{"ip":"23.132.164.170","data_as_of":"2026-10-26T08:53:48+00:00","observed":true,"total_events":30464,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"7 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["7 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 30,464 event(s) from this address as well.","Not in any known-scanner range.","Sent 14,949,879,081 bytes, which is sustained payload delivery.","Held a session open for 3229s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"14,949,879,081 bytes sent, longest session 3229s","bytes_sent":14949879081,"session_seconds":3229,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-20T00:20:44","last_seen":"2026-10-26T01:41:34","events_24h":4,"events_7d":30464,"interactive_sessions":17,"interactive_sessions_24h":4,"interactive_sessions_7d":17,"interactive_protocols":[{"protocol":"ssh","sessions":13},{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":401626,"org":"Netiface America, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":17,"first_seen":"2026-10-20T00:20:44","last_seen":"2026-10-26T01:41:34","verdicts":[{"verdict":"unknown","sessions":9},{"verdict":"post-exploitation","sessions":7},{"verdict":"scan","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":7},{"persona":"linux-ubuntu@20.04","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":1}],"services":[{"protocol":"ssh","port":54120,"sessions":5},{"protocol":"ssh","port":22222,"sessions":4},{"protocol":"ssh","port":212,"sessions":4},{"protocol":"tcp","port":212,"sessions":3},{"protocol":"http","port":212,"sessions":1}],"logins":[{"username":"squid01","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-26T01:41:21"},{"username":"nhtuong1","password":"12345","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-23T00:58:29"},{"username":"root","password":"P@ssword!","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T00:31:43"},{"username":"root","password":"qsQq/3Mx","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-23T00:58:39"}],"commands":[{"ts":"2026-10-26T01:41:33","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T01:41:33","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-26T01:41:33","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-26T01:41:32","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uptime","exit_code":0},{"ts":"2026-10-26T01:41:31","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-26T01:41:31","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc","exit_code":0},{"ts":"2026-10-26T01:41:30","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -a","exit_code":0},{"ts":"2026-10-26T01:41:30","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"hostname","exit_code":0},{"ts":"2026-10-26T01:41:29","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-26T01:41:29","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-26T01:41:27","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T01:41:26","session_id":"42100b27-c0e8-477b-8853-c16359c644d9","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo OK","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uptime","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -a","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"hostname","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-26T01:37:28","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-26T01:37:27","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-26T01:37:27","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /etc/os-release 2>/dev/null | head -1","exit_code":0},{"ts":"2026-10-26T01:37:27","session_id":"65a7627c-b2ea-4198-81cf-18d7d6431d2a","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo OK","exit_code":0},{"ts":"2026-10-23T00:59:00","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-23T00:58:59","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-23T00:58:58","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc","exit_code":0},{"ts":"2026-10-23T00:58:58","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -a","exit_code":0},{"ts":"2026-10-23T00:58:57","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"hostname","exit_code":0},{"ts":"2026-10-23T00:58:56","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-23T00:58:56","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-23T00:58:55","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-23T00:58:46","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-23T00:58:45","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uptime","exit_code":0},{"ts":"2026-10-23T00:58:45","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"netstat -tulpn 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-23T00:58:44","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ps aux 2>/dev/null | head -10","exit_code":0},{"ts":"2026-10-23T00:58:44","session_id":"2b54fb60-5114-428e-81f5-5240f7638b62","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo OK","exit_code":0},{"ts":"2026-10-23T00:58:43","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la / 2>/dev/null | head -20","exit_code":0},{"ts":"2026-10-23T00:58:43","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uptime","exit_code":0},{"ts":"2026-10-23T00:58:41","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-23T00:58:41","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nproc","exit_code":0},{"ts":"2026-10-23T00:58:40","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -a","exit_code":0},{"ts":"2026-10-23T00:58:40","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"hostname","exit_code":0},{"ts":"2026-10-23T00:58:38","session_id":"a1c7cc94-eec2-4ef5-9914-08207780e070","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo OK","exit_code":0},{"ts":"2026-10-23T00:58:33","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","exit_code":0},{"ts":"2026-10-23T00:58:33","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uptime","exit_code":0},{"ts":"2026-10-23T00:58:33","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","exit_code":0},{"ts":"2026-10-23T00:58:33","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc","exit_code":0},{"ts":"2026-10-23T00:58:32","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -a","exit_code":0},{"ts":"2026-10-23T00:58:32","session_id":"9b99e768-4d3c-4051-947a-99f9a4b9a8b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"hostname","exit_code":0}],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":7},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":7},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":7}]},"top_ports":[{"port":212,"proto":"tcp","label":"","count":30457,"sessions":8},{"port":22222,"proto":"tcp","label":"","count":4,"sessions":4},{"port":54120,"proto":"tcp","label":"","count":3,"sessions":5}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"16443846184eafde36765c9bab2f4397":45,"b11cun030_00040014_54d07b6d":3812},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"],"timeline":[{"date":"2026-10-20","count":15216,"sessions":7},{"date":"2026-10-21","count":15241,"sessions":1},{"date":"2026-10-23","count":3,"sessions":5},{"date":"2026-10-26","count":4,"sessions":4}],"recent_events":[{"timestamp":"2026-10-26T01:41:33","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1","payload_hex":"6e76696469612d736d69202d2d71756572792d6770753d6e616d65202d2d666f726d61743d6373762c6e6f68656164657220323e2f6465762f6e756c6c207c2068656164202d31","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"47aa6bea3978cf9e","strings":["nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T01:41:33","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2067726570204c495354454e207c2068656164202d3230","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66c5676d8f38874c","strings":["netstat -tulpn 2>/dev/null | grep LISTEN | head -20"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T01:41:33","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls -la / 2>/dev/null | head -20","payload_hex":"6c73202d6c61202f20323e2f6465762f6e756c6c207c2068656164202d3230","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ebfa0eb99775d527","strings":["ls -la / 2>/dev/null | head -20"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T01:41:32","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uptime","payload_hex":"757074696d65","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6772c61c438ad4ab","strings":["uptime"]},"interactive":true},{"timestamp":"2026-10-26T01:41:31","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2","payload_hex":"636174202f70726f632f637075696e666f207c206772657020276d6f64656c206e616d6527207c2068656164202d31207c20637574202d64273a27202d6632","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"252822c0a513ad67","strings":["cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2"],"iocs":{"paths":["/proc/cpuinfo"]}},"interactive":true},{"timestamp":"2026-10-26T01:41:31","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nproc","payload_hex":"6e70726f63","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b54c60434a889c6b","strings":["nproc"]},"interactive":true},{"timestamp":"2026-10-26T01:41:30","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -a","payload_hex":"756e616d65202d61","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a103d79c46716c12","strings":["uname -a"]},"interactive":true},{"timestamp":"2026-10-26T01:41:30","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"hostname","payload_hex":"686f73746e616d65","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"709381e970d2d669","strings":["hostname"]},"interactive":true},{"timestamp":"2026-10-26T01:41:29","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"netstat -tulpn 2>/dev/null | head -10","payload_hex":"6e657473746174202d74756c706e20323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"94439b651f765ba2","strings":["netstat -tulpn 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T01:41:29","port":22222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ps aux 2>/dev/null | head -10","payload_hex":"70732061757820323e2f6465762f6e756c6c207c2068656164202d3130","method":"","user_agent":"","ja3":"","session":"42100b27-c0e8-477b-8853-c16359c644d9-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d188b8795e9a8b8f","strings":["ps aux 2>/dev/null | head -10"],"iocs":{"paths":["/dev/null"]}},"interactive":true}],"http_methods":[{"method":"GET","count":30464}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":6,"ports":1},{"path":"/developer/crm/info.php","count":4,"ports":1},{"path":"/cache/error_log.save","count":4,"ports":1},{"path":"/.github/workflows/deploy.yml","count":4,"ports":1},{"path":"/admin/docker-compose.key","count":4,"ports":1},{"path":"/sinatra.log.old.old","count":4,"ports":1},{"path":"/dev/lara/phpinfo.php","count":4,"ports":1},{"path":"/mailer/phpversion.php","count":4,"ports":1},{"path":"/settings.php.save","count":4,"ports":1},{"path":"/tmp/debug.inc.save","count":4,"ports":1},{"path":"/config/mailjet_config.json","count":4,"ports":1},{"path":"/api/env.tar.gz","count":4,"ports":1},{"path":"/marketing/time.php","count":3,"ports":1},{"path":"/developer/develop/info.php","count":3,"ports":1},{"path":"/hibernate.log.copy.original.original","count":3,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":11}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":7},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":7},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":7}]}