{"ip":"138.124.108.76","data_as_of":"2026-10-26T05:44:56+00:00","observed":true,"total_events":19,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2,600 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["2,600 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 19 event(s) from this address as well.","Not in any known-scanner range.","Sent 240,181 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"240,181 bytes sent","bytes_sent":240181,"session_seconds":8,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T01:45:58","last_seen":"2026-10-26T05:30:10","events_24h":0,"events_7d":19,"interactive_sessions":8002,"interactive_sessions_24h":1473,"interactive_sessions_7d":7854,"interactive_protocols":[{"protocol":"cgminer-api","sessions":7448},{"protocol":"http","sessions":445},{"protocol":"ssh","sessions":12},{"protocol":"telnet","sessions":3},{"protocol":"stratum","sessions":3},{"protocol":"sccp","sessions":1},{"protocol":"dnp3","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":210644,"org":"Aeza Group LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as210644","label":"Aéza","category":"isp","url":"https://www.peeringdb.com/asn/210644"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":8010,"first_seen":"2026-10-18T01:45:58","last_seen":"2026-10-26T05:30:10","verdicts":[{"verdict":"scan","sessions":4887},{"verdict":"post-exploitation","sessions":2600},{"verdict":"unknown","sessions":519},{"verdict":"credential","sessions":4}],"personas":[{"persona":"miner@cgminer 4.11.1","sessions":7451},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":307},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":104},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":31},{"persona":"linux-ubuntu@20.04","sessions":15},{"persona":"snmp@net-snmp 5.8","sessions":8},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":3},{"persona":"ics@Siemens S7-1200","sessions":1},{"persona":"sccp@CUCM 11.5","sessions":1}],"services":[{"protocol":"cgminer-api","port":4028,"sessions":7448},{"protocol":"http","port":80,"sessions":405},{"protocol":"http","port":443,"sessions":28},{"protocol":"tcp","port":4433,"sessions":25},{"protocol":"tcp","port":4029,"sessions":16},{"protocol":"snmp","port":161,"sessions":8},{"protocol":"tcp","port":8888,"sessions":7},{"protocol":"tcp","port":5175,"sessions":7},{"protocol":"tcp","port":8889,"sessions":7},{"protocol":"ssh","port":2222,"sessions":7},{"protocol":"tcp","port":47123,"sessions":7},{"protocol":"http","port":8080,"sessions":6}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-18T21:29:01"}],"commands":[{"ts":"2026-10-18T21:29:01","session_id":"6edd797a-14ed-41b4-a912-1446d83aa1b9","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo RA-SHELL-OK; uname -a; head -c 200 /etc/openwrt_release 2>/dev/null; for f in /config/bmminer.conf /etc/bmminer.conf /etc/cgminer.conf /config/cgminer.conf /etc/config/cgminer /etc/luxminer.d/*.json /etc/braiins/asic/miner.json /hive-config/rig.conf; do [ -f \"$f\" ] && echo \"== $f\" && head -c 4000 \"$f\"; done","exit_code":1}],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4887},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":5},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":5},{"technique_id":"T1496","technique_name":"Resource Hijacking","tactic_id":"TA0040","tactic_name":"Impact","sessions":2599}]},"top_ports":[{"port":4028,"proto":"tcp","label":"","count":13,"sessions":7448},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":405},{"port":4433,"proto":"tcp","label":"","count":6,"sessions":25},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":28},{"port":4029,"proto":"tcp","label":"","count":0,"sessions":16},{"port":47123,"proto":"tcp","label":"","count":0,"sessions":7},{"port":2222,"proto":"tcp","label":"SSH-alt","count":0,"sessions":7},{"port":5175,"proto":"tcp","label":"","count":0,"sessions":7},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":7},{"port":8889,"proto":"tcp","label":"","count":0,"sessions":7},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":6},{"port":31337,"proto":"tcp","label":"","count":0,"sessions":6},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":5},{"port":9997,"proto":"tcp","label":"HTTP","count":0,"sessions":5},{"port":9999,"proto":"tcp","label":"","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":[],"interactive":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":688,"aae6b9604f6f3356543709a376d7f657":1},"akin_families":{},"user_agents":["ra-probe","Python-urllib/3.12","RouterAudit-Wave/1.0","Mozilla/5.0 (RouterAudit-research)"],"timeline":[{"date":"2026-10-18","count":0,"sessions":143},{"date":"2026-10-19","count":0,"sessions":8},{"date":"2026-10-20","count":7,"sessions":541},{"date":"2026-10-21","count":0,"sessions":1071},{"date":"2026-10-22","count":0,"sessions":1343},{"date":"2026-10-23","count":0,"sessions":1542},{"date":"2026-10-24","count":12,"sessions":1508},{"date":"2026-10-25","count":0,"sessions":1473},{"date":"2026-10-26","count":0,"sessions":373}],"recent_events":[{"timestamp":"2026-10-26T05:30:10","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e67dab4c-51a9-4ca2-8f65-5f32b44b8818-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T05:30:10","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\":\"pools\"}","payload_hex":"7b22636f6d6d616e64223a22706f6f6c73227d","method":"","user_agent":"","ja3":"","session":"e67dab4c-51a9-4ca2-8f65-5f32b44b8818-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6391ab0f50452470","strings":["{\"command\":\"pools\"}"]},"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"addpool\", \"parameter\": \"stratum+tcp://btc.viabtc.io:3333,sadsajfjsdf.ra185228081226,123\"}","payload_hex":"7b22636f6d6d616e64223a2022616464706f6f6c222c2022706172616d65746572223a20227374726174756d2b7463703a2f2f6274632e7669616274632e696f3a333333332c73616473616a666a7364662e72613138353232383038313232362c313233227d","method":"","user_agent":"","ja3":"","session":"cd59adbb-97b2-4746-a46e-a96aaae9b1db-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"09098b11d84fa69b","strings":["{\"command\": \"addpool\", \"parameter\": \"stratum+tcp://btc.viabtc.io:3333,sadsajfjsd…"],"iocs":{"domains":["btc.viabtc.io"]}},"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n","payload_hex":"0d0a","method":"","user_agent":"","ja3":"","session":"cd59adbb-97b2-4746-a46e-a96aaae9b1db-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"summary\"}","payload_hex":"7b22636f6d6d616e64223a202273756d6d617279227d","method":"","user_agent":"","ja3":"","session":"e2a830ec-d083-448e-bc24-bbe5ff11bd45-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"52afe6f55df5081e","strings":["{\"command\": \"summary\"}"]},"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n","payload_hex":"0d0a","method":"","user_agent":"","ja3":"","session":"e2a830ec-d083-448e-bc24-bbe5ff11bd45-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"enablepool\"}","payload_hex":"7b22636f6d6d616e64223a2022656e61626c65706f6f6c227d","method":"","user_agent":"","ja3":"","session":"4e49a4ee-9f83-42a2-b3df-c5f43667c9e8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3b55dc940e68ac69","strings":["{\"command\": \"enablepool\"}"]},"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n","payload_hex":"0d0a","method":"","user_agent":"","ja3":"","session":"4e49a4ee-9f83-42a2-b3df-c5f43667c9e8-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"disablepool\"}","payload_hex":"7b22636f6d6d616e64223a202264697361626c65706f6f6c227d","method":"","user_agent":"","ja3":"","session":"1e1e9e10-d569-4e68-95ff-acdf285c2dd6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6650fe6e16d40c7c","strings":["{\"command\": \"disablepool\"}"]},"interactive":true},{"timestamp":"2026-10-26T05:03:16","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n","payload_hex":"0d0a","method":"","user_agent":"","ja3":"","session":"1e1e9e10-d569-4e68-95ff-acdf285c2dd6-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":24},{"method":"POST","count":4}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":15,"ports":2},{"path":"/login","count":1,"ports":1},{"path":"/miner","count":1,"ports":1},{"path":"/admin","count":1,"ports":1},{"path":"/api","count":1,"ports":1},{"path":"/api/v1","count":1,"ports":1},{"path":"/pools","count":1,"ports":1},{"path":"/api/pools","count":1,"ports":1},{"path":"/cgi-bin/task","count":1,"ports":1},{"path":"/api/status","count":1,"ports":1},{"path":"/dashboard","count":1,"ports":1},{"path":"/user/machineconfig","count":1,"ports":1},{"path":"/cgi-bin/update_miner_conf.cgi","count":1,"ports":1},{"path":"/wp-includes/js/dist/hooks.min.js","count":1,"ports":1},{"path":"/cgi-bin/set_miner_conf.cgi","count":1,"ports":1}],"distinct_paths_total":15,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":2600},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}