{"ip":"216.219.89.86","total_events":90,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 7,724 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,724 bytes sent","bytes_sent":7724,"session_seconds":7,"persistent":false}},"first_seen":"2026-08-14T15:36:01","last_seen":"2026-09-30T12:53:21","events_24h":0,"events_7d":14,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":19318,"org":"Interserver, Inc"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as19318","label":"InterServer","category":"cdn","url":"https://www.peeringdb.com/asn/19318"},"cve_matches":[],"malware":[],"top_ports":[{"port":5038,"proto":"tcp","label":"","count":85},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4310h1_c7886603b240_7379471da272"],"tls_client_hello":"","tls_ja3":["b4c1f3d7ee0a286259123c39e5109569"],"http_akin":["b11cuq070_00050817_81cd6514","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i4310h1_c7886603b240_7379471da272":0,"b11cuq070_00050817_81cd6514":309,"b11cun050_00040017_976354f0":1275},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1275}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"],"timeline":[{"date":"2026-08-14","count":3},{"date":"2026-08-15","count":10},{"date":"2026-08-16","count":2},{"date":"2026-08-17","count":5},{"date":"2026-08-19","count":10},{"date":"2026-08-20","count":6},{"date":"2026-08-21","count":6},{"date":"2026-08-22","count":2},{"date":"2026-08-23","count":6},{"date":"2026-08-24","count":4},{"date":"2026-08-25","count":2},{"date":"2026-08-26","count":6},{"date":"2026-08-27","count":2},{"date":"2026-08-28","count":4},{"date":"2026-08-29","count":4},{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":2},{"date":"2026-09-26","count":2},{"date":"2026-09-27","count":4},{"date":"2026-09-29","count":4},{"date":"2026-09-30","count":2}],"recent_events":[{"timestamp":"2026-09-30T12:53:21","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"c49ddb73-572d-4918-8f5e-5367ccba55f1","seq":2,"duration_ms":7329,"bytes_in":92,"bytes_out":26,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-09-30T12:53:14","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nActionID: 1\r\nUsername: cron\r\nSecret: 12345\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a416374696f6e49443a20310d0a557365726e616d653a2063726f6e0d0a5365637265743a2031323334350d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"c49ddb73-572d-4918-8f5e-5367ccba55f1","seq":1,"duration_ms":100,"bytes_in":74,"bytes_out":13,"enriched":{"digest":"b3bc86853b037a10","strings":["Action: Login","ActionID: 1","Username: cron","Secret: 12345","Events: off"]}},{"timestamp":"2026-09-29T21:10:51","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"1e40be95-da27-44bb-83d9-f09053171924","seq":2,"duration_ms":7124,"bytes_in":92,"bytes_out":26,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-09-29T21:10:44","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nActionID: 1\r\nUsername: cron\r\nSecret: 12345\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a416374696f6e49443a20310d0a557365726e616d653a2063726f6e0d0a5365637265743a2031323334350d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"1e40be95-da27-44bb-83d9-f09053171924","seq":1,"duration_ms":100,"bytes_in":74,"bytes_out":13,"enriched":{"digest":"b3bc86853b037a10","strings":["Action: Login","ActionID: 1","Username: cron","Secret: 12345","Events: off"]}},{"timestamp":"2026-09-29T13:34:54","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"05c46336-1d19-4e14-a6f5-1953039c529d","seq":2,"duration_ms":7125,"bytes_in":92,"bytes_out":26,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-09-29T13:34:47","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nActionID: 1\r\nUsername: cron\r\nSecret: 12345\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a416374696f6e49443a20310d0a557365726e616d653a2063726f6e0d0a5365637265743a2031323334350d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"05c46336-1d19-4e14-a6f5-1953039c529d","seq":1,"duration_ms":100,"bytes_in":74,"bytes_out":13,"enriched":{"digest":"b3bc86853b037a10","strings":["Action: Login","ActionID: 1","Username: cron","Secret: 12345","Events: off"]}},{"timestamp":"2026-09-27T19:56:04","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"dd522e57-a142-4d2a-b900-ca9a0ab6cdd6","seq":2,"duration_ms":7188,"bytes_in":92,"bytes_out":26,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-09-27T19:55:57","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nActionID: 1\r\nUsername: cron\r\nSecret: admin\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a416374696f6e49443a20310d0a557365726e616d653a2063726f6e0d0a5365637265743a2061646d696e0d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"dd522e57-a142-4d2a-b900-ca9a0ab6cdd6","seq":1,"duration_ms":100,"bytes_in":74,"bytes_out":13,"enriched":{"digest":"9c49473c65df8ec6","strings":["Action: Login","ActionID: 1","Username: cron","Secret: admin","Events: off"]}},{"timestamp":"2026-09-27T04:16:53","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"bf4ecf25-e318-4559-ad65-e69ed3c42197","seq":2,"duration_ms":7124,"bytes_in":92,"bytes_out":26,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-09-27T04:16:46","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nActionID: 1\r\nUsername: cron\r\nSecret: admin\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a416374696f6e49443a20310d0a557365726e616d653a2063726f6e0d0a5365637265743a2061646d696e0d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"bf4ecf25-e318-4559-ad65-e69ed3c42197","seq":1,"duration_ms":100,"bytes_in":74,"bytes_out":13,"enriched":{"digest":"9c49473c65df8ec6","strings":["Action: Login","ActionID: 1","Username: cron","Secret: admin","Events: off"]}}],"http_methods":[{"method":"GET","count":1},{"method":"POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/.env","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[{"value":"SSH-2.0-OpenSSH","count":3}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-01T20:20:57.926683+00:00"}