{"ip":"112.25.55.8","observed":true,"total_events":6327,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["8 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access, not a probe.","The first-packet sensors recorded 6,327 event(s) from this address as well.","Not in any known-scanner range.","Sent 7,621,959 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,621,959 bytes sent","bytes_sent":7621959,"session_seconds":16,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-17T21:32:03","last_seen":"2026-10-20T08:08:47","events_24h":3009,"events_7d":6327,"interactive_sessions":17,"interactive_sessions_24h":7,"interactive_sessions_7d":17,"interactive_protocols":[{"protocol":"ssh","sessions":17}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":56046,"org":"China Mobile communications corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":17,"first_seen":"2026-10-17T21:32:03","last_seen":"2026-10-20T05:46:13","verdicts":[{"verdict":"unknown","sessions":9},{"verdict":"credential","sessions":8}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":17}],"services":[{"protocol":"ssh","port":10,"sessions":4},{"protocol":"ssh","port":4,"sessions":4},{"protocol":"ssh","port":1,"sessions":3},{"protocol":"ssh","port":6,"sessions":2},{"protocol":"ssh","port":7,"sessions":2},{"protocol":"ssh","port":3,"sessions":2}],"logins":[{"username":"root","password":"TheArmorOfGod","password_sent":true,"service":"ssh-password","outcome":"success","tries":8,"last_seen":"2026-10-20T05:46:12"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":8},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":8}]},"top_ports":[{"port":4,"proto":"tcp","label":"","count":1747,"sessions":4},{"port":3,"proto":"tcp","label":"","count":1641,"sessions":2},{"port":2,"proto":"tcp","label":"","count":889,"sessions":0},{"port":10,"proto":"tcp","label":"","count":749,"sessions":4},{"port":9,"proto":"tcp","label":"","count":606,"sessions":0},{"port":7,"proto":"tcp","label":"","count":430,"sessions":2},{"port":8,"proto":"tcp","label":"","count":163,"sessions":0},{"port":5,"proto":"tcp","label":"","count":102,"sessions":0},{"port":1,"proto":"tcp","label":"SSH","count":0,"sessions":3},{"port":6,"proto":"tcp","label":"SSH","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":445},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-17","count":308,"sessions":6},{"date":"2026-10-18","count":3010,"sessions":4},{"date":"2026-10-20","count":3009,"sessions":7}],"recent_events":[{"timestamp":"2026-10-20T08:08:47","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014ڻ��^8�@`m���0\u0015�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00001�8;ח\u0002�5e:\u0019q9","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14dabbf0fe5e38d740606df9e1cb30159a000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000031fc383bd797028235653a197139","method":"","user_agent":"","ja3":"","session":"185803e3-6a1f-476d-90a8-7a34724009c6","seq":1,"duration_ms":408,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"43454bedc801d9e1","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","none1"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:08:25","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014y@���i�����1�J5\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$�Z�$\u001a�\u0015k]��\u0001�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e147940d4cbd67f69a5a19bbda731c14a35000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000024d25af1241a9c156b5da9b60191","method":"","user_agent":"","ja3":"","session":"3ff8a281-e2ff-4d7c-9c56-a9431f73d63f","seq":1,"duration_ms":421,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"7807986c3e1c47a7","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","none$"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:08:03","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�1M��\u0006�Xy\u0010�'�+�\u0002\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�n��Me3�\u001a�50�.","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14ca314dd0da06cd587910f327e02bd002000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000a46e90964d6533951a9a3530e72e","method":"","user_agent":"","ja3":"","session":"b1a77499-2bbc-4b3b-aec8-72fa755df195","seq":1,"duration_ms":372,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"43c69560e39b5447","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:07:41","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�%�(-�#'yY>���T�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001a�ُb��4�\u0003�)�_","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14c125f2282dcf232779593e8aa79a54a5000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000001acbd98f62a7f5348a038e29805f","method":"","user_agent":"","ja3":"","session":"d371e1cc-afeb-4697-a6a6-9c0741cbda72","seq":1,"duration_ms":418,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"3aa685d90b9e65ed","label":"SSH","strings":["SSH-2.0-OpenSSH","#'yY>","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:07:19","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014Tƹ�VY\rBt\u00012�\u0015ԥ�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\r�w�3(��O\u0017�)K","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1454c6b9c556590d42740132ab15d4a5d6000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000a90dd777ea332893cc4f17ee294b","method":"","user_agent":"","ja3":"","session":"290c8677-c01a-442e-823c-bd938ca79282","seq":1,"duration_ms":456,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"d2ed8e33270ff36d","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:06:57","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014��5>��oɿ-�nsT��\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ѽsGw�z\u0016�G��\u001b|","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14bea3353ef38d6fc9bf2dbd6e735483bc000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000d1bd7347778f7a16d3479dbe1b7c","method":"","user_agent":"","ja3":"","session":"c0db5e6f-11c6-4ddd-8ecd-1941f9905e37","seq":1,"duration_ms":384,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"509fb38c3903281a","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:06:35","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u00140�a�\u0019Kl�j:P��8��\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\bv_��\u0007��\u0007��y��","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1430a361d5194b6c9b6a3a50a2d9388380000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000008765fcde807889c078fca79b3cf","method":"","user_agent":"","ja3":"","session":"cd675850-b1ef-48c2-8410-91f8dfe6072d","seq":1,"duration_ms":410,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"2695c41238bbd7a2","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:06:13","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�\u0016��5!���Q�KhR\u001c�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�p\u0006>��$�\t\u001f�(3\u001b","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14ef16a6da3521b6b98451d54b68521cec000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000e570063eee9324ef091ff928331b","method":"","user_agent":"","ja3":"","session":"310f490e-7211-4ee7-a4e7-c3b8707c3ce6","seq":1,"duration_ms":412,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"2e9b5c344aa0c35f","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:05:50","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�\u0000\u0016�M&�\f#\u001eFM��Md\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001�\u000e\u001f��7u;���o\u000b","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14a00016e04d26ba0c231e464dd5e24d64000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000001d00e1fb8c237753b8faadd6f0b","method":"","user_agent":"","ja3":"","session":"bdf91d18-a59a-4311-b5d9-6f93aabfc77a","seq":1,"duration_ms":1227,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"640bb6aeebb0256c","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T08:05:27","port":7,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014DЫ��Å.�����\u001d)�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002۬�\u000bdM�t\u000f�콱","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1444d0aba69ec3852ef28fcbe4ed1d2981000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000002dbacc30b644da7740fc7ecbdb1","method":"","user_agent":"","ja3":"","session":"4de048b3-58d4-4959-b9d4-2d50e90b7358","seq":1,"duration_ms":410,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"b7f72cd10eac3e9d","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":6316}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":8}],"data_as_of":"2026-10-20T12:15:20.448001+00:00"}