{"ip":"190.52.38.11","data_as_of":"2026-10-26T22:48:23+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 7,528 bytes, which is sustained payload delivery.","Held a session open for 564s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"7,528 bytes sent, longest session 564s","bytes_sent":7528,"session_seconds":564,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-22T09:07:40","last_seen":"2026-10-22T09:17:04","events_24h":0,"events_7d":0,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"telnet","sessions":2}],"geo":{"country_code":"AR","country_name":"Argentina","region":"","city":"","lat":null,"lon":null,"asn":52312,"org":"TV MUSIC HOUSE JUJUY"},"source_domain":"host11.190-52-38.wirenet.com.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as52312","label":"TV MUSIC HOUSE JUJUY","category":"isp","url":"https://www.peeringdb.com/asn/52312"},"cve_matches":[],"malware":[{"sha256":"708f333620e94e21cb7b0a9c12b91bd18173ecfa0e67c56dcbf0554c80ea9ffe","family":"","vt_name":"wget.sh","malicious":1,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-22 09:17:04"}],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-22T09:07:40","last_seen":"2026-10-22T09:17:04","verdicts":[{"verdict":"credential","sessions":1},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":2}],"services":[{"protocol":"telnet","port":23,"sessions":2}],"logins":[{"username":"root","password":"5up","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-22T09:07:44"},{"username":"Admin","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-22T09:07:38"}],"commands":[{"ts":"2026-10-22T09:17:03","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:17:02","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:17:01","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:17:00","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:58","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:57","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:56","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:55","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:53","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:52","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:51","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:50","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:48","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:47","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:46","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:45","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:43","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:42","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:41","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:40","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:38","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:37","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:36","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:34","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:33","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:32","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:31","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:29","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:28","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:27","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:26","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:24","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:23","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:22","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:21","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:19","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:18","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:17","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:16","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:14","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:13","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:12","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:11","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:09","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:08","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:07","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:05","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:04","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:03","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-22T09:16:02","session_id":"0b313ffd-8220-4a84-aeca-dbdad226a98a","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0}],"downloads":[{"url":"tftp[.]sh","host":"","sessions":1,"first_seen":"2026-10-22T09:17:04","last_seen":"2026-10-22T09:17:04","virustotal":null},{"url":"[http]://45[.]198[.]224[.]89/curl.sh","host":"45[.]198[.]224[.]89","sessions":1,"first_seen":"2026-10-22T09:17:04","last_seen":"2026-10-22T09:17:04","virustotal":null},{"url":"[http]://45[.]198[.]224[.]89/wget.sh","host":"45[.]198[.]224[.]89","sessions":1,"first_seen":"2026-10-22T09:17:04","last_seen":"2026-10-22T09:17:04","virustotal":{"sha256":"708f333620e94e21cb7b0a9c12b91bd18173ecfa0e67c56dcbf0554c80ea9ffe","status":"uploaded","malicious":1,"total":75,"name":"wget.sh"}}],"files":[{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","name":"tftp","size":0,"mime_type":"application/x-empty","kind":"executed","times":13,"first_seen":"2026-10-22T09:07:50","last_seen":"2026-10-22T09:07:54","virustotal":{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","status":"known","malicious":0,"total":75,"name":"android-cts-7.1_r6-linux_x86-arm.zip"}},{"sha256":"ca930c3e385c72fe51714122ee21f0ea280e9b6d6116255addd71aa3d39e7224","name":"curl","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":2,"first_seen":"2026-10-22T09:07:59","last_seen":"2026-10-22T09:07:59","virustotal":null},{"sha256":"4cd055836b17e7257019eaa141e7c4dafa3fe493fc27c4b2e3746b385b47a78f","name":"wget","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":2,"first_seen":"2026-10-22T09:07:51","last_seen":"2026-10-22T09:07:51","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-22","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-22T09:17:03","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-942","seq":942,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:17:02","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-940","seq":940,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:17:01","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-938","seq":938,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:17:00","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-936","seq":936,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:58","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-934","seq":934,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:57","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-932","seq":932,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-930","seq":930,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:55","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-928","seq":928,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:53","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-926","seq":926,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-22T09:16:52","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0b313ffd-8220-4a84-aeca-dbdad226a98a-924","seq":924,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}