{"ip":"217.218.10.45","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["1 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access, not a probe.","Not in any known-scanner range."],"engagement":{"level":"touch","label":"Touch only","detail":"8 bytes sent, no real exchange","bytes_sent":8,"session_seconds":1,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T06:27:25","last_seen":"2026-10-18T06:27:25","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"IR","country_name":"Iran","region":"","city":"","lat":null,"lon":null,"asn":58224,"org":"Iran Telecommunication Company PJS"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-18T06:27:25","last_seen":"2026-10-18T06:27:25","verdicts":[{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[{"username":"root","password":"ubuntu","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-18T06:27:25"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["98ddc5604ef6a1006a2b49a58759fbe6"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["98ddc5604ef6a1006a2b49a58759fbe6"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"98ddc5604ef6a1006a2b49a58759fbe6":95},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":0,"sessions":1}],"recent_events":[],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}],"data_as_of":"2026-10-18T19:21:29.053672+00:00"}