{"ip":"85.11.167.132","total_events":439,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["1 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 449,972 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"449,972 bytes sent","bytes_sent":449972,"session_seconds":2,"persistent":false}},"first_seen":"2026-08-28T23:59:27","last_seen":"2026-09-11T11:25:41","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":2222,"proto":"tcp","label":"SSH-alt","count":204},{"port":22022,"proto":"tcp","label":"","count":100},{"port":22222,"proto":"tcp","label":"","count":89},{"port":8088,"proto":"tcp","label":"Hadoop","count":11},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8081,"proto":"tcp","label":"","count":6},{"port":85,"proto":"tcp","label":"","count":3},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":56575,"proto":"tcp","label":"","count":2},{"port":999,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":6789,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[]},"fingerprint_peers":{"16443846184eafde36765c9bab2f4397":23},"user_agents":[],"timeline":[{"date":"2026-08-28","count":1},{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":5},{"date":"2026-09-03","count":185},{"date":"2026-09-04","count":98},{"date":"2026-09-05","count":3},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":3},{"date":"2026-09-09","count":122},{"date":"2026-09-10","count":17},{"date":"2026-09-11","count":2}],"recent_events":[{"timestamp":"2026-09-11T11:25:41","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"bdb10f66-bf47-4e40-8a98-400d37d5795f","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":78},{"timestamp":"2026-09-11T00:51:49","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8088\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"51df051c-f4f4-4dc3-9fd9-721bc8c2c87e","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-10T21:53:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c6460371-b74e-46e4-a2b1-7d2058a3f674","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":78},{"timestamp":"2026-09-10T21:07:37","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"71fdbc3b-90f3-48db-af96-afe87f99b13f","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":78},{"timestamp":"2026-09-10T20:34:50","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"1acba382-92d0-4388-9337-67955364e5ce","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":78},{"timestamp":"2026-09-10T19:37:06","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8081\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"68419ea8-a823-4346-8934-dd6cae65e2f4","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-10T17:12:41","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"642fb8a1-32b6-413f-b368-1dd829826ed3","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-10T17:02:34","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8088\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8eb742e3-9a35-472b-8ef2-2a8736a0d1e4","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-10T16:49:43","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"83c57085-fce3-420b-9bb9-69ecfcfe30c6","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-09-10T14:44:45","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8088\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"659aa7b8-90d3-4ad6-8f1f-cc5a217824e5","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":78}],"http_methods":[{"method":"GET","count":39}],"distinct_ports_total":13,"top_paths":[{"path":"/","count":39,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":396}],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8088","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T16:45:13.340666+00:00"}