{"ip":"104.211.77.81","data_as_of":"2026-10-20T14:20:36+00:00","observed":true,"total_events":6,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"medium","network_type":"CDN","why":["2 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,922 bytes sent","bytes_sent":1922,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-17T14:03:14","last_seen":"2026-10-18T19:34:21","events_24h":0,"events_7d":6,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"IN","country_name":"India","region":"Maharashtra","city":"Pune","lat":18.5211,"lon":73.8502,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1711h1_ab0a1bf427ad_882d495ac381"],"tls_client_hello":"16030105e4010005e00303f1b515cff778d714ee340f8bcf749be4c6ba4bd6c340ec5636e84f2a86b1d7a120bc66c165f9a543912ee82043e5e0fce3138c3ce8e2055abe75ffe75b87da26c80022130213031301c02cc030c02bc02fcca9cca8c024c028c023c027009f009e006b006701000575ff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c00323c04a3253c7834ae94b58c0c020565ba690551971365a4cca9cb151694f5a0da5dc5fb48b7d0a4b7b63404c44b755a1860ee6a37771f34184d1ac367601003aacc82c5de88291be02c85f0bc572787438a695c0996fe612a3f6444530da87477726d81733d2a29a6246b32ee72578b0ba0fcb6ac7f24099e946d6a3522c73aab2298e6f3590bd246917498a7d154e7df09e0fe8a666385915fa1160d69d06839670f13b80a610e3498cb1f8b6e83a68316b4dc026288382aeb58c250488c6ebe230a2859b3e6532d472814daa98e110c57a3050d068cd3f2a0f6e3669930c8c51392f08b6a13c8a6f21e22c1c82008852a411cb1f5917be1d373e03945ce524806e994da6cc6697b7b79f0025a6914d17311f97ac3bece8ae9be35ec3909ad2b2ad57d1715683ad113242b5b1108630a83792020f918d67980de83711bc40acacf0b380b07f1827099ada6c5cda38dc8b1ee9eb8eb4eb038e977123173ff0f414fe015a42bc2826f696123c02e028290aa63516315df9924bc3173dbf057f4609bf7baa4ebec4746d2723e598c3a27a0af7533f05047c9a39bd802b109793987cd2a91be9499c42c0b1b1245360153a923cc657bf7c320b78ec54adb6158417c3c2bbc71b510493d9145190cee0b965dd4b86f6d87eec851f9f5089dac3c81cb6c28ee112189cc415e78e91795cdc56a9a9f07eb2b1990081835297854b644f3fa8a3f54988dbc38209fb17c3250a2b9111481c705510c793432d2fe29ff6799068a606aed1c31c145899632c2e512cc4eaccc519b55a4b69f585109f2079c5c9a29ba40973598585b5717037957017b25001a70315252271098a838ccc243f497c825625bdb97c5002a80d7b72158982c46bf48ea568627d98aeedb81a19c8cefb0bc285c844b2c5111218911bcc55d9d747438621a8c7c2a725744c7a4856e8b8baa5720a4802b517bf4fb9633e6645c46574376a5446768bb1abcc44602604e9735c264fb3a7037a208c6d724b241b9b5b0c4c9127a6a9c194b62a01afeb49afc7bd578c605ba44d7b890249e693e2ba84a446c2e485bbe582563a926037e39097b88582e036924510c22926dc574eccd25004aa809290016a2c761d41c67f3741c740aec17c62c94986bf444d51e0874b5444512203f59b418e6c78fdc018ee40ac44c4ce3d516bcd38c5ae7973c43965eccaca9186a93f1a35a2170ac57ccded59c6a7659a1a6ca0fdbb6b0fd63f5c38b5494224902452136b9d3cc997e384bb8aaba004f276e98928d2386384f0c1db6413f323b6b3d08b0f55a8211abf7a189af0f460c8f55ad4a8ae3bfb12c19bc24fa72011bc938da228ce47971bfa86df879acaf3592500852aa03efc019d4a55a49a211ada598e94131fd1223cf18ab49fc10abf571f79343115da35aa20108838a629a9478cb13cfa1200eb2309d3f446b7a12264fc57291a5519b12e7ee84200e81f1644b321080b4d94756fe2627fab544fa579677413f37c51077987c11ac5aa617e79f7a158369f1977c8589620cb33ae23355789c146a5e95df4204e7a4a0f6a88adb8eb14942385dbab1b50aa231c76c8d17b6a0b73327ba28c675b9d95da438f171404bbc5dd8730a676707908620eddc02ee39d6d3504f503391d510e7ce6c197db33cf7941b4213a6d9d24eef47816c6b8a31c36180beff05f2f60dc21394f7fe8de0996fe123a001d002079f728f0d6e7344029da27a42dcdc95222d1034b82ccc6da0f269131","tls_ja3":["fb0c9cea0478d6132076f4cdcb0d5224"],"http_akin":["b11cun050_00040017_38043d51","b11cun050_00040017_2a8291af","b11cuq070_00050817_44096d2b","b11cuq060_00040817_229ec904"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i1711h1_ab0a1bf427ad_882d495ac381":32,"b11cun050_00040017_38043d51":50,"b11cun050_00040017_2a8291af":1,"b11cuq070_00050817_44096d2b":8,"b11cuq060_00040817_229ec904":1},"akin_families":{"b11cun050_00040017_38043d51":{"head":"b11cun050_00040017_38043d51","shapes":2,"ips":50}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","python-requests/2.34.2"],"timeline":[{"date":"2026-10-17","count":1},{"date":"2026-10-18","count":5}],"recent_events":[{"timestamp":"2026-10-18T19:34:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"content-length\":\"19\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"<?php phpinfo(); ?>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2031390d0a0d0a3c3f70687020706870696e666f28293b203f3e","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"c52a6e42-7ed3-465d-af66-a8f12a8072af","seq":1,"duration_ms":111,"bytes_in":239,"bytes_out":78},{"timestamp":"2026-10-18T19:34:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"0x%5B%5D=androxgh0st","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a30782535422535443d616e64726f786768307374","method":"POST","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"38ab662e-b71f-4bce-9d28-43936161a53c","seq":1,"duration_ms":104,"bytes_in":389,"bytes_out":78},{"timestamp":"2026-10-18T19:34:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"b750958b-9640-428f-a525-482f7e8c853f","seq":1,"duration_ms":102,"bytes_in":303,"bytes_out":78},{"timestamp":"2026-10-18T19:34:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"0x%5B%5D=androxgh0st","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a30782535422535443d616e64726f786768307374","method":"POST","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"bf884ab7-6e5b-44dd-9d56-bde2fa967ad4","seq":1,"duration_ms":100,"bytes_in":389,"bytes_out":78},{"timestamp":"2026-10-18T19:34:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"b4af5366-4d68-40b4-b46f-f3f1bb5089b9","seq":1,"duration_ms":100,"bytes_in":303,"bytes_out":78},{"timestamp":"2026-10-17T14:03:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132382e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","ja3":"","session":"ee811b4c-4de6-49fe-bd9d-fb3016607fd6","seq":1,"duration_ms":100,"bytes_in":299,"bytes_out":78}],"http_methods":[{"method":"GET","count":4},{"method":"POST","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":3,"ports":2},{"path":"/.env","count":2,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, zstd","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","notable":false}],"distinct_sets":3,"events_with_headers":6},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"}]}