{"ip":"178.128.18.214","total_events":144,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,848 bytes sent","bytes_sent":3848,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-18T22:54:40","last_seen":"2026-09-21T05:16:21","events_24h":0,"events_7d":0,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.314,"lon":103.6839,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":128},{"port":5555,"proto":"tcp","label":"","count":8},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":37215,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":5858,"proto":"tcp","label":"","count":1},{"port":12108,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq040_00050801_2daa70d6","b11cuq030_00040801_c91eaf54","b11cun030_00040011_c91eaf54","b11cuq050_00850801_985b9497"]},"fingerprint_peers":{"b11cuq040_00050801_2daa70d6":92,"b11cun030_00040011_c91eaf54":546,"b11cuq030_00040801_c91eaf54":3,"b11cuq050_00850801_985b9497":3},"akin_families":{"b11cuq040_00050801_2daa70d6":{"head":"b11cuq040_00050801_2daa70d6","shapes":2,"ips":92},"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":547},"b11cuq050_00850801_985b9497":{"head":"b11cuq040_00050801_2daa70d6","shapes":2,"ips":92}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":9},{"date":"2026-09-20","count":3},{"date":"2026-09-21","count":130}],"recent_events":[{"timestamp":"2026-09-21T05:16:21","port":12108,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001c\u0000\u0000\u0000��-�����host::features=shell_v2,cmd\u0000","payload_hex":"434e584e00000001000004001c000000c7d02d88bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d6400","method":"","user_agent":"","ja3":"","session":"f2887b30-b4d7-472a-a9df-940295c126a0","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"3994e7c2838593aa","strings":["CNXN","host::features=shell_v2,cmd"]}},{"timestamp":"2026-09-21T04:27:49","port":5858,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001c\u0000\u0000\u0000��-�����host::features=shell_v2,cmd\u0000","payload_hex":"434e584e00000001000004001c000000c7d02d88bcb1a7b1686f73743a3a66656174757265733d7368656c6c5f76322c636d6400","method":"","user_agent":"","ja3":"","session":"081d1d1d-f617-42a4-ba52-ba0129a7c7e7","seq":1,"duration_ms":100,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"3994e7c2838593aa","strings":["CNXN","host::features=shell_v2,cmd"]}},{"timestamp":"2026-09-21T03:07:07","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SYSMAN\n","payload_hex":"5359534d414e0a","method":"","user_agent":"","ja3":"","session":"2db1e108-068d-46e6-a04c-2d0b2dcddf82","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"0d810601a8a5b6c4","strings":["SYSMAN"]}},{"timestamp":"2026-09-21T03:07:07","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"oem_temp\n","payload_hex":"6f656d5f74656d700a","method":"","user_agent":"","ja3":"","session":"2db1e108-068d-46e6-a04c-2d0b2dcddf82","seq":2,"duration_ms":352,"bytes_in":16,"bytes_out":31,"enriched":{"digest":"18767ce5d033f16a","strings":["oem_temp"]}},{"timestamp":"2026-09-21T03:07:00","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\n","payload_hex":"61646d696e0a","method":"","user_agent":"","ja3":"","session":"25b7d90d-fbc1-4fa0-8461-953fad398e59","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":12,"enriched":{"digest":"4015bc9ee91e437d","strings":["admin"]}},{"timestamp":"2026-09-21T03:07:00","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"1234\n","payload_hex":"313233340a","method":"","user_agent":"","ja3":"","session":"25b7d90d-fbc1-4fa0-8461-953fad398e59","seq":2,"duration_ms":324,"bytes_in":11,"bytes_out":31,"enriched":{"digest":"1be168ff837f043b","strings":["1234"]}},{"timestamp":"2026-09-21T03:06:53","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root\n","payload_hex":"726f6f740a","method":"","user_agent":"","ja3":"","session":"9fda838d-a7d9-42f6-94fb-92f8073804c7","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":12,"enriched":{"digest":"552c0ba71b1046a0","strings":["root"]}},{"timestamp":"2026-09-21T03:06:53","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"xc3511\n","payload_hex":"7863333531310a","method":"","user_agent":"","ja3":"","session":"9fda838d-a7d9-42f6-94fb-92f8073804c7","seq":2,"duration_ms":290,"bytes_in":12,"bytes_out":31,"enriched":{"digest":"112622270511f7f0","strings":["xc3511"]}},{"timestamp":"2026-09-21T03:06:46","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"12345\n","payload_hex":"31323334350a","method":"","user_agent":"","ja3":"","session":"aae1244c-8cae-44af-8998-2b0cbf8ffe54","seq":2,"duration_ms":276,"bytes_in":12,"bytes_out":31,"enriched":{"digest":"2672275fe0c456fb","strings":["12345"]}},{"timestamp":"2026-09-21T03:06:45","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\n","payload_hex":"61646d696e0a","method":"","user_agent":"","ja3":"","session":"aae1244c-8cae-44af-8998-2b0cbf8ffe54","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":12,"enriched":{"digest":"4015bc9ee91e437d","strings":["admin"]}}],"http_methods":[{"method":"POST","count":6},{"method":"GET","count":2}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/UD/act?1","count":2,"ports":1},{"path":"/ctrlt/DeviceUpgrade_1","count":2,"ports":1},{"path":"/cgi-bin/luci/;stok=/domain_login?form=dlogin","count":2,"ports":2}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T16:52:53.850825+00:00"}