{"ip":"109.95.35.200","data_as_of":"2026-10-26T23:39:49+00:00","observed":true,"total_events":6,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network service provider","why":["12 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","The first-packet sensors recorded 6 event(s) from this address as well.","Not in any known-scanner range.","Sent 7,290 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,290 bytes sent","bytes_sent":7290,"session_seconds":1,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-23T18:51:36","last_seen":"2026-10-23T19:02:57","events_24h":0,"events_7d":6,"interactive_sessions":14,"interactive_sessions_24h":0,"interactive_sessions_7d":14,"interactive_protocols":[{"protocol":"smb","sessions":14}],"geo":{"country_code":"UA","country_name":"Ukraine","region":"Kirovohrad Oblast","city":"Kropyvnytskyi","lat":48.5161,"lon":32.2581,"asn":31725,"org":"ISP Shtorm LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31725","label":"ISP Shtorm LTD","category":"isp","url":"https://www.peeringdb.com/asn/31725"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":14,"first_seen":"2026-10-23T18:51:36","last_seen":"2026-10-23T19:02:57","verdicts":[{"verdict":"exploit-attempt","sessions":12},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"smb@Windows Server 2019","sessions":14}],"services":[{"protocol":"smb","port":445,"sessions":14}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":12},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":12},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":12}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":6,"sessions":14}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-23","count":6,"sessions":14}],"recent_events":[{"timestamp":"2026-10-23T19:02:55","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"14bee768-b414-4322-a5fa-bd35f5fb698d","seq":1,"duration_ms":100,"bytes_in":137,"bytes_out":13,"enriched":{"digest":"bf5baf1504bec0a1","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12"]}},{"timestamp":"2026-10-23T19:02:55","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"544cb5c3-a1a2-430f-b8ca-0448a7d92246","seq":1,"duration_ms":100,"bytes_in":137,"bytes_out":13,"enriched":{"digest":"bf5baf1504bec0a1","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12"]}},{"timestamp":"2026-10-23T19:02:55","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000'�SMBt\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u0002�\u0000'\u0000\u0000\u0000","payload_hex":"00000027ff534d4274000000001807c00000000000000000000000000108fffe0008410002ff0027000000","method":"","user_agent":"","ja3":"","session":"ca4d2a11-1d5e-4457-a9f0-a31b402a0218-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0a05219afec9b71b","strings":["SMBt"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#�SMBq\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u0000\u0000\u0000","payload_hex":"00000023ff534d4271000000001807c00000000000000000000000000108fffe00084100000000","method":"","user_agent":"","ja3":"","session":"ca4d2a11-1d5e-4457-a9f0-a31b402a0218-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6d2d0801175b8b79","strings":["SMBq"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000D�\u0014\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c000000010000000000000044cb140000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"ca4d2a11-1d5e-4457-a9f0-a31b402a0218-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cd890f65bedd6cc2","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000'�SMBt\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u0002�\u0000'\u0000\u0000\u0000","payload_hex":"00000027ff534d4274000000001807c00000000000000000000000000108fffe0008410002ff0027000000","method":"","user_agent":"","ja3":"","session":"4dc9f272-1f46-4d4c-9c37-89efb9b6a3c0-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0a05219afec9b71b","strings":["SMBt"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000^�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\b@\u0000\u0004�\u0000^\u0000\b\u0000\u0001\u00003\u0000\u0000\\\u0000\\\u00001\u00008\u00005\u0000.\u00002\u00002\u00008\u0000.\u00008\u00001\u0000.\u00002\u00002\u00006\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000","payload_hex":"0000005eff534d4275000000001807c00000000000000000000000000000fffe0008400004ff005e00080001003300005c005c003100380035002e003200320038002e00380031002e003200320036005c00490050004300240000003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"ca4d2a11-1d5e-4457-a9f0-a31b402a0218-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"eee9477c53abb5da","strings":["SMBu","3\\\\185.228.81.226\\IPC$?????"],"iocs":{"ips":["185.228.81.226"]}},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#�SMBq\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u0000\u0000\u0000","payload_hex":"00000023ff534d4271000000001807c00000000000000000000000000108fffe00084100000000","method":"","user_agent":"","ja3":"","session":"4dc9f272-1f46-4d4c-9c37-89efb9b6a3c0-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6d2d0801175b8b79","strings":["SMBq"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000","payload_hex":"00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000","method":"","user_agent":"","ja3":"","session":"ca4d2a11-1d5e-4457-a9f0-a31b402a0218-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ee47b9d34e56607b","strings":["SMBs","KWindows 2000 2195Windows 2000 5.0"]},"interactive":true},{"timestamp":"2026-10-23T19:02:54","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�S�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c0000000100000000000000f753d90000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"4dc9f272-1f46-4d4c-9c37-89efb9b6a3c0-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"794a0048a7473bf0","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":12}]}