{"ip":"2.26.172.97","total_events":29,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 4,297 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,297 bytes sent","bytes_sent":4297,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-03T07:03:22","last_seen":"2026-09-03T07:05:39","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":215703,"org":"Freakhosting Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215703","label":"FREAKHOSTING","category":"cdn","url":"https://www.peeringdb.com/asn/215703"},"cve_matches":[{"cve_id":"CVE-2021-3129","title":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/_ignition/execute-solution"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":14},{"port":8545,"proto":"tcp","label":"","count":14},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["96c75337fa175ccfce43c22970023f58"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun040_00040013_608dab68","b11cuq060_00050813_95cc9d02"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3800,"b11cun030_00040012_13ee3d34":5063,"b11cun040_00040013_608dab68":4305,"b11cuq060_00050813_95cc9d02":55},"akin_families":{"b11cuq060_00050813_95cc9d02":{"head":"b11cuq060_00050813_95cc9d02","shapes":8,"ips":55}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","Mozilla/5.0"],"timeline":[{"date":"2026-09-03","count":29}],"recent_events":[{"timestamp":"2026-09-03T07:05:39","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger/v1/swagger.json","summary":"","payload_hex":"474554202f737761676765722f76312f737761676765722e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"67c9a2de-0657-490c-8c24-091163bdc38a","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":76},{"timestamp":"2026-09-03T07:05:30","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger/v1/swagger.json","summary":"","payload_hex":"474554202f737761676765722f76312f737761676765722e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"16a7b499-dddb-49bf-a1d9-817f126a068c","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":76},{"timestamp":"2026-09-03T07:05:24","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger.json","summary":"","payload_hex":"474554202f737761676765722e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"2279b85b-c819-4c5a-91e3-db017e1407f1","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":76},{"timestamp":"2026-09-03T07:05:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger.json","summary":"","payload_hex":"474554202f737761676765722e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"283e366d-45ea-436d-ba3a-491d1a7b411d","seq":1,"duration_ms":101,"bytes_in":119,"bytes_out":76},{"timestamp":"2026-09-03T07:05:17","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api-docs","summary":"","payload_hex":"474554202f6170692d646f637320485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"1e9964bc-e3ad-43fe-85b2-0f7e08b73568","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":76},{"timestamp":"2026-09-03T07:05:10","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/api-docs","summary":"","payload_hex":"474554202f76322f6170692d646f637320485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"146bede5-7261-4d85-be5f-a38d90619010","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":76},{"timestamp":"2026-09-03T07:05:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api-docs","summary":"","payload_hex":"474554202f6170692d646f637320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"4ec2cfcd-ce69-4495-ab32-af162ab919da","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":76},{"timestamp":"2026-09-03T07:05:04","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/env","summary":"","payload_hex":"474554202f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"28b8408e-9d49-4893-a367-7cde2f8cf6b5","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":76},{"timestamp":"2026-09-03T07:05:04","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/api-docs","summary":"","payload_hex":"474554202f76322f6170692d646f637320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"66b10db1-6d32-47fc-88f2-deeef6d24847","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":76},{"timestamp":"2026-09-03T07:04:56","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/env","summary":"","payload_hex":"474554202f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"7436e226-31d6-4247-89eb-81427a09dffb","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":76}],"http_methods":[{"method":"GET","count":25},{"method":"POST","count":4}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":5,"ports":3},{"path":"/env","count":2,"ports":2},{"path":"/script","count":2,"ports":2},{"path":"/api-docs","count":2,"ports":2},{"path":"/swagger.json","count":2,"ports":2},{"path":"/v2/api-docs","count":2,"ports":2},{"path":"/actuator/env","count":2,"ports":2},{"path":"/swagger/v1/swagger.json","count":2,"ports":2},{"path":"/_ignition/health-check","count":2,"ports":2},{"path":"/index.php/module/action/param1/$%7B@print%28env%29%7D","count":2,"ports":2},{"path":"/_ignition/execute-solution","count":2,"ports":2},{"path":"/__debug__/execute?cmd=printenv","count":2,"ports":2},{"path":"/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=printenv","count":2,"ports":2}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8545","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2021-3129","tag_type":"cve","title":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/_ignition/execute-solution","reference_urls":["https://www.ambionics.io/blog/laravel-debug-rce","https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129","https://nvd.nist.gov/vuln/detail/CVE-2021-3129","https://github.com/facade/ignition/pull/334","https://github.com/d4n-sec/d4n-sec.github.io"]}],"data_as_of":"2026-09-30T17:06:09.455332+00:00"}