{"ip":"176.65.139.206","total_events":22,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,763 bytes sent","bytes_sent":1763,"session_seconds":2,"persistent":false}},"first_seen":"2026-08-31T08:45:44","last_seen":"2026-09-10T01:06:10","events_24h":0,"events_7d":19,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2023-1389","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/luci/;stok=/locale?form=country"}],"malware":[{"sha256":"8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27","family":"mirai","vt_name":"wget.sh","malicious":21,"total":75,"vt_status":"uploaded","delivery":"tftp","url_path":"/cgi-bin/luci/;stok=/locale?form=country","dest_port":8080,"hits":3,"last_seen":"2026-09-01 00:08:21"}],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":18},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0600_99a8bce9aba9","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"po11nn0600_99a8bce9aba9":4,"ge11nn0400_9c3956fad5da":1564},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0"],"timeline":[{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":18}],"recent_events":[{"timestamp":"2026-09-10T01:06:10","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\n","payload_hex":"61646d696e0a","method":"","user_agent":"","ja3":"","session":"eab2098f-395c-4a00-a617-979dd0b5556a","seq":2,"duration_ms":1390,"bytes_in":7,"bytes_out":19,"enriched":{"digest":"4015bc9ee91e437d","strings":["admin"]}},{"timestamp":"2026-09-10T01:06:09","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"eab2098f-395c-4a00-a617-979dd0b5556a","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:53","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"bdb680f9-dc97-448a-b577-8fb454a3b79b","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:47","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"09ac9c98-6de3-41c8-aa7f-44721a54bab7","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:41","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root\n","payload_hex":"726f6f740a","method":"","user_agent":"","ja3":"","session":"bda9e7ce-642c-4d38-91af-3b9ee188b667","seq":2,"duration_ms":1133,"bytes_in":6,"bytes_out":19,"enriched":{"digest":"552c0ba71b1046a0","strings":["root"]}},{"timestamp":"2026-09-10T01:05:40","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"bda9e7ce-642c-4d38-91af-3b9ee188b667","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:29","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"197d1264-9a1f-402d-9df4-f1258844d714","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:21","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ubnt\n","payload_hex":"75626e740a","method":"","user_agent":"","ja3":"","session":"aac4f75d-f76a-4a50-9e6b-b35ea6958536","seq":2,"duration_ms":1152,"bytes_in":6,"bytes_out":19,"enriched":{"digest":"7b10e3f5a5b9579c","strings":["ubnt"]}},{"timestamp":"2026-09-10T01:05:20","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"aac4f75d-f76a-4a50-9e6b-b35ea6958536","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":7},{"timestamp":"2026-09-10T01:05:14","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"1234\n","payload_hex":"313233340a","method":"","user_agent":"","ja3":"","session":"1f65ba95-cf33-49ea-b7b8-11ad59d0dc1a","seq":3,"duration_ms":1482,"bytes_in":11,"bytes_out":38,"enriched":{"digest":"1be168ff837f043b","strings":["1234"]}}],"http_methods":[{"method":"POST","count":2},{"method":"GET","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/cgi-bin/luci/;stok=/locale?form=country","count":2,"ports":1},{"path":"/login","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2023-1389","tag_type":"cve","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/luci/;stok=/locale?form=country","reference_urls":["https://www.tenable.com/security/research/tra-2023-11","https://nvd.nist.gov/vuln/detail/CVE-2023-1389","https://github.com/tenable/poc-cve-2023-1389"]}],"data_as_of":"2026-09-11T18:51:24.255191+00:00"}