{"ip":"151.247.22.164","data_as_of":"2026-10-26T20:46:02+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"10 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["10 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 73,819 bytes, which is sustained payload delivery.","Held a session open for 13502s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"73,819 bytes sent, longest session 13502s","bytes_sent":73819,"session_seconds":13502,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-15T22:37:29","last_seen":"2026-10-20T02:59:00","events_24h":0,"events_7d":0,"interactive_sessions":552,"interactive_sessions_24h":0,"interactive_sessions_7d":255,"interactive_protocols":[{"protocol":"http","sessions":524},{"protocol":"smtp","sessions":10},{"protocol":"ssh","sessions":10}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":399486,"org":"12651980 CANADA INC."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as399486","label":"Virtuo.Host (AS399486)","category":"cdn","url":"https://www.peeringdb.com/asn/399486"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":10,"kev_date_added":"2022-02-15"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":552,"first_seen":"2026-10-15T22:37:29","last_seen":"2026-10-20T02:59:00","verdicts":[{"verdict":"unknown","sessions":365},{"verdict":"scan","sessions":158},{"verdict":"exploit-attempt","sessions":19},{"verdict":"post-exploitation","sessions":10}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":357},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":146},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":15},{"persona":"smtp@3.4.13","sessions":8},{"persona":"linux-ubuntu@20.04","sessions":8},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":4},{"persona":"smtp@3.8.6","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":2},{"persona":"linux-ubuntu@24.04","sessions":2}],"services":[{"protocol":"http","port":80,"sessions":503},{"protocol":"http","port":443,"sessions":19},{"protocol":"smtp","port":587,"sessions":10},{"protocol":"ssh","port":22,"sessions":10},{"protocol":"tcp","port":2083,"sessions":8},{"protocol":"http","port":2083,"sessions":2}],"logins":[{"username":"shopfront","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":8,"last_seen":"2026-10-20T00:10:41"},{"username":"portal","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-20T00:40:05"}],"commands":[{"ts":"2026-10-20T00:40:06","session_id":"1978695f-9372-47b9-b0c3-9fafbd8f84a3","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T00:39:51","session_id":"9f904e8a-7e98-4c73-bfa1-ea49735bb210","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T00:10:41","session_id":"0b365da3-ed7d-464f-a640-74e66b20e5e2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-20T00:10:33","session_id":"e0267980-75f8-42b2-acc1-6be87d19c7e0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T07:32:29","session_id":"f814776a-9600-401d-8137-53f44fd8fadc","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T07:31:04","session_id":"83d1444b-7c66-4c32-a272-3400ccaacc68","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T06:01:43","session_id":"0a1c6f0e-ccb9-42b8-966d-cd4ad68c967e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T06:01:21","session_id":"28814a73-a1fb-4d5b-bf27-7cdd3fd1522e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T04:17:45","session_id":"c30d4c69-b400-47ba-96d3-de943a9380b0","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-16T04:17:41","session_id":"0194291a-bbec-4b3a-ad54-5543964ceadb","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0}],"downloads":[],"files":[{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","name":"phpunit-eval-stdin","size":706,"mime_type":"text/x-php","kind":"payload","times":10,"first_seen":"2026-10-16T04:17:17","last_seen":"2026-10-20T00:40:04","virustotal":{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","status":"known","malicious":5,"total":78,"name":"3CA33F26_174e551e40cc81a506a24f4b701df49a"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":168},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":19},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":10},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":10},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":10}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":503},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":19},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":10},{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":10},{"port":2083,"proto":"tcp","label":"HTTP","count":0,"sessions":10}],"fingerprints":{"ssh_hassh":["6372ee6957562199b2fb773b0be1bf34"],"tls_ja4":["t13i1811h1_85036bcba153_b26ce05bbdd6","t13i4311h1_c7886603b240_8d633dac7124"],"tls_client_hello":"","tls_ja3":["4b510481e2e54d5956f56d2177fb122d","db687c576d7ee0017b289fc05e0f8574"],"http_akin":[],"interactive":{"ssh_hassh":["6372ee6957562199b2fb773b0be1bf34"],"tls_ja4":["t13i1811h1_85036bcba153_b26ce05bbdd6","t13i4311h1_c7886603b240_8d633dac7124"],"tls_ja3":["4b510481e2e54d5956f56d2177fb122d","db687c576d7ee0017b289fc05e0f8574"]}},"fingerprint_peers":{"6372ee6957562199b2fb773b0be1bf34":5,"t13i4311h1_c7886603b240_8d633dac7124":7,"t13i1811h1_85036bcba153_b26ce05bbdd6":67},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","python-requests/2.34.2","python-requests/2.32.5"],"timeline":[{"date":"2026-10-15","count":0,"sessions":10},{"date":"2026-10-16","count":0,"sessions":287},{"date":"2026-10-19","count":0,"sessions":2},{"date":"2026-10-20","count":0,"sessions":253}],"recent_events":[{"timestamp":"2026-10-20T02:59:00","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"2ef5539f-9030-424c-9300-85bfb55c1b5a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:58:59","port":80,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"278cd77d-05ef-4f9e-85ac-16e9abf74e50-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:58:59","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"5e3d6dc2-3943-4d1c-832b-5f8b360e7288-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:58:59","port":80,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"6a2877f0-d14e-4c3d-a6f6-85610c8b17b7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:57:34","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"b6171247-6717-4c44-8d79-704a3a728a3b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:57:34","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"843ad4e1-1b2a-4915-af5c-0bab9f4a037e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T00:40:06","port":2083,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2083\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"user=portal&pass=Sh0pfr0nt%212024","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/login/","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323038330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a757365723d706f7274616c26706173733d536830706672306e7425323132303234","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"85ff2578-befa-4957-879b-03baa4cdd3ad-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T00:40:06","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo 'wakanda';uname -a;","payload_hex":"6563686f202777616b616e6461273b756e616d65202d613b","method":"","user_agent":"","ja3":"","session":"1978695f-9372-47b9-b0c3-9fafbd8f84a3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"250c1334a144d4db","strings":["echo 'wakanda';uname -a;"]},"interactive":true},{"timestamp":"2026-10-20T00:40:04","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"d744836a-8047-4917-b5e4-5592be65049c-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]},"interactive":true},{"timestamp":"2026-10-20T00:40:04","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ehlo ADMINIS-RSLR6VI\r\n","payload_hex":"65686c6f2041444d494e49532d52534c523656490d0a","method":"","user_agent":"","ja3":"","session":"d744836a-8047-4917-b5e4-5592be65049c-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"31c07b4fee1a5001","label":"SMTP","strings":["ehlo ADMINIS-RSLR6VI"]},"interactive":true}],"http_methods":[{"method":"GET","count":183},{"method":"POST","count":76}],"distinct_ports_total":5,"top_paths":[{"path":"/.env","count":27,"ports":2},{"path":"/","count":14,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":10,"ports":1},{"path":"/core/.env","count":6,"ports":1},{"path":"/app/.env","count":6,"ports":1},{"path":"/api/.env","count":6,"ports":1},{"path":"/local/.env","count":6,"ports":1},{"path":"/apps/.env","count":6,"ports":1},{"path":"/.env.dist","count":4,"ports":1},{"path":"/.env.prod","count":4,"ports":1},{"path":"/application/.env","count":4,"ports":1},{"path":"/development/.env","count":4,"ports":1},{"path":"/cms/.env","count":4,"ports":1},{"path":"/shared/.env","count":4,"ports":1},{"path":"/.env.save","count":4,"ports":1}],"distinct_paths_total":72,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:2083","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":10,"kev_date_added":"2022-02-15"},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":10},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":10},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":10}]}