{"ip":"64.190.76.3","data_as_of":"2026-10-26T21:47:16+00:00","observed":true,"total_events":0,"verdict":{"verdict":"tor","label":"Tor exit node","detail":null,"confidence":"high","network_type":null,"why":["The address is a listed Tor exit node.","Traffic through an exit node comes from many users, so nothing here is attributed to the address itself.","Counted from 1 interactive session(s); the first-packet sensors recorded no TCP events from this address.","Interactive sessions: 1 interactive session(s) ran commands after logging in."],"engagement":{"level":"request","label":"Request traffic","detail":"410 bytes sent","bytes_sent":410,"session_seconds":11,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-16T19:41:14","last_seen":"2026-10-16T19:41:14","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"IT","country_name":"Italy","region":"","city":"","lat":null,"lon":null,"asn":214094,"org":"'Association Osservatorio Nessuno ODV'"},"source_domain":"raschera.exit.osservatorionessuno.org","known_scanners":[],"scanner_tag":{"key":"tor","label":"Tor exit","category":"vpn","url":"https://www.torproject.org/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-16T19:41:14","last_seen":"2026-10-16T19:41:14","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[],"commands":[{"ts":"2026-10-16T19:41:13","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":0},{"ts":"2026-10-16T19:41:13","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":126},{"ts":"2026-10-16T19:41:11","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":null},{"ts":"2026-10-16T19:41:11","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":0},{"ts":"2026-10-16T19:41:10","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":0},{"ts":"2026-10-16T19:41:09","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":0},{"ts":"2026-10-16T19:41:08","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":null},{"ts":"2026-10-16T19:41:07","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -t ~/hvzg9ir3tizalj8a1r4u6v2yoy","exit_code":null},{"ts":"2026-10-16T19:41:06","session_id":"078329e0-0f79-460d-839d-10ff150a3b74","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"LC_ALL=C top -bn1","exit_code":127}],"downloads":[],"files":[{"sha256":"f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d","name":"hvzg9ir3tizalj8a1r4u6v2yoy","size":348,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-16T19:41:12","last_seen":"2026-10-16T19:41:13","virustotal":{"sha256":"f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d","status":"known","malicious":0,"total":74,"name":"f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d.elf"}},{"sha256":"e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769","name":"hvzg9ir3tizalj8a1r4u6v2yoy","size":512,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-16T19:41:08","last_seen":"2026-10-16T19:41:09","virustotal":{"sha256":"e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769","status":"known","malicious":0,"total":75,"name":"e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769.elf"}}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["d00d43d15d59705b090cf74488cc2218"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["d00d43d15d59705b090cf74488cc2218"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"d00d43d15d59705b090cf74488cc2218":0},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-16T19:41:13","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"4c435f414c4c3d4320726d202d66202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-24","seq":24,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"355058088d64a851","strings":["LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:13","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"4c435f414c4c3d43202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-22","seq":22,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4b1e45eea36162e3","strings":["LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:12","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0755 348 hw","payload_hex":"433037353520333438206877","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ff5dcd11354ada2f","strings":["C0755 348 hw"]},"interactive":true},{"timestamp":"2026-10-16T19:41:11","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"736370202d74202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"48c68d2e15db4842","strings":["scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:11","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"4c435f414c4c3d4320726d202d66202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"355058088d64a851","strings":["LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:10","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"4c435f414c4c3d4320726d202d66202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"355058088d64a851","strings":["LC_ALL=C rm -f /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:09","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"4c435f414c4c3d43202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4b1e45eea36162e3","strings":["LC_ALL=C /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:08","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0755 512 hw","payload_hex":"433037353520353132206877","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1b748f92d2e49871","strings":["C0755 512 hw"]},"interactive":true},{"timestamp":"2026-10-16T19:41:08","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy","payload_hex":"736370202d74202f7661722f746d702f68767a673969723374697a616c6a386131723475367632796f79","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"48c68d2e15db4842","strings":["scp -t /var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"],"iocs":{"paths":["/var/tmp/hvzg9ir3tizalj8a1r4u6v2yoy"]}},"interactive":true},{"timestamp":"2026-10-16T19:41:07","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0755 512 hw","payload_hex":"433037353520353132206877","method":"","user_agent":"","ja3":"","session":"078329e0-0f79-460d-839d-10ff150a3b74-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1b748f92d2e49871","strings":["C0755 512 hw"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}