{"ip":"120.7.73.28","data_as_of":"2026-10-20T14:24:46+00:00","observed":true,"total_events":1156,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive login(s) succeeded","confidence":"high","network_type":"network service provider","why":["1 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1,156 event(s) from this address as well.","Not in any known-scanner range.","Sent 1,400,852 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,400,852 bytes sent","bytes_sent":1400852,"session_seconds":2,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T05:55:35","last_seen":"2026-10-18T14:28:08","events_24h":0,"events_7d":1156,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"ssh","sessions":2}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-18T05:55:35","last_seen":"2026-10-18T05:58:05","verdicts":[{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":2}],"services":[{"protocol":"ssh","port":38,"sessions":2}],"logins":[{"username":"root","password":"TheArmorOfGod","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-18T05:58:03"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":38,"proto":"tcp","label":"","count":1003,"sessions":2},{"port":27,"proto":"tcp","label":"","count":153,"sessions":0}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":447},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":1156,"sessions":2}],"recent_events":[{"timestamp":"2026-10-18T14:28:08","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014����c�D�'���\n\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��j��=a�\u0001�Ѯ ","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14e1f3858a63fdefa392449d27a5feff0a000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000f7c86a9ac13d61b701d1d1ae7f20","method":"","user_agent":"","ja3":"","session":"63e80d58-fbf9-4994-b974-5e0703ff07f4","seq":1,"duration_ms":462,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"af1848c2845ecf4e","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:27:52","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014P�v\u000f��˿k�Ex�Mcj\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000f�>�����|M`p��","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1450dc760fb4b2cbbf6bed4578d24d636a000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000000fb93ef7b2bac9de7c4d6070e184","method":"","user_agent":"","ja3":"","session":"82aafc6a-00f9-40e4-8751-68e8570f442d","seq":1,"duration_ms":405,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"dc54fa5f004905aa","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","|M`p"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:27:37","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014\u0004��Iy\u001e��\u001f��3��\u000e�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����E�/1�\u001d�l��","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14049fbd49791e94f51fe2f433f38f0e87000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000e2d0c5c545ba2f31e11daf6cacf6","method":"","user_agent":"","ja3":"","session":"1a9c9997-d7bd-4267-96f3-3d509d41d2d4","seq":1,"duration_ms":443,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"a0915a7cc5349310","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:27:21","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�\u000fN����\u0011н]2!���\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000l��\t�\"�Evk4l\u0007�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14ef0f4eb4b2fee511d0bd5d3221a9e2cd000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000006cf4a809cb229045766b346c07ad","method":"","user_agent":"","ja3":"","session":"3ca4eb72-826f-493e-bd8c-72007d9442b9","seq":1,"duration_ms":515,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"befecaee786cc5e2","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","Evk4l","nonel"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:27:05","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014\u0002_B�\u0000��=FV��V���\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000T�N�\u000bG�����K�%","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14025f429a00afeb3d4656abe35682b9e5000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000054b94ea40b47d8fcaa89fb4bfe25","method":"","user_agent":"","ja3":"","session":"ca58acfe-30c0-45ce-a31a-e915f465f77c","seq":1,"duration_ms":431,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"f70fd55a926e6b29","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneT"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:26:50","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014-|�q\u000b�0�ݽ\u0019�I�4�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000h�J+��Uey\u0019;k�8","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e142d7ca4710b8430a5ddbd199949f134d9000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000068c34a2bc8ec556579193b6ba838","method":"","user_agent":"","ja3":"","session":"cbe98453-8446-4829-bfdd-dda05206dc60","seq":1,"duration_ms":435,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"f8486601bf87ed98","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneh"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:26:35","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014˘\u001c�=\u0015\b\b)W�.\b,��\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(���_�-���9�M�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14cb981c973d15080829578b2e082cf3fd000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000028888fa65fbe2df69ff739f44dc4","method":"","user_agent":"","ja3":"","session":"fffae783-3517-48dc-91bd-1c3ac5a5464a","seq":1,"duration_ms":465,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"a9f658ddbe2ba983","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","none("],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:26:19","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014\nY���S�]�O\u0018\u001b��OR\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�b<\u0019��\u0005�\u0012����@","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e140a59b1f19f53f15dff4f181ba5974f52000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000b3623c19c7ef05e112f89bd4db40","method":"","user_agent":"","ja3":"","session":"6e9276e7-39a4-4285-86b4-e32a68a1e68e","seq":1,"duration_ms":486,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"a5969bf461c7f299","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:26:03","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014`��i�H�\u0013\u000e��p��#2\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000O�v�\\���,j�G\u001c\r","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1460c7cc69e948c8130ee2fe70cfc22332000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000004ffb76b55ce982d02c6ad1471c0d","method":"","user_agent":"","ja3":"","session":"e57ab1e2-fd59-45a2-ad4a-c75113377e54","seq":1,"duration_ms":420,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"4af0e6539796ea58","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneO"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T14:25:48","port":27,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�R\u0010/���^\nF5c\u001e\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I�b�۾{��}� l�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14e152102f8bbfef8ea0ea5e0a4635631e000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000049e5628ddbbe7baade7d94206cb8","method":"","user_agent":"","ja3":"","session":"8b88945a-9baf-42b0-b2fd-6d05387cfdd9","seq":1,"duration_ms":456,"bytes_in":1217,"bytes_out":11,"enriched":{"digest":"eb13db9cd28c1c16","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneI"],"iocs":{"domains":["libssh.org","openssh.com"]}}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":1154}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}