{"ip":"195.170.172.128","total_events":899,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"347,286 bytes sent","bytes_sent":347286,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-22T15:01:18","last_seen":"2026-08-11T13:24:01","events_24h":0,"events_7d":0,"geo":{"country_code":"ES","country_name":"Spain","region":"","city":"","lat":40.4172,"lon":-3.684,"asn":41608,"org":"NextGenWebs, S.L."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":50050,"proto":"tcp","label":"","count":359},{"port":443,"proto":"tcp","label":"HTTPS","count":79},{"port":80,"proto":"tcp","label":"HTTP","count":77},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":56},{"port":6666,"proto":"tcp","label":"","count":56},{"port":3333,"proto":"tcp","label":"","count":56},{"port":5555,"proto":"tcp","label":"","count":54},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":46},{"port":7777,"proto":"tcp","label":"Oracle","count":42},{"port":4444,"proto":"tcp","label":"","count":42},{"port":25,"proto":"tcp","label":"SMTP","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["004556e859f3c26c5d19746b3a957c74"],"ja4h":["ge11nn06en_1257db3eebd3","po11nn07en_e8e145d78e03","ge11nn0400_9795830020a3","po11nn09en_7560d3ae9ff8"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":1138,"ge11nn06en_1257db3eebd3":12,"ge11nn0400_9795830020a3":13,"po11nn07en_e8e145d78e03":12,"po11nn09en_7560d3ae9ff8":13},"user_agents":["Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36"],"timeline":[{"date":"2026-05-30","count":15},{"date":"2026-05-31","count":15},{"date":"2026-06-08","count":15},{"date":"2026-06-10","count":12},{"date":"2026-06-11","count":7},{"date":"2026-06-13","count":30},{"date":"2026-06-14","count":15},{"date":"2026-06-16","count":15},{"date":"2026-06-19","count":30},{"date":"2026-07-08","count":34},{"date":"2026-07-09","count":7},{"date":"2026-07-10","count":14},{"date":"2026-07-11","count":14},{"date":"2026-07-12","count":16},{"date":"2026-07-15","count":16},{"date":"2026-08-04","count":16},{"date":"2026-08-09","count":14},{"date":"2026-08-10","count":24},{"date":"2026-08-11","count":6}],"recent_events":[{"timestamp":"2026-08-11T13:24:01","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"authorization\":\"Basic MUdQOHo0cGh3OHp1RTZuMlMzczFYRGR5UHBqUGp1a1JVZzp4\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-length\":\"44\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:25\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"{\"id\": 1, \"method\": \"getwork\", \"params\": []}","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a417574686f72697a6174696f6e3a204261736963204d5564514f486f30634768334f48703152545a754d6c4d7a637a465952475235554842715547703161314a565a7a70340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b226964223a20312c20226d6574686f64223a2022676574776f726b222c2022706172616d73223a205b5d7d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","ja3":"004556e859f3c26c5d19746b3a957c74","session":"be94bb32-a71e-4c4b-9862-ddaab9ceee1d","seq":1,"duration_ms":110,"bytes_in":574,"bytes_out":40},{"timestamp":"2026-08-11T13:23:51","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:25\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","ja3":"004556e859f3c26c5d19746b3a957c74","session":"48ebe9ef-440f-4643-8d31-03ad431374fe","seq":1,"duration_ms":110,"bytes_in":389,"bytes_out":40},{"timestamp":"2026-08-11T13:23:51","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"4848Jsh9wDi7rBQkkrtNWP3FQax2MxQJfWtMYWs3kyCj19osPdjJeUbZFszxpbDeRYcJd4v3oLLUmBVVzLfHtYBkLWGPiaQ\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n","payload_hex":"7b226964223a312c226a736f6e727063223a22322e30222c226d6574686f64223a226c6f67696e222c22706172616d73223a7b226c6f67696e223a22343834384a736839774469377242516b6b72744e57503346516178324d78514a6657744d595773336b79436a31396f7350646a4a6555625a46737a78706244655259634a643476336f4c4c556d4256567a4c66487459426b4c574750696151222c2270617373223a2278222c226167656e74223a22584d5269672f362e31352e33202857696e646f7773204e542031302e303b2057696e36343b2078363429206c696275762f312e34322e30206d7376632f32303139222c22616c676f223a5b22636e2f31222c22636e2f32222c22636e2f72222c22636e2f66617374222c22636e2f68616c66222c22636e2f78616f222c22636e2f72746f222c22636e2f72777a222c22636e2f7a6c73222c22636e2f646f75626c65222c22636e2f636378222c22636e2d6c6974652f31222c22636e2d68656176792f30222c22636e2d68656176792f74756265222c22636e2d68656176792f786876222c22636e2d7069636f222c22636e2d7069636f2f746c6f222c22636e2f75707832222c2272782f30222c2272782f776f77222c2272782f617271222c2272782f6772616674222c2272782f736678222c2272782f6b657661222c226172676f6e322f6368756b7761222c226172676f6e322f6368756b77617632222c226172676f6e322f6e696e6a61222c22617374726f627774225d7d7d0a","method":"","user_agent":"","ja3":"004556e859f3c26c5d19746b3a957c74","session":"96d1ae07-a324-455b-b996-1df7b013db82","seq":1,"duration_ms":9,"bytes_in":558,"bytes_out":40,"enriched":{"digest":"2e36e0da633cf341","strings":["{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"4848Jsh9wDi7rBQkkrtN…"]}},{"timestamp":"2026-08-11T13:23:51","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"{\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"igwrcvap\",\"params\":[\"0x1169daccb817f3df0e5ea36108039bd34da4ac68\",\"x\"],\"jsonrpc\":\"2.0\"}\n","payload_hex":"7b226964223a312c226d6574686f64223a226574685f7375626d69744c6f67696e222c22776f726b6572223a226967777263766170222c22706172616d73223a5b22307831313639646163636238313766336466306535656133363130383033396264333464613461633638222c2278225d2c226a736f6e727063223a22322e30227d0a","method":"","user_agent":"","ja3":"004556e859f3c26c5d19746b3a957c74","session":"0546f99d-9eba-45ee-aef8-298182fa75ed","seq":1,"duration_ms":10,"bytes_in":132,"bytes_out":40,"enriched":{"digest":"117cfe34ac7efc0f","strings":["{\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"igwrcvap\",\"params\":[\"0x1169daccb817…"]}},{"timestamp":"2026-08-11T13:23:51","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumStratum/1.0.0\"]}\n","payload_hex":"7b226964223a20312c20226d6574686f64223a20226d696e696e672e737562736372696265222c2022706172616d73223a205b224d696e65724e616d652f312e302e30222c2022457468657265756d5374726174756d2f312e302e30225d7d0a","method":"","user_agent":"","ja3":"004556e859f3c26c5d19746b3a957c74","session":"706f4dc0-cd31-4c98-854f-05e25dd27596","seq":1,"duration_ms":9,"bytes_in":96,"bytes_out":40,"enriched":{"digest":"375e4b35e60185e1","strings":["{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumS…"],"iocs":{"domains":["mining.subscribe"]}}},{"timestamp":"2026-08-11T13:23:50","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n","payload_hex":"7b226964223a20312c20226d6574686f64223a20226d696e696e672e737562736372696265222c2022706172616d73223a205b226370756d696e65722f322e352e31225d7d0a","method":"","user_agent":"","ja3":"004556e859f3c26c5d19746b3a957c74","session":"7afd2f52-ca5b-45bd-bd49-3f9d1f864616","seq":1,"duration_ms":9,"bytes_in":70,"bytes_out":40,"enriched":{"digest":"82dc0b5800908b9d","strings":["{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}"],"iocs":{"domains":["mining.subscribe"]}}},{"timestamp":"2026-08-10T13:31:51","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"authorization\":\"Basic MHgxY2M3ZmIxMThkM2I2YjQzYWY5MTI5NjU2ODk5ZTEyODBhM2ZlYmYzOng=\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-length\":\"48\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"{\"id\": 1, \"method\": \"eth_getWork\", \"params\": []}","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a417574686f72697a6174696f6e3a204261736963204d48677859324d335a6d49784d54686b4d324932596a517a595759354d5449354e6a55324f446b355a5445794f4442684d325a6c596d597a4f6e673d0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a2034380d0a0d0a7b226964223a20312c20226d6574686f64223a20226574685f676574576f726b222c2022706172616d73223a205b5d7d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","ja3":"004556e859f3c26c5d19746b3a957c74","session":"fa705903-56bb-40b2-b8d2-2533062ad786","seq":1,"duration_ms":196,"bytes_in":590,"bytes_out":80},{"timestamp":"2026-08-10T13:31:50","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"authorization\":\"Basic MTVyWHc0dEVUQVdkelpzVnJpYks1aTNWMWpXc3AxVmNpVTp4\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-length\":\"44\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"{\"id\": 1, \"method\": \"getwork\", \"params\": []}","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a417574686f72697a6174696f6e3a204261736963204d54567957486330644556555156646b656c707a566e4a70596b733161544e574d57705863334178566d4e70565470340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b226964223a20312c20226d6574686f64223a2022676574776f726b222c2022706172616d73223a205b5d7d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","ja3":"004556e859f3c26c5d19746b3a957c74","session":"e7bffa5e-c407-4ef7-8c99-efe32dd36c85","seq":1,"duration_ms":194,"bytes_in":574,"bytes_out":80},{"timestamp":"2026-08-10T13:31:50","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","ja3":"004556e859f3c26c5d19746b3a957c74","session":"a7d5e5ba-c715-4987-ba21-46bdb1338ea5","seq":1,"duration_ms":194,"bytes_in":389,"bytes_out":80},{"timestamp":"2026-08-10T13:31:49","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"47GqcicFynvHEboS29e65oQNn2H2QQtKT9gppyWLRzU1SoL3b4hzk38RQi4uNtjNoNSbMVJ8avEotBgQuW8Sq1DPB3Ke8oX\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n","payload_hex":"7b226964223a312c226a736f6e727063223a22322e30222c226d6574686f64223a226c6f67696e222c22706172616d73223a7b226c6f67696e223a223437477163696346796e764845626f5332396536356f514e6e3248325151744b543967707079574c527a5531536f4c336234687a6b333852516934754e746a4e6f4e53624d564a386176456f74426751755738537131445042334b65386f58222c2270617373223a2278222c226167656e74223a22584d5269672f362e31352e33202857696e646f7773204e542031302e303b2057696e36343b2078363429206c696275762f312e34322e30206d7376632f32303139222c22616c676f223a5b22636e2f31222c22636e2f32222c22636e2f72222c22636e2f66617374222c22636e2f68616c66222c22636e2f78616f222c22636e2f72746f222c22636e2f72777a222c22636e2f7a6c73222c22636e2f646f75626c65222c22636e2f636378222c22636e2d6c6974652f31222c22636e2d68656176792f30222c22636e2d68656176792f74756265222c22636e2d68656176792f786876222c22636e2d7069636f222c22636e2d7069636f2f746c6f222c22636e2f75707832222c2272782f30222c2272782f776f77222c2272782f617271222c2272782f6772616674222c2272782f736678222c2272782f6b657661222c226172676f6e322f6368756b7761222c226172676f6e322f6368756b77617632222c226172676f6e322f6e696e6a61222c22617374726f627774225d7d7d0a","method":"","user_agent":"","ja3":"004556e859f3c26c5d19746b3a957c74","session":"9afca682-be3d-4e84-b4c0-798e2f870954","seq":1,"duration_ms":205,"bytes_in":558,"bytes_out":15,"enriched":{"digest":"f37634af3d93bdc0","strings":["{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"47GqcicFynvHEboS29e6…"]}}],"http_methods":[{"method":"GET","count":343},{"method":"POST","count":202}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":323,"ports":11},{"path":"stager64","count":37,"ports":4},{"path":"/WuEL","count":37,"ports":4},{"path":"/a","count":37,"ports":4},{"path":"/mPlayer","count":37,"ports":4},{"path":"/SiteLoader","count":37,"ports":4},{"path":"/download/file.ext","count":37,"ports":4}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Authorization","Cache-Control","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","notable":false},{"name":"Accept-Language","value":"en;q=0.9","notable":false},{"name":"Authorization","value":"Basic MUdQOHo0cGh3OHp1RTZuMlMzczFYRGR5UHBqUGp1a1JVZzp4","notable":true},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"44","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:25","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":5},"tags":[],"data_as_of":"2026-08-25T21:07:32.094942+00:00"}