{"ip":"45.138.12.89","data_as_of":"2026-10-20T16:22:18+00:00","observed":true,"total_events":492,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"25 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["25 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 19,909,970 bytes, which is sustained payload delivery.","Counts include 128 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,909,970 bytes sent","bytes_sent":19909970,"session_seconds":11,"persistent":false},"basis":"combined"},"first_seen":"2026-10-19T03:33:04","last_seen":"2026-10-20T04:57:16","events_24h":243,"events_7d":492,"interactive_sessions":128,"interactive_sessions_24h":78,"interactive_sessions_7d":128,"interactive_protocols":[{"protocol":"http","sessions":51},{"protocol":"http-proxy","sessions":7}],"geo":{"country_code":"LT","country_name":"Lithuania","region":"","city":"","lat":55.4167,"lon":24.0,"asn":218785,"org":"Tc Datacenter Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":128,"first_seen":"2026-10-19T03:33:04","last_seen":"2026-10-20T00:28:10","verdicts":[{"verdict":"unknown","sessions":112},{"verdict":"scan","sessions":16}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":21},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":16},{"persona":"proxy@squid/5.7","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, mikrotik@6.49.10, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1","sessions":7}],"services":[{"protocol":"http","port":8443,"sessions":12},{"protocol":"http-proxy","port":3128,"sessions":7},{"protocol":"tcp","port":8888,"sessions":7},{"protocol":"tcp","port":3000,"sessions":7},{"protocol":"http","port":8081,"sessions":7},{"protocol":"tcp","port":8082,"sessions":7},{"protocol":"tcp","port":8083,"sessions":7},{"protocol":"http","port":8080,"sessions":7},{"protocol":"tcp","port":5001,"sessions":7},{"protocol":"tcp","port":9443,"sessions":7},{"protocol":"tcp","port":10000,"sessions":7},{"protocol":"tcp","port":9000,"sessions":7}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":16}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":33,"sessions":7},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":28,"sessions":12},{"port":5000,"proto":"tcp","label":"Web-alt","count":31,"sessions":7},{"port":10000,"proto":"tcp","label":"Webmin","count":31,"sessions":7},{"port":8006,"proto":"tcp","label":"","count":31,"sessions":7},{"port":80,"proto":"tcp","label":"HTTP","count":30,"sessions":7},{"port":9443,"proto":"tcp","label":"","count":30,"sessions":7},{"port":5001,"proto":"tcp","label":"","count":29,"sessions":7},{"port":8083,"proto":"tcp","label":"","count":28,"sessions":7},{"port":443,"proto":"tcp","label":"HTTPS","count":29,"sessions":4},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":26,"sessions":7},{"port":8082,"proto":"tcp","label":"","count":25,"sessions":7},{"port":8081,"proto":"tcp","label":"","count":25,"sessions":7},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":24,"sessions":7},{"port":81,"proto":"tcp","label":"","count":23,"sessions":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105d2010005ce030336dcb0c90e99c608788eb5a83a6bf82681531e1bf6caa2dc749bbf2a750f9b8020517b105803932c627ca03291ab62e3ed305c0ee2f5b6c4ec59ac13130bb94e0a001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056b000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0d312ba4aa486e04418c8fab09477cdd30b04eeb1250c048e0567c3b5da0e29044e8f3110c768c5454a6c7b6c8310f793cd987092c5782cb3c1e4704c3b2ccde5fa3119140a21a75261c181d0c52c636443a461b4f188937f0697f9db3641e905b10444ed21c95793bc999c7ebb72b05809b919144f9b63afa39c07c40286ee14c096b352f295328c3cbb18903f8dd28488c49390a50e57594db5650fda94abbfa609515407c9f6b801e5b74ccba0aa90ac99b80ba10ba2d47cabe4f65e4968b58c4538384baeea38ab56f584536a8a47e2b525ac58e6e377afe686b281b406a6a8e0a64a3d9125763107fb88a57e2883d3e18512a3c5eeebc0502b1b86264dda6bcb8d652d09216870772916a7bdefd2373333852fd589aa5744e52bae075c18558a3d5194704de9269246c90948488d5cb2638a68abb720a18aa451cc62a8139290e47d3cc64fc3262b049559dce1a7d498073f1569ca3c350b6aadcf5a7cef960e195cc503677a5161ace32c4a88a1a94847aff732b3eb07cfabb76a2e85654ec7cd0ba76859e7100724946a8a5046db5a03a923004a6613e2b4ee6779bcbcb1a5ba49e3c1c891d13aed2a8b62a99f7bd972c0351f90c64bc68a9f47f48e6e0b452b0a2b1da9aaad8a44ae587c461260c0393448c48970a21e8f5c6a74a92c683b5037a52ae267c6776a8a77b87f6114b28ffc8e82954567cb76862c0cf1804b9001914179253914bddc3a7a7b63c19be483bdc0b18cfb0c040b39b4b3ce3673973299408a0041290c5b9ed26902d489dd885526a19f2a0a92fa58a398da9065492bac2686537c492f5b8e036acf9a24658a4c3b6e58c75790c3a154cb5dea3fba28619ba0a22781b744235011fc4359493eed8b9c37c14292aa000c95741ba860e5215e6a537c025a18a1a701f242081db8ceebab0c1ea72c646a1a4a538d9c286eee1c4751043cbfec0af7a4465c4cbcaefc96b6fb9dce922676541e3f507ebab42831dc36db58001bc127f5a17744bbb210c89450f45a80593c5f9796b8a00aca72ab3d047b7845b56f0409a1030359139900c48d142c01a37c2b99196c1eb73066314364356c9e964c71f4acfac267b099b1356926bb64a9770964d79ac4dc03b357b19b0ca8c7b2fcb7b420130c520a74279956a8ce1bf435cb33b98a991debba5c73169bcdf2551e35694c03abd9559cff852be827b2bd5453cc078786866e7909689653bb5aec3b940424906404ac504cd1525ff9b96ddb0457e325a812d4220fc75de075153a8c896256b25f75cd27f1ca4e1155098bb3de10826d9101089b99a9c905b3c37c2f637cc3a670bd526aff09382f3a14eb384a34b3ceabf6c6664b771bc0671806b88b9875efeb53aab906a5c4b825c7bb9c086fdf746c9c30152ed67ef69a72d6f6b806d6866e40432fb5c360695f1a13b93710b4a593423e6929d7a7a329d4b3672203d15aa01b63a91f37c1d7c1bd076017d4c5ca7b7213051c07d341b55b2489602bc5693871ce19c55fdcc8a0b82ee7bb57695420e828bac7311b9b7882ee65670f362cd6619d06544979f16e1975a47c109618453892c93d00c37c11ec58b5a8a9d48ab81112bcc10bb2fa0ac94cc72bc8064b3d96ffcb33888dc8a2a31a9908f89f4ad2f1ec998a8d089292141a6c8b43a72cc3b187d01bc730f6dd78cabbd7eb7694ba262b390cc057b4a50f179d39d8ec2c001d0020c3b187d01bc730f6dd78cabbd7eb7694ba262b390cc057b4a50f179d39d8ec2c","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun020_00040010_724c10fb","b11cuq083_00050814_0e1aa637_x8e84d668e7f3"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_ja3":["725543c78edf669194c11dc7a039b56e"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2807,"b11cun010_00040000_c4b2c4aa":848,"b11cun020_00040010_724c10fb":1708,"b11cuq083_00050814_0e1aa637_x8e84d668e7f3":1},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-19","count":249,"sessions":50},{"date":"2026-10-20","count":243,"sessions":78}],"recent_events":[{"timestamp":"2026-10-20T04:57:16","port":8888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8888\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"5be0865a-09c5-4115-a4f4-984703e526a8","seq":2,"duration_ms":231,"bytes_in":108,"bytes_out":154},{"timestamp":"2026-10-20T04:57:16","port":8888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8888\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"5be0865a-09c5-4115-a4f4-984703e526a8","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":77},{"timestamp":"2026-10-20T04:57:15","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8888\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"6dcd4ace-23df-4474-9100-21a029ee1749","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":77},{"timestamp":"2026-10-20T04:57:14","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"2f785f3b-66ab-4618-a2af-c2b82893a085","seq":2,"duration_ms":2284,"bytes_in":108,"bytes_out":154},{"timestamp":"2026-10-20T04:57:13","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"2f785f3b-66ab-4618-a2af-c2b82893a085","seq":1,"duration_ms":1508,"bytes_in":55,"bytes_out":77},{"timestamp":"2026-10-20T04:57:12","port":8006,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8006\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"3bbf5f69-14a3-4a25-8938-0595a1561002","seq":2,"duration_ms":1438,"bytes_in":108,"bytes_out":154},{"timestamp":"2026-10-20T04:57:12","port":9000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9000\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"a6c24c17-5fa5-4392-8948-be8c7a63ab21","seq":2,"duration_ms":1412,"bytes_in":108,"bytes_out":154},{"timestamp":"2026-10-20T04:57:12","port":3128,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3128\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a333132380d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"127fa4c0-1f1c-4536-bd19-651c2adf6774","seq":2,"duration_ms":871,"bytes_in":108,"bytes_out":154},{"timestamp":"2026-10-20T04:57:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"88b980de-3a08-4526-b7f4-71455f511ba4","seq":2,"duration_ms":1513,"bytes_in":106,"bytes_out":154},{"timestamp":"2026-10-20T04:57:12","port":8083,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8083\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038330d0a0d0a","method":"GET","user_agent":"","ja3":"725543c78edf669194c11dc7a039b56e","session":"52559dd2-7944-437e-9c1e-48eb79915cd3","seq":2,"duration_ms":1513,"bytes_in":108,"bytes_out":154}],"http_methods":[{"method":"GET","count":243},{"method":"POST","count":92},{"method":"HEAD","count":37}],"distinct_ports_total":18,"top_paths":[{"path":"/","count":129,"ports":18},{"path":"/.git/HEAD","count":122,"ports":18},{"path":"/.git/config","count":121,"ports":18}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>:8888","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}