{
  "node": "argus",
  "role": "mirror",
  "generated_at": "2026-11-02T18:00:06.848736Z",
  "unique_ips": 25,
  "threats": [
    {
      "ip": "34.147.96.11",
      "first_seen": "2026-11-02T12:59:38-05:00",
      "last_seen": "2026-11-02T13:00:02-05:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T13:00:02-05:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:59:38-05:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:59:38-05:00"
        }
      ],
      "source": [
        "Hermes"
      ],
      "confidence": {
        "score": 0.49,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "2.57.121.112",
      "first_seen": "2026-11-02T12:59:33-05:00",
      "last_seen": "2026-11-02T12:59:33-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T12:59:33-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "92.118.39.71",
      "first_seen": "2026-11-02T12:54:31-05:00",
      "last_seen": "2026-11-02T12:54:31-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T12:54:31-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "193.46.255.86",
      "first_seen": "2026-11-02T12:50:14-05:00",
      "last_seen": "2026-11-02T12:50:14-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T12:50:14-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.142.210.201",
      "first_seen": "2026-11-02T12:33:52-05:00",
      "last_seen": "2026-11-02T12:33:55-05:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T12:33:55-05:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T12:33:55-05:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-11-02T12:33:54-05:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:33:54-05:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T12:33:54-05:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T12:33:54-05:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:33:54-05:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:33:53-05:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:33:52-05:00"
        },
        {
          "name": "crowdsecurity/http-generic-bf",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:33:52-05:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "218.244.143.162",
      "first_seen": "2026-11-02T12:22:47-05:00",
      "last_seen": "2026-11-02T12:22:47-05:00",
      "scenarios": [
        {
          "name": "crowdsecurity/CVE-2017-9841",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-11-02T12:22:47-05:00"
        }
      ],
      "source": [
        "Eurus"
      ],
      "confidence": {
        "score": 0.93,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "217.60.248.173",
      "first_seen": "2026-11-02T12:19:56-05:00",
      "last_seen": "2026-11-02T12:19:56-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T12:19:56-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.51.194.104",
      "first_seen": "2026-11-02T12:03:33-05:00",
      "last_seen": "2026-11-02T12:03:33-05:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T12:03:33-05:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T12:03:33-05:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.52,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "102.220.160.195",
      "first_seen": "2026-11-02T11:49:07-05:00",
      "last_seen": "2026-11-02T11:49:07-05:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T11:49:07-05:00"
        }
      ],
      "source": [
        "Hermes"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "89.106.1.23",
      "first_seen": "2026-11-02T11:31:49-05:00",
      "last_seen": "2026-11-02T11:31:49-05:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T11:31:49-05:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "115.191.34.239",
      "first_seen": "2026-11-02T11:25:41-05:00",
      "last_seen": "2026-11-02T11:25:41-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:25:41-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "189.101.75.145",
      "first_seen": "2026-11-02T11:25:25-05:00",
      "last_seen": "2026-11-02T11:25:25-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:25:25-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "36.255.220.145",
      "first_seen": "2026-11-02T11:23:45-05:00",
      "last_seen": "2026-11-02T11:23:45-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:23:45-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "50.6.205.78",
      "first_seen": "2026-11-02T11:23:00-05:00",
      "last_seen": "2026-11-02T11:23:00-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:23:00-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "50.6.5.14",
      "first_seen": "2026-11-02T11:22:34-05:00",
      "last_seen": "2026-11-02T11:22:34-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:22:34-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "50.6.23.110",
      "first_seen": "2026-11-02T11:22:16-05:00",
      "last_seen": "2026-11-02T11:22:16-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:22:16-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "222.208.64.40",
      "first_seen": "2026-11-02T11:22:10-05:00",
      "last_seen": "2026-11-02T11:22:10-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:22:10-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.77.34.65",
      "first_seen": "2026-11-02T11:20:48-05:00",
      "last_seen": "2026-11-02T11:20:52-05:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T11:20:52-05:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-11-02T11:20:52-05:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T11:20:52-05:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T11:20:49-05:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T11:20:49-05:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T11:20:48-05:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.51,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "58.229.253.119",
      "first_seen": "2026-11-02T11:20:50-05:00",
      "last_seen": "2026-11-02T11:20:50-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:50-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "213.230.127.104",
      "first_seen": "2026-11-02T11:20:49-05:00",
      "last_seen": "2026-11-02T11:20:49-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:49-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "14.103.126.104",
      "first_seen": "2026-11-02T11:20:43-05:00",
      "last_seen": "2026-11-02T11:20:43-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:43-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "121.142.87.218",
      "first_seen": "2026-11-02T11:20:43-05:00",
      "last_seen": "2026-11-02T11:20:43-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:43-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "20.217.184.185",
      "first_seen": "2026-11-02T11:02:08-05:00",
      "last_seen": "2026-11-02T11:20:18-05:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:18-05:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T11:02:11-05:00"
        },
        {
          "name": "php-obscure-path-backdoor",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T11:02:11-05:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T11:02:11-05:00"
        },
        {
          "name": "wp-obscure-nested-php",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T11:02:09-05:00"
        },
        {
          "name": "wp-nested-backdoor",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-11-02T11:02:09-05:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-11-02T11:02:08-05:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.99,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence",
          "Initial Access",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105",
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "192.169.232.223",
      "first_seen": "2026-11-02T11:20:13-05:00",
      "last_seen": "2026-11-02T11:20:13-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:20:13-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "129.121.115.10",
      "first_seen": "2026-11-02T11:19:31-05:00",
      "last_seen": "2026-11-02T11:19:31-05:00",
      "scenarios": [
        {
          "name": "cowrie-interaction",
          "category": "honeypot",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-11-02T11:19:31-05:00"
        }
      ],
      "source": [
        "Nike"
      ],
      "confidence": {
        "score": 0.98,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Credential Access / Execution"
        ],
        "mitre_techniques": [
          "T1059",
          "T1078",
          "T1110"
        ]
      },
      "scope": "fleet"
    }
  ]
}