{"ip":"88.118.127.130","data_as_of":"2026-10-26T23:01:48+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network service provider","why":["4 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","Not in any known-scanner range.","Sent 5,412,239 bytes, which is sustained payload delivery.","Held a session open for 276s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"5,412,239 bytes sent, longest session 276s","bytes_sent":5412239,"session_seconds":276,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-19T22:53:10","last_seen":"2026-10-19T23:00:43","events_24h":0,"events_7d":0,"interactive_sessions":6,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"smb","sessions":6}],"geo":{"country_code":"LT","country_name":"Lithuania","region":"","city":"","lat":null,"lon":null,"asn":8764,"org":"Telia Lietuva, AB"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8764","label":"Telia Lietuva, AB","category":"isp","url":"https://www.peeringdb.com/asn/8764"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":6,"first_seen":"2026-10-19T22:53:10","last_seen":"2026-10-19T23:00:43","verdicts":[{"verdict":"exploit-attempt","sessions":4},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"smb@Windows Server 2016","sessions":6}],"services":[{"protocol":"smb","port":445,"sessions":6}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"d6706bbcb266e823f033c4c74283d99254186856520e5720f156ea961b53cbba","name":"doublepulsar-payload.dll","size":5298176,"mime_type":"application/x-dosexec","kind":"sample","times":1,"first_seen":"2026-10-19T23:00:41","last_seen":"2026-10-19T23:00:41","virustotal":{"sha256":"d6706bbcb266e823f033c4c74283d99254186856520e5720f156ea961b53cbba","status":"known","malicious":59,"total":75,"name":"www.exe"}},{"sha256":"b8138fdd360b090df211301c20e701c90c0819f67d550f5327c053afc9be02ed","name":"doublepulsar-payload.bin","size":5304320,"mime_type":"application/octet-stream","kind":"sample","times":1,"first_seen":"2026-10-19T23:00:41","last_seen":"2026-10-19T23:00:41","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":4}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":0,"sessions":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-19","count":0,"sessions":6}],"recent_events":[{"timestamp":"2026-10-19T23:00:41","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2597","seq":2597,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:41","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2595","seq":2595,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:41","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2593","seq":2593,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2591","seq":2591,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2589","seq":2589,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2587","seq":2587,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:40","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2585","seq":2585,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2583","seq":2583,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2581","seq":2581,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-19T23:00:39","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"ff200e44-55e3-4d47-9558-7de7460b97e6-2579","seq":2579,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":4}]}