{"ip":"13.68.158.199","data_as_of":"2026-10-20T14:21:56+00:00","observed":true,"total_events":7,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 exploit-path hits","confidence":"medium","network_type":"CDN","why":["4 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,313 bytes sent","bytes_sent":2313,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-04T13:44:08","last_seen":"2026-10-04T13:44:09","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1711h1_ab0a1bf427ad_882d495ac381"],"tls_client_hello":"16030105e4010005e003030be121f37cd5d9d6be7ff290cbad6e896f327dc525630bc3f0c3ed908a32aa7f20936e71bad148fbb68072e2a771bd4b4f65b13f5c1fb015759c83b50828c5a35a0022130213031301c02cc030c02bc02fcca9cca8c024c028c023c027009f009e006b006701000575ff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c068d58298611986fb9f0f11598ea145c239aaab239238a475dfd5025ce06c37273e8c6727fac93d451ac77d516757e60126052aa2091cd6168a421034081c976bb4a5d7c630f00b207de2a7b96c3c50d29eef85a209f7a9139cc6414c9b888858557ab8e079cf9c20ca4bc6709eb6305b123942808ef37b258d77830942ad75ca34550890de660f849299f8328d270740ec45650673cd78188c84354068a5c590ea1c61e5167ff62fce36af7531225a407e567c6f7d4b5d2c411c9b9a70ecc367edb698c6732a021b35eeb527a1a71baa2a0de4dc3da87b88744cbbb4408b11382323c04c96a1922a23b8c1c3c1e7db50c50164790a26dcd65ee63b58650c061c554337158e33e3b92817aa96fb693415020569238eec4f7a22b096938b6e79aee0f863d3c9b82d80b732379a7b6347f4374b0d223abcf075f87094d0070b4d082368015ceb4b6a64691fc0dab8987229f751799cf9172d3812d68aa78af377ccc8c6122cc07344a4de8a95989081f3e35a8d02a07d10a3e78ccb93b2bec61284f14c0797c28f5a159b834a5d078cb9bd1225db7a82a9899888c730cebbc1c0eb166ce7c07e5b7b9991c7d517a44a046add87a99fdb140fcab969d9c06c89c3f0ac99117bcd7f762e4fa38b76a460ec906dbc620d7da96eebd522b6786fcd225121a022845bc94b1a1b315ba93977a61519153e0134c636058681a7a992633f3b3942fcba1a0b17270bbfcd8b4efb430b94679eb7cb19cb726f2ba3ca8cbbb18ca016198ace238498a62a3692d6c73f7babbff7c07df4b267ba5a8d71042f58c816f52e54399709d3509e8a57d8270a687321b79b7bc62724ad68b707415d491cb3c191a8c3c65590d77645b7374e84585a7b9dd4433ec860694c73c457b7891df2aaf7097da19aab6c089f9db16c6a151469c11ce4f15a9ad972c8e85bf1b0aa2b96b62ce70fa046c6be1868a0a29ce9fc0899a94fe80744bd0ccd9fba1411b2627589bb38ea5277a697b1f10778c209b32a4416f4508a833458263180e2ceada24ebfc71c4f95b21a80aaea3c1551d4204560cf3385847d283831c11514a669f1362d7ea859f5c12e78628e1d519bc2780ae84b312408a951b1aaf75896710a2623f086f6e921bd013418199af8a48358e99bbcf70d6834be1ac08db3aa59e406b7e6223e409ab2f2e406ccd9aaf5db129323077aea4feaf68639185316383bd721470fa776ce34cc8b0267f7990d9f770ebcfa04d39b9ae6ea26176011eba32ce1126841907a113538e7674ec89ba4b63c5c3d881936c769bf9b95450626c482768be6269b0133fdcbaaf9207cfab0509d48b0b7f9394788cde34c13b1e1700bb302323c90656ac4bc28b210582de3b894e3522b0e3a66eeb1ada5f69ca43646e47819f4593102c6a6fc8591c8c355e7d4710e57a3828b17e124a54a21165d111d0e7890b65064f9b578abb744928704f5dba6c7145548788988d37694314cf1d75b559b2272a1b063f5afd749b184a20db79a1624cc33949384d315bf3b4b21f29a8ce9227251c11177c965674a1c7d880218422521990270008e3ddb7618724fb0591a61d462931a5a8bcbbaad06b9f0518e82b88ca85c34f8a077e5513c3483476d265975a8ea269c020e1d82607d2b8dff8ea43eb0528e9670ab215163a720441dd4062a06a8241b43e2767d6253d176318cc95d82fa010d464e6df138001d002036884be9dd55cdb0ddb35e4b008307fc3a639102df5ca213686ea9d4","tls_ja3":["fb0c9cea0478d6132076f4cdcb0d5224"],"http_akin":["b11cun050_00040017_38043d51","b11cuq070_00050817_44096d2b"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i1711h1_ab0a1bf427ad_882d495ac381":32,"b11cun050_00040017_38043d51":50,"b11cuq070_00050817_44096d2b":8},"akin_families":{"b11cun050_00040017_38043d51":{"head":"b11cun050_00040017_38043d51","shapes":2,"ips":50}},"user_agents":["Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"],"timeline":[{"date":"2026-10-04","count":7}],"recent_events":[{"timestamp":"2026-10-04T13:44:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"0x%5B%5D=androxgh0st","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a30782535422535443d616e64726f786768307374","method":"POST","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"9882a1cd-4009-40dd-80cd-ebc7d69f3cae","seq":1,"duration_ms":100,"bytes_in":388,"bytes_out":78},{"timestamp":"2026-10-04T13:44:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"c1baf77c-c5e3-4da3-8c67-50766f6f1f5b","seq":1,"duration_ms":100,"bytes_in":307,"bytes_out":78},{"timestamp":"2026-10-04T13:44:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"e939f026-f9cd-4a30-9541-208fdc7229cf","seq":1,"duration_ms":100,"bytes_in":302,"bytes_out":78},{"timestamp":"2026-10-04T13:44:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpinfo.php","summary":"","payload_hex":"474554202f706870696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"c7349418-c16a-42b6-b0db-c4bd47c507fd","seq":1,"duration_ms":100,"bytes_in":309,"bytes_out":78},{"timestamp":"2026-10-04T13:44:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"f30edfc3-e93f-4fb1-b437-284f9c38b87f","seq":1,"duration_ms":100,"bytes_in":308,"bytes_out":78},{"timestamp":"2026-10-04T13:44:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-config.php","summary":"","payload_hex":"474554202f77702d636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"9da2f595-5e6d-41f9-bc25-e1117578c875","seq":1,"duration_ms":100,"bytes_in":311,"bytes_out":78},{"timestamp":"2026-10-04T13:44:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\"}","body":"0x%5B%5D=androxgh0st","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d6167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420342e342e323b20656e2d55533b20484d204e4f5445203157204275696c642f4b4f5434394829204170706c655765624b69742f3533342e333020284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e3020554342726f777365722f31312e302e352e3835302055332f302e382e30204d6f62696c65205361666172692f3533342e33300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a30782535422535443d616e64726f786768307374","method":"POST","user_agent":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","ja3":"","session":"b83732f2-9ca7-44e8-861f-e60c69f9e946","seq":1,"duration_ms":100,"bytes_in":388,"bytes_out":78}],"http_methods":[{"method":"GET","count":5},{"method":"POST","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/.env","count":1,"ports":1},{"path":"/phpinfo.php","count":1,"ports":1},{"path":"/.env.local","count":1,"ports":1},{"path":"/wp-config.php","count":1,"ports":1},{"path":"/.git/HEAD","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, zstd","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[]}