{"ip":"23.19.231.52","data_as_of":"2026-10-26T21:47:26+00:00","observed":true,"total_events":155,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"CDN","why":["2 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","The first-packet sensors recorded 155 event(s) from this address as well.","Not in any known-scanner range.","Sent 21,324 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,324 bytes sent","bytes_sent":21324,"session_seconds":3,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-17T15:47:19","last_seen":"2026-10-26T18:27:11","events_24h":20,"events_7d":151,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"redis","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":395954,"org":"Leaseweb USA, Inc."},"source_domain":"52.231.19.23.hosted.by.hostdzire.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as395954","label":"LeaseWeb USA / LAX-12","category":"cdn","url":"https://www.peeringdb.com/asn/395954"},"cve_matches":[],"malware":[{"sha256":"5c4f6a9b91af535fe5ca6e7badeced6fdd112c5eb2bab5893fde91a4c03f8699","family":"","vt_name":"r.sh","malicious":1,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":6379,"hits":2,"last_seen":"2026-10-17 15:48:05"}],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-17T15:47:19","last_seen":"2026-10-17T16:00:34","verdicts":[{"verdict":"upload","sessions":2},{"verdict":"scan","sessions":1}],"personas":[{"persona":"redis@6.2.14","sessions":3}],"services":[{"protocol":"redis","port":6379,"sessions":3}],"logins":[],"commands":[],"downloads":[{"url":"[http]://23[.]19[.]231[.]52:443/kx/r.sh","host":"23[.]19[.]231[.]52","sessions":2,"first_seen":"2026-10-17T15:48:05","last_seen":"2026-10-17T16:00:34","virustotal":{"sha256":"5c4f6a9b91af535fe5ca6e7badeced6fdd112c5eb2bab5893fde91a4c03f8699","status":"uploaded","malicious":1,"total":75,"name":"r.sh"}}],"files":[{"sha256":"c22c5e64e214f2230e0a77b501bcb80845adeb4007d4d09d6eb05581653a5f15","name":"kxyrvkqj","size":352,"mime_type":"text/plain","kind":"redis-value","times":2,"first_seen":"2026-10-17T15:48:04","last_seen":"2026-10-17T16:00:33","virustotal":null},{"sha256":"0a49b2327a74daa6ee4266e96c5b676fddeba6160f0098a2c5dee16ccfc8ae89","name":"authorized_keys","size":93,"mime_type":"text/plain","kind":"redis-value","times":2,"first_seen":"2026-10-17T15:48:03","last_seen":"2026-10-17T16:00:32","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":2}]},"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":76,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":76,"sessions":0},{"port":6379,"proto":"tcp","label":"Redis","count":0,"sessions":3},{"port":10150,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2375,"proto":"tcp","label":"Docker","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4346,"b11cun030_00040014_54d07b6d":3813},"akin_families":{"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3814}},"user_agents":["curl/8.5.0","Mozilla/5.0"],"timeline":[{"date":"2026-10-17","count":0,"sessions":3},{"date":"2026-10-19","count":4,"sessions":0},{"date":"2026-10-20","count":16,"sessions":0},{"date":"2026-10-21","count":16,"sessions":0},{"date":"2026-10-22","count":14,"sessions":0},{"date":"2026-10-23","count":30,"sessions":0},{"date":"2026-10-24","count":37,"sessions":0},{"date":"2026-10-25","count":22,"sessions":0},{"date":"2026-10-26","count":16,"sessions":0}],"recent_events":[{"timestamp":"2026-10-26T18:27:11","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"680ec134-d6cc-46ae-a3ff-c6e96bea689d","seq":1,"duration_ms":101,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T18:26:48","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"41f52551-943d-45c3-990d-9fad9633370c","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T13:14:55","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8ac8315b-3915-41f0-ac87-0686c939397f","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T13:14:41","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"ec816128-5aa6-469a-a2ab-af0e294b3704","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T11:20:42","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"f446c387-9750-47b7-be47-f8d2de85ab05","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T11:20:15","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"baa0084a-bb0c-4334-8389-68620c1fb140","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T10:35:55","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"daf6bcb0-ae7d-4dc2-a5ac-1ef13967e988","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T10:35:41","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"d6821ed3-6674-4146-b63b-1d878753977d","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T04:59:19","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"07b3e49e-3921-4e2c-b570-b4e2988b5ee5","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-26T04:58:58","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"6c1189c8-e048-472c-93f6-82d40526179c","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77}],"http_methods":[{"method":"GET","count":155}],"distinct_ports_total":5,"top_paths":[{"path":"/api/config","count":152,"ports":2},{"path":"/version","count":2,"ports":2},{"path":"/openapi.json","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":2}]}