{"ip":"94.197.204.154","data_as_of":"2026-10-20T13:32:25+00:00","observed":true,"total_events":3081,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive login(s) succeeded","confidence":"high","network_type":"residential ISP","why":["2 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 3,081 event(s) from this address as well.","Not in any known-scanner range.","Sent 3,357,177 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,357,177 bytes sent","bytes_sent":3357177,"session_seconds":19,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-17T17:10:33","last_seen":"2026-10-18T18:49:18","events_24h":0,"events_7d":3081,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"ssh","sessions":5}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"Scotland","city":"Glasgow","lat":55.8036,"lon":-4.1294,"asn":206067,"org":"Three"},"source_domain":"94.197.204.154.threembb.co.uk","known_scanners":[],"scanner_tag":{"key":"peeringdb:as206067","label":"Three UK AS206067","category":"isp","url":"https://www.peeringdb.com/asn/206067"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-17T17:10:33","last_seen":"2026-10-18T13:32:00","verdicts":[{"verdict":"unknown","sessions":3},{"verdict":"credential","sessions":2}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":5}],"services":[{"protocol":"ssh","port":5,"sessions":2},{"protocol":"ssh","port":2,"sessions":2},{"protocol":"ssh","port":1,"sessions":1}],"logins":[{"username":"root","password":"TheArmorOfGod","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-17T17:13:05"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":2,"proto":"tcp","label":"","count":1064,"sessions":2},{"port":4,"proto":"tcp","label":"","count":1009,"sessions":0},{"port":9,"proto":"tcp","label":"","count":1008,"sessions":0},{"port":5,"proto":"tcp","label":"SSH","count":0,"sessions":2},{"port":1,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["f8c77b782d33442905e2c431c2ba312e"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"f8c77b782d33442905e2c431c2ba312e":446},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-17","count":1064,"sessions":4},{"date":"2026-10-18","count":2017,"sessions":1}],"recent_events":[{"timestamp":"2026-10-18T18:49:18","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014�!\u00047V&�_�\\�8�\u0014��\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��]h�\u0004\u0002�z\bS�\u001b�","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14be2104375626e55fbe5cac38b314faf2000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000d6c65d68cb0402d87a0853b41b97","method":"","user_agent":"","ja3":"","session":"e13366a7-8d5b-4b6d-a560-16980cfc09ac","seq":1,"duration_ms":198,"bytes_in":1217,"bytes_out":14,"enriched":{"digest":"07855038bb82f3d0","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:49:18","port":9,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014=�F\u001c(�\u001e�\u0016\f1\u0004P�\u0001�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��Qe~�L#_��Q'R","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e143dc0461c28dd1e8c160c310450e001fe000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000b3d451657eb34c235fa88e512752","method":"","user_agent":"","ja3":"","session":"d6fa41ff-9923-4734-92e2-811a2f5e0544","seq":1,"duration_ms":219,"bytes_in":1217,"bytes_out":14,"enriched":{"digest":"153ba2018068f415","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:49:09","port":9,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014ײ�RX\\���0d��L\fT\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�-�\u0000����\u0015.\u0002.+\r","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e14d7b2fc52585c8fd2ed3064d2e44c0c54000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000c52db200af8587d8152e022e2b0d","method":"","user_agent":"","ja3":"","session":"0cbe7102-12a1-4bcf-a2c6-7e671b1ea591","seq":1,"duration_ms":192,"bytes_in":1217,"bytes_out":14,"enriched":{"digest":"3495eba761848962","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:49:06","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n\u0000\u0000\u0004�\u000e\u0014v�P\r\u0000��\u0015�����\u0019\u001b�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�C�9�f\"y�R�jo5","payload_hex":"5353482d322e302d4f70656e5353480d0a000004ac0e1476ff500d00e3b215a2c7f580c6191b9c000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000a143dd39fd662279ba52d36a6f35","method":"","user_agent":"","ja3":"","session":"5b33da90-c2c1-4585-b929-abb6fdff749b","seq":1,"duration_ms":221,"bytes_in":1217,"bytes_out":14,"enriched":{"digest":"fc370fecbd123111","label":"SSH","strings":["SSH-2.0-OpenSSH","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:48:54","port":9,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0004�\u000e\u0014�\u0003��2L��9���O�w�\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0017i���9\u001cg�,�D�\f","payload_hex":"000004ac0e14f203a1a2324cafde3999a1b54fad77bc000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e650000000000000000000000000017699a99e7391c67f02cf144b90c","method":"","user_agent":"","ja3":"","session":"6c056c67-eaf7-4e90-b7bc-61906acf85ce","seq":2,"duration_ms":2202,"bytes_in":1217,"bytes_out":28,"enriched":{"digest":"1bef30df9a356912","strings":["curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:48:54","port":4,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0004�\u000e\u0014\u001a\u0001bz?A�����[g\u00059~\u0000\u0000\u0000�curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c\u0000\u0000\u0002\u0019ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000�arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,chacha20-poly1305@openssh.com\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����.���X�7\b�O","payload_hex":"000004ac0e141a01627a3f41aae1e9abc25b6705397e000000ac637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63000002197373682d7273612c7373682d6473732c65636473612d736861322d6e697374703235362c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d656432353531392c736b2d7373682d65643235353139406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000087617263666f75722c617263666f75723132382c617263666f75723235362c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733132382d67636d406f70656e7373682e636f6d2c336465732d6362632c63686163686132302d706f6c7931333035406f70656e7373682e636f6d00000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000d7ec95ca2e8f8ee6588b3708d54f","method":"","user_agent":"","ja3":"","session":"0b7b2b75-0b97-4afe-8773-836270a471d1","seq":2,"duration_ms":2205,"bytes_in":1217,"bytes_out":28,"enriched":{"digest":"ddd3928af3ea11d9","strings":["bz?A","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha…","arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes128…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-18T18:48:54","port":9,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"6c056c67-eaf7-4e90-b7bc-61906acf85ce","seq":1,"duration_ms":2101,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T18:48:54","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"0b7b2b75-0b97-4afe-8773-836270a471d1","seq":1,"duration_ms":2101,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T18:48:40","port":9,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"6a3472fe-f9de-4fbd-84bb-421923ac419a","seq":1,"duration_ms":2101,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}},{"timestamp":"2026-10-18T18:48:40","port":4,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH\r\n","payload_hex":"5353482d322e302d4f70656e5353480d0a","method":"","user_agent":"","ja3":"","session":"29c2383f-c6fc-4027-9981-ca4cca3e88a4","seq":1,"duration_ms":2101,"bytes_in":17,"bytes_out":14,"enriched":{"digest":"d0c1a40494b9d799","label":"SSH","strings":["SSH-2.0-OpenSSH"]}}],"http_methods":[],"distinct_ports_total":5,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH","count":2861}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}