{"ip":"34.156.207.13","data_as_of":"2026-10-24T13:05:20+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["1 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range."],"engagement":{"level":"touch","label":"Touch only","detail":"0 bytes sent, no real exchange","bytes_sent":0,"session_seconds":1,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-15T05:24:07","last_seen":"2026-10-15T05:24:08","events_24h":0,"events_7d":0,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"ssh","sessions":2}],"geo":{"country_code":"BE","country_name":"Belgium","region":"","city":"","lat":null,"lon":null,"asn":396982,"org":"Google LLC"},"source_domain":"13.207.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-15T05:24:07","last_seen":"2026-10-15T05:24:08","verdicts":[{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":2}],"services":[{"protocol":"ssh","port":22,"sessions":2}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T05:24:07"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["4e066189c3bbeec38c99b1855113733a","dde267e50f82fcc16a7e1e7b59b8af71"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["4e066189c3bbeec38c99b1855113733a","dde267e50f82fcc16a7e1e7b59b8af71"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"4e066189c3bbeec38c99b1855113733a":61,"dde267e50f82fcc16a7e1e7b59b8af71":0},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":0,"sessions":2}],"recent_events":[],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}