{"ip":"15.204.122.159","data_as_of":"2026-10-26T20:46:36+00:00","observed":true,"total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["2 interactive session(s) logged in and ran commands.","3 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1 event(s) from this address as well.","Not in any known-scanner range.","Held a session open for 4930s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"984 bytes sent, longest session 4930s","bytes_sent":984,"session_seconds":4930,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-22T02:55:50","last_seen":"2026-10-25T20:26:53","events_24h":0,"events_7d":1,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"ssh","sessions":5}],"geo":{"country_code":"US","country_name":"United States","region":"Oregon","city":"Hillsboro","lat":45.526,"lon":-122.9874,"asn":16276,"org":"OVH SAS"},"source_domain":"vps-bf35355b.vps.ovh.us","known_scanners":[],"scanner_tag":{"key":"peeringdb:as16276","label":"OVHcloud","category":"cdn","url":"https://www.peeringdb.com/asn/16276"},"cve_matches":[],"malware":[{"sha256":"70b9cc8db3c3c084d750ff81a5da73cd4bc1111f234d583981f7b05d915cb9c0","family":"","vt_name":"","malicious":0,"total":0,"vt_status":"","delivery":"interactive session","url_path":"","dest_port":22,"hits":1,"last_seen":"2026-10-25 15:44:18"},{"sha256":"b8d1a6d3cae79ed2da2ef6a68f69a24a4945898b926e8974d42a578fd662ab6d","family":"","vt_name":"__down","malicious":0,"total":74,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":22,"hits":1,"last_seen":"2026-10-25 15:44:18"}],"udp":null,"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-24T19:45:36","last_seen":"2026-10-25T20:26:53","verdicts":[{"verdict":"credential","sessions":2},{"verdict":"post-exploitation","sessions":2},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":5}],"services":[{"protocol":"ssh","port":22,"sessions":5}],"logins":[{"username":"root","password":"R00t","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-25T19:04:43"},{"username":"22","password":"root|R00t","password_sent":true,"service":"ssh-password","outcome":"failure","tries":1,"last_seen":"2026-10-25T20:24:51"}],"commands":[{"ts":"2026-10-25T19:04:44","session_id":"5bb1b1e7-1319-45f2-aa0a-5b5205108f69","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep processor","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"head -c 15000000 /dev/zero 2>/dev/null | curl -s --max-time 45 -o /dev/null -w '%{speed_upload}' --data-binary @- '[https]://speed[.]cloudflare[.]com/__up' 2>/dev/null","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"curl -s --max-time 45 -o /dev/null -w '%{speed_download}' '[https]://speed[.]cloudflare[.]com/__down?bytes=25000000' 2>/dev/null","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"command -v speedtest >/dev/null 2>&1 && echo var","exit_code":1},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"command -v speedtest-cli >/dev/null 2>&1 && echo var","exit_code":1},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"curl -s --max-time 12 '[http]://ip-api[.]com/json/?fields=countryCode,city' 2>/dev/null || wget -qO- -T 12 '[http]://ip-api[.]com/json/?fields=countryCode,city' 2>/dev/null","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"df -h / 2>/dev/null | awk 'NR>1{print $2; exit}'","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"free -m 2>/dev/null","exit_code":0},{"ts":"2026-10-25T15:44:18","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc 2>/dev/null","exit_code":0},{"ts":"2026-10-25T15:44:17","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":". /etc/os-release 2>/dev/null && echo \"$PRETTY_NAME\"","exit_code":0},{"ts":"2026-10-25T15:44:17","session_id":"f6817b9a-8f22-430e-b130-e1b760c61336","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo CMDCHK_7f3a9e21","exit_code":0}],"downloads":[{"url":"[https]://speed[.]cloudflare[.]com/__up","host":"speed[.]cloudflare[.]com","sessions":1,"first_seen":"2026-10-25T15:44:18","last_seen":"2026-10-25T15:44:18","virustotal":null},{"url":"[http]://ip-api[.]com/json/?fields=countryCode,city","host":"ip-api[.]com","sessions":1,"first_seen":"2026-10-25T15:44:18","last_seen":"2026-10-25T15:44:18","virustotal":null},{"url":"[https]://speed[.]cloudflare[.]com/__down?bytes=25000000","host":"speed[.]cloudflare[.]com","sessions":1,"first_seen":"2026-10-25T15:44:18","last_seen":"2026-10-25T15:44:18","virustotal":{"sha256":"b8d1a6d3cae79ed2da2ef6a68f69a24a4945898b926e8974d42a578fd662ab6d","status":"known","malicious":0,"total":74,"name":"__down"}}],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":3},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":4},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":5},{"port":80,"proto":"tcp","label":"HTTP","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["4c94058d5e9e31659879f79fd5b46084"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":["4c94058d5e9e31659879f79fd5b46084"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"4c94058d5e9e31659879f79fd5b46084":0,"b11cun050_00040017_976354f0":1243},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1243}},"user_agents":["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"],"timeline":[{"date":"2026-10-22","count":1,"sessions":0},{"date":"2026-10-24","count":0,"sessions":1},{"date":"2026-10-25","count":0,"sessions":4}],"recent_events":[{"timestamp":"2026-10-25T19:04:44","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /proc/cpuinfo | grep processor","payload_hex":"636174202f70726f632f637075696e666f207c20677265702070726f636573736f72","method":"","user_agent":"","ja3":"","session":"5bb1b1e7-1319-45f2-aa0a-5b5205108f69-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8062c95b7681fb57","strings":["cat /proc/cpuinfo | grep processor"],"iocs":{"paths":["/proc/cpuinfo"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"head -c 15000000 /dev/zero 2>/dev/null | curl -s --max-time 45 -o /dev/null -w '%{speed_upload}' --data-binary @- 'https://speed.cloudflare.com/__up' 2>/dev/null","payload_hex":"68656164202d63203135303030303030202f6465762f7a65726f20323e2f6465762f6e756c6c207c206375726c202d73202d2d6d61782d74696d65203435202d6f202f6465762f6e756c6c202d772027257b73706565645f75706c6f61647d27202d2d646174612d62696e61727920402d202768747470733a2f2f73706565642e636c6f7564666c6172652e636f6d2f5f5f75702720323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c95599fce3bd9b5b","strings":["head -c 15000000 /dev/zero 2>/dev/null | curl -s --max-time 45 -o /dev/null -w '…"],"iocs":{"paths":["/dev/zero","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"curl -s --max-time 45 -o /dev/null -w '%{speed_download}' 'https://speed.cloudflare.com/__down?bytes=25000000' 2>/dev/null","payload_hex":"6375726c202d73202d2d6d61782d74696d65203435202d6f202f6465762f6e756c6c202d772027257b73706565645f646f776e6c6f61647d27202768747470733a2f2f73706565642e636c6f7564666c6172652e636f6d2f5f5f646f776e3f62797465733d32353030303030302720323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0f580f55fcd5a313","strings":["curl -s --max-time 45 -o /dev/null -w '%{speed_download}' 'https://speed.cloudfl…"],"iocs":{"urls":["https://speed.cloudfl…"],"domains":["speed.cloudfl"],"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"command -v speedtest >/dev/null 2>&1 && echo var","payload_hex":"636f6d6d616e64202d7620737065656474657374203e2f6465762f6e756c6c20323e2631202626206563686f20766172","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e8863f655ac353d2","strings":["command -v speedtest >/dev/null 2>&1 && echo var"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"command -v speedtest-cli >/dev/null 2>&1 && echo var","payload_hex":"636f6d6d616e64202d76207370656564746573742d636c69203e2f6465762f6e756c6c20323e2631202626206563686f20766172","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e400d0feeb03e1a7","strings":["command -v speedtest-cli >/dev/null 2>&1 && echo var"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"curl -s --max-time 12 'http://ip-api.com/json/?fields=countryCode,city' 2>/dev/null || wget -qO- -T 12 'http://ip-api.com/json/?fields=countryCode,city' 2>/dev/null","payload_hex":"6375726c202d73202d2d6d61782d74696d652031322027687474703a2f2f69702d6170692e636f6d2f6a736f6e2f3f6669656c64733d636f756e747279436f64652c636974792720323e2f6465762f6e756c6c207c7c2077676574202d714f2d202d542031322027687474703a2f2f69702d6170692e636f6d2f6a736f6e2f3f6669656c64733d636f756e747279436f64652c636974792720323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b9bacd24a10c22f4","strings":["curl -s --max-time 12 'http://ip-api.com/json/?fields=countryCode,city' 2>/dev/n…"],"iocs":{"urls":["http://ip-api.com/json/?fields=countryCode,city"],"domains":["ip-api.com"],"paths":["/ip-api.com/json","/dev/n"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"df -h / 2>/dev/null | awk 'NR>1{print $2; exit}'","payload_hex":"6466202d68202f20323e2f6465762f6e756c6c207c2061776b20274e523e317b7072696e742024323b20657869747d27","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7b13b6cc5bf1dc00","strings":["df -h / 2>/dev/null | awk 'NR>1{print $2; exit}'"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"free -m 2>/dev/null","payload_hex":"66726565202d6d20323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf7b563b88fb8596","strings":["free -m 2>/dev/null"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:18","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nproc 2>/dev/null","payload_hex":"6e70726f6320323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8c34c40996bf1e58","strings":["nproc 2>/dev/null"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T15:44:17","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":". /etc/os-release 2>/dev/null && echo \"$PRETTY_NAME\"","payload_hex":"2e202f6574632f6f732d72656c6561736520323e2f6465762f6e756c6c202626206563686f2022245052455454595f4e414d4522","method":"","user_agent":"","ja3":"","session":"f6817b9a-8f22-430e-b130-e1b760c61336-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a16dd6b318b64f3f","strings":[". /etc/os-release 2>/dev/null && echo \"$PRETTY_NAME\""],"iocs":{"paths":["/etc/os-release","/dev/null"]}},"interactive":true}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/.env","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":2},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":2},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":4}]}