"enriched":{"digest":"3e037088cc126467","strings":["huawei"]}},{"timestamp":"2026-10-25T04:42:11","port":161,"src_port":35780,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007default��=n�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000764656661756c74a0a43d6ed3000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"2adc9dd0-49c1-455b-b661-680eb9bbce36","bytes_in":61,"source_verified":false,"enriched":{"digest":"a6f5d32b0cba3ede","strings":["default"]}},{"timestamp":"2026-10-25T04:42:09","port":161,"src_port":35780,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006router�i�J\u0015\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006726f75746572a069ac4a15000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"b9bc4d17-99ff-48e8-89d3-2a3211074f6d","bytes_in":60,"source_verified":false,"enriched":{"digest":"c63e9077353e83c8","strings":["router"]}},{"timestamp":"2026-10-25T04:42:07","port":161,"src_port":35780,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007manager�-\u001fWS\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000076d616e61676572a02d1f5753000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"2d8b6974-7e0e-464c-8c96-211f85aef705","bytes_in":61,"source_verified":false,"enriched":{"digest":"22ec14482d6c66f8","strings":["manager"]}},{"timestamp":"2026-10-25T04:42:05","port":123,"src_port":49015,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"\u001b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","sni":"","session":"c573c061-5125-45cd-9088-3c19bc9592ec","bytes_in":48,"source_verified":false},{"timestamp":"2026-10-25T04:42:04","port":161,"src_port":35780,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006public�\u0011q�i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000067075626c6963a011719869000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"5e2cb53d-6d60-4024-b84f-6e34b8ab09e2","bytes_in":60,"source_verified":false,"enriched":{"digest":"f72b604570da0ebf","strings":["public"]}},{"timestamp":"2026-10-22T14:09:29","port":161,"src_port":41997,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006huawei���2z\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006687561776569a0f5be327a000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"aa3ea1b5-fb6c-422e-ab55-252f92e7d91f","bytes_in":60,"source_verified":false,"enriched":{"digest":"9c7241e91b5fdfc3","strings":["huawei"]}},{"timestamp":"2026-10-22T14:09:19","port":161,"src_port":41997,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007default��I\u0002�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000764656661756c74a0b14902cc000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"83a01ced-ca9b-4f44-b068-9874c0d19c3a","bytes_in":61,"source_verified":false,"enriched":{"digest":"91c2cf67796aaa18","strings":["default"]}},{"timestamp":"2026-10-22T14:09:14","port":161,"src_port":41997,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006router�|� �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"0000000100000006726f75746572a07cd820d4000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"d4660a7e-9d53-47a5-ab92-2f91e22955f1","bytes_in":60,"source_verified":false,"enriched":{"digest":"c3ba326882ae1d70","strings":["router"]}},{"timestamp":"2026-10-22T14:09:12","port":161,"src_port":41997,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0007manager�8kM\u0012\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000076d616e61676572a0386b4d12000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"a48b7b6f-feac-4478-bed9-e0c4f7b07842","bytes_in":61,"source_verified":false,"enriched":{"digest":"9a83418387f8d554","strings":["manager"]}},{"timestamp":"2026-10-22T14:09:09","port":161,"src_port":41997,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006public�\u0004\u0005��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"00000001000000067075626c6963a00405b3a8000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"100bb84c-9bde-4c70-9718-1d25e9bdc2d5","bytes_in":60,"source_verified":false,"enriched":{"digest":"66efeb6e37a461e2","strings":["public"]}},{"timestamp":"2026-10-22T14:06:29","port":161,"src_port":41179,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u00040000���\u0005J\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000430303030a08bf0054a000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"cc132ecd-7354-4ca9-b8da-250bd44cd4bd","bytes_in":58,"source_verified":false,"enriched":{"digest":"73fb685a31bde0e2","strings":["0000"]}},{"timestamp":"2026-10-22T14:06:26","port":161,"src_port":41179,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0005admin�W�b�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0000\u0006\u0007+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0000","payload_hex":"000000010000000561646d696ea0578762b9000000000000000006072b060102010101000006072b060102010105000006072b0601020101060000","sni":"","session":"0bc6f4f9-1c01-4d66-a153-ea72f707f6f5","bytes_in":59,"source_verified":false,"enriched":{"digest":"33273130b92f9127","strings":["admin"]}}]},"interaction":{"window_days":90,"sessions":12151,"first_seen":"2026-10-22T02:28:26","last_seen":"2026-10-27T01:38:32","verdicts":[{"verdict":"unknown","sessions":11079},{"verdict":"scan","sessions":1000},{"verdict":"post-exploitation","sessions":66},{"verdict":"credential","sessions":6}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":480},{"persona":"miner@cgminer 4.11.1","sessions":400},{"persona":"linux-ubuntu@20.04","sessions":104},{"persona":"proxy@squid/5.7","sessions":73},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":44},{"persona":"snmp@net-snmp 5.8","sessions":35},{"persona":"dns@dnsmasq 2.80","sessions":13},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, mikrotik@6.49.10, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":11},{"persona":"kerberos@Windows Server 2019","sessions":9},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1, gitlab@19.4.2","sessions":9},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3, gitlab@19.4.2","sessions":9}],"services":[{"protocol":"cgminer-api","port":4028,"sessions":346},{"protocol":"http","port":443,"sessions":53},{"protocol":"http","port":8443,"sessions":48},{"protocol":"telnet","port":23,"sessions":37},{"protocol":"tcp","port":161,"sessions":34},{"protocol":"telnet","port":2323,"sessions":32},{"protocol":"ssh","port":22,"sessions":29},{"protocol":"stratum","port":3334,"sessions":29},{"protocol":"socks5","port":9050,"sessions":25},{"protocol":"socks5","port":1081,"sessions":24},{"protocol":"tftp","port":69,"sessions":22},{"protocol":"http","port":93,"sessions":21}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"ssh-password","outcome":"success","tries":11,"last_seen":"2026-10-22T13:28:44"},{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":6,"last_seen":"2026-10-27T01:29:26"},{"username":"admin","password":"user","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-22T14:09:55"},{"username":"routeraudit.probe","password":"x","password_sent":true,"service":"stratum-authorize","outcome":"success","tries":3,"last_seen":"2026-10-22T14:15:54"},{"username":"root","password":"bitmain","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-22T14:59:51"},{"username":"default","password":"VIDEO","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-22T14:07:08"}],"commands":[{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:27","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -1 /etc/luxminer.d/*.json 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-27T01:29:26","session_id":"1413b477-9caa-44de-9c73-e30770344cf8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:25","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-27T01:29:24","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -1 /etc/luxminer.d/*.json 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-27T01:29:24","session_id":"22ddd7c2-5034-4265-b58a-fefa3a508c5f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-26T15:00:28","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:28","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -1 /etc/luxminer.d/*.json 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"a18333b1-f9e9-4974-ad56-cd1264641233","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -1 /etc/luxminer.d/*.json 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T15:00:27","session_id":"15d3200a-ef5b-4339-8b7f-a73c187dd4f1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-25T20:48:13","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:13","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:13","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"a96565c4-2cd4-4294-8c15-24eee5b35072","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /hive-config/rig.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"a96565c4-2cd4-4294-8c15-24eee5b35072","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/braiins/asic/miner.json 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"a96565c4-2cd4-4294-8c15-24eee5b35072","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/luxminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -1 /etc/luxminer.d/*.json 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-25T20:48:12","session_id":"778dac73-f14d-4774-886e-1c50940aece7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK","exit_code":0},{"ts":"2026-10-25T20:48:12","session_id":"a96565c4-2cd4-4294-8c15-24eee5b35072","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/bmminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-25T20:48:12","session_id":"a96565c4-2cd4-4294-8c15-24eee5b35072","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /config/cgminer.conf 2>/dev/null","exit_code":1}],"downloads":[],"files":[{"sha256":"d2bea9a2470419ca4576d42bfcf0606dddb57abd0eff06735d5b5f180e57452f","name":"lanscan.py","size":864,"mime_type":"text/plain","kind":"shell-write","times":4,"first_seen":"2026-10-22T13:26:36","last_seen":"2026-10-22T13:28:36","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1000},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":27},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":21},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":27},{"technique_id":"T1496","technique_name":"Resource Hijacking","tactic_id":"TA0040","tactic_name":"Impact","sessions":46}]},"top_ports":[{"port":4028,"proto":"tcp","label":"CGMINER-API","count":0,"sessions":346},{"port":443,"proto":"tcp","label":"HTTPS","count":229,"sessions":53},{"port":8444,"proto":"tcp","label":"","count":158,"sessions":15},{"port":4433,"proto":"tcp","label":"","count":158,"sessions":13},{"port":8333,"proto":"tcp","label":"Bitcoin","count":158,"sessions":13},{"port":55400,"proto":"tcp","label":"","count":162,"sessions":7},{"port":8560,"proto":"tcp","label":"","count":162,"sessions":5},{"port":5000,"proto":"tcp","label":"Web-alt","count":158,"sessions":9},{"port":1534,"proto":"tcp","label":"","count":158,"sessions":7},{"port":8555,"proto":"tcp","label":"","count":162,"sessions":2},{"port":8559,"proto":"tcp","label":"","count":162,"sessions":0},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":159,"sessions":3},{"port":4066,"proto":"tcp","label":"","count":158,"sessions":2},{"port":4067,"proto":"tcp","label":"","count":158,"sessions":2},{"port":50051,"proto":"tcp","label":"","count":158,"sessions":0}],"fingerprints":{"ssh_hassh":["d055c93eb832f05741824c5d6eeb7251","87e3d9ffee0540b0390f8a5b9c343c08"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e","t13i3111h2_e8f1e7e78f70_b26ce05bbdd6"],"tls_client_hello":"1603010103010000ff0303c709dc729161e209903b3be71a1289ee1095e50d3a91e88c78854d61d5d16b9e2059aec2058eb2c7e9bf0c7c76bb34419e7903c6a1c9e2394e84b419b77471b2a60018130213031301c02cc02bc030c02fc024c023c028c02700ff0100009e000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000005000501000000000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d002042cd8fc8a8eb5e5182f292210394ccf53e8d4356d442e10cdb898a72ed9d8e","tls_ja3":["64415168a62acdefdaa061ac3ae40abc","78f0dc5ac5b19daf131a133cfdee9691"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun030_00040012_f983b7ce","b11cuq060_00850812_1a0049ff","b11cun050_00440412_e41ea0b6"],"interactive":{"ssh_hassh":["87e3d9ffee0540b0390f8a5b9c343c08","d055c93eb832f05741824c5d6eeb7251"],"tls_ja4":["t13i121000_a538d02d76d5_f6eeaf393d2e","t13i3111h2_e8f1e7e78f70_b26ce05bbdd6"],"tls_ja3":["64415168a62acdefdaa061ac3ae40abc","78f0dc5ac5b19daf131a133cfdee9691"]}},"fingerprint_peers":{"t13i3111h2_e8f1e7e78f70_b26ce05bbdd6":20,"b11cun010_00040000_c4b2c4aa":931,"t13i121000_a538d02d76d5_f6eeaf393d2e":4,"d055c93eb832f05741824c5d6eeb7251":3,"87e3d9ffee0540b0390f8a5b9c343c08":14,"b11cun050_00440412_e41ea0b6":6,"b11cun030_00040012_f983b7ce":8,"b11cuq060_00850812_1a0049ff":6},"akin_families":{"b11cun030_00040012_f983b7ce":{"head":"b11cun030_00040012_f983b7ce","shapes":2,"ips":8},"b11cuq060_00850812_1a0049ff":{"head":"b11cuq060_00850812_1a0049ff","shapes":2,"ips":6}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) RouterAudit/1.0","curl/8.5.0"],"timeline":[{"date":"2026-10-22","count":8810,"sessions":12005},{"date":"2026-10-23","count":0,"sessions":18},{"date":"2026-10-25","count":6,"sessions":41},{"date":"2026-10-26","count":3,"sessions":12},{"date":"2026-10-27","count":0,"sessions":12}],"recent_events":[{"timestamp":"2026-10-27T01:29:38","port":11212,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"version\r\n","payload_hex":"76657273696f6e0d0a","method":"","user_agent":"","ja3":"","session":"d210e92b-742a-485b-ba93-93fe7aafce53-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d1a9b5f9ca3064cf","label":"Memcached","strings":["version"]},"interactive":true},{"timestamp":"2026-10-27T01:29:38","port":11210,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"version\r\n","payload_hex":"76657273696f6e0d0a","method":"","user_agent":"","ja3":"","session":"51f38522-55c3-4636-9f27-f0da869268a9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d1a9b5f9ca3064cf","label":"Memcached","strings":["version"]},"interactive":true},{"timestamp":"2026-10-27T01:29:35","port":11211,"proto":"tcp","app_proto":"memcached","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"version\r\n","payload_hex":"76657273696f6e0d0a","method":"","user_agent":"","ja3":"","session":"2412ffd2-5174-4cb5-97d4-ddacd2b65712-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d1a9b5f9ca3064cf","label":"Memcached","strings":["version"]},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /hive-config/rig.conf 2>/dev/null","payload_hex":"636174202f686976652d636f6e6669672f7269672e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ae75104cca734333","strings":["cat /hive-config/rig.conf 2>/dev/null"],"iocs":{"domains":["rig.conf"],"paths":["/hive-config/rig.conf","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /etc/braiins/asic/miner.json 2>/dev/null","payload_hex":"636174202f6574632f62726169696e732f617369632f6d696e65722e6a736f6e20323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bb69c77aead7d1a5","strings":["cat /etc/braiins/asic/miner.json 2>/dev/null"],"iocs":{"paths":["/etc/braiins/asic/miner.json","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /etc/luxminer.conf 2>/dev/null","payload_hex":"636174202f6574632f6c75786d696e65722e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8018f1094214e35c","strings":["cat /etc/luxminer.conf 2>/dev/null"],"iocs":{"domains":["luxminer.conf"],"paths":["/etc/luxminer.conf","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /etc/bmminer.conf 2>/dev/null","payload_hex":"636174202f6574632f626d6d696e65722e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"22ae98f2b6d70dab","strings":["cat /etc/bmminer.conf 2>/dev/null"],"iocs":{"domains":["bmminer.conf"],"paths":["/etc/bmminer.conf","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /config/cgminer.conf 2>/dev/null","payload_hex":"636174202f636f6e6669672f63676d696e65722e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b079dcc123c47f54","strings":["cat /config/cgminer.conf 2>/dev/null"],"iocs":{"domains":["cgminer.conf"],"paths":["/config/cgminer.conf","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /etc/cgminer.conf 2>/dev/null","payload_hex":"636174202f6574632f63676d696e65722e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1f4708dec35ddf2f","strings":["cat /etc/cgminer.conf 2>/dev/null"],"iocs":{"domains":["cgminer.conf"],"paths":["/etc/cgminer.conf","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-27T01:29:27","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /config/bmminer.conf 2>/dev/null","payload_hex":"636174202f636f6e6669672f626d6d696e65722e636f6e6620323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"1413b477-9caa-44de-9c73-e30770344cf8-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"91fbca557cfefef3","strings":["cat /config/bmminer.conf 2>/dev/null"],"iocs":{"domains":["bmminer.conf"],"paths":["/config/bmminer.conf","/dev/null"]}},"interactive":true}],"http_methods":[{"method":"GET","count":9629},{"method":"POST","count":562},{"method":"CONNECT","count":56}],"distinct_ports_total":10294,"top_paths":[{"path":"/","count":2933,"ports":61},{"path":"/get_minerinfo.cgi","count":385,"ports":61},{"path":"/get_home.cgi","count":383,"ports":61},{"path":"/cgi-bin/get_system_info.cgi","count":193,"ports":61},{"path":"/cgi-bin/minerStatus.cgi","count":161,"ports":61},{"path":"/user/login","count":155,"ports":59},{"path":"/cgi-bin/get_miner_conf.cgi","count":154,"ports":61},{"path":"/cgi-bin/get_miner_info.cgi","count":152,"ports":61},{"path":"/cgi-bin/miner_info.cgi","count":152,"ports":61},{"path":"/cgi-bin/get_miner_conf","count":152,"ports":61},{"path":"/api/system/info","count":151,"ports":61},{"path":"/cgi-bin/get_blade_info.cgi","count":150,"ports":61},{"path":"/cgi-bin/get_network_info.cgi","count":150,"ports":61},{"path":"/cgi-bin/get_miner_status.cgi","count":149,"ports":61},{"path":"/metrics","count":142,"ports":61}],"distinct_paths_total":281,"top_snis":[],"top_hosts":[{"value":"example.com","count":56},{"value":"x","count":4}],"top_alpns":[],"banners":[{"value":"SSH-2.0-Renci.SshNet.SshClient.2026.0.0","count":6}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":66},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":21},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":27}]}