{"ip":"213.177.179.12","total_events":22,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"high","network_type":null,"why":["2 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 5,293 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,293 bytes sent","bytes_sent":5293,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-27T17:44:11","last_seen":"2026-09-24T10:47:02","events_24h":0,"events_7d":8,"geo":{"country_code":"IR","country_name":"Iran","region":"","city":"","lat":35.698,"lon":51.4115,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":8545,"proto":"tcp","label":"","count":3},{"port":8546,"proto":"tcp","label":"","count":3},{"port":8548,"proto":"tcp","label":"","count":2},{"port":8547,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_8d633dac7124"],"tls_client_hello":"","tls_ja3":["db687c576d7ee0017b289fc05e0f8574"],"http_akin":["a11cun060_e000004a_ffe60107"]},"fingerprint_peers":{"t13i4311h1_c7886603b240_8d633dac7124":6,"a11cun060_e000004a_ffe60107":24},"akin_families":{"a11cun060_e000004a_ffe60107":{"head":"a11cun060_e000004a_ffe60107","shapes":2,"ips":25}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30","python-requests/2.26.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"],"timeline":[{"date":"2026-07-27","count":2},{"date":"2026-07-28","count":4},{"date":"2026-07-29","count":5},{"date":"2026-08-25","count":1},{"date":"2026-09-17","count":2},{"date":"2026-09-24","count":8}],"recent_events":[{"timestamp":"2026-09-24T10:47:02","port":8546,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8546\",\"sec-websocket-key\":\"lPI7bH0JGRvDoChdUC723A==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206c5049376248304a475276446f4368645543373233413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a21abf06-681b-4c41-9e47-446a228c9aac","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T10:47:02","port":8548,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8548\",\"sec-websocket-key\":\"kc0R+PXXMfKPND3WJVp4yg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534380d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206b6330522b5058584d664b504e4433574a56703479673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"4f4f52bd-8de5-44a3-a919-058a9724bc7b","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T10:47:02","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8545\",\"sec-websocket-key\":\"0EH349BjZGone5VqDthnLQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20304548333439426a5a476f6e653556714474686e4c513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"229c2e61-341f-47c4-882a-f746689a4676","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T10:47:02","port":8547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8547\",\"sec-websocket-key\":\"41Ubd16cljTdBY32ymZbnA==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2034315562643136636c6a546442593332796d5a626e413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e5f813e5-ede3-46da-b6a4-2152c94db7ad","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-24T00:28:21","port":8548,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8548\",\"sec-websocket-key\":\"ra4O+CDAWSjCQNRBAoaXlw==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534380d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a207261344f2b43444157536a43514e5242416f61586c773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"103b58b1-bc68-44b0-8045-b04f72e68ef2","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-24T00:28:21","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8545\",\"sec-websocket-key\":\"+amdkN3wQgesMOUTuiW6ZQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a202b616d646b4e3377516765734d4f5554756957365a513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"f25b02e9-9f6c-46df-9fa7-7ff50c1a61aa","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-24T00:28:21","port":8547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8547\",\"sec-websocket-key\":\"A7OuYUltLFEr4Wnln6g23A==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2041374f7559556c744c46457234576e6c6e36673233413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a5cf70a5-16e6-4767-8566-b652756b0c77","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-24T00:28:20","port":8546,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8546\",\"sec-websocket-key\":\"XxKGXhi2PfXvxdP23ey3yg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2058784b475868693250665876786450323365793379673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"0966ed2c-10c0-4f14-82c8-e3cb32e8a730","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79},{"timestamp":"2026-09-17T10:00:19","port":8546,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8546\",\"sec-websocket-key\":\"qtgmQKXSp/FFBRKd46Tg6w==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a207174676d514b5853702f464642524b643436546736773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"645e95fb-3437-4de5-a8cc-7fabb52ba65e","seq":1,"duration_ms":101,"bytes_in":189,"bytes_out":79},{"timestamp":"2026-09-17T10:00:19","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8545\",\"sec-websocket-key\":\"DWUJRegYj8Q97sxI3dym4w==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204457554a526567596a385139377378493364796d34773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"4c9e18cf-d1f5-4398-bc8b-a14e5a703ad9","seq":1,"duration_ms":101,"bytes_in":189,"bytes_out":79}],"http_methods":[{"method":"GET","count":17},{"method":"POST","count":5}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":16,"ports":6},{"path":"/.env","count":5,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:8546","notable":false},{"name":"Sec-Websocket-Key","value":"lPI7bH0JGRvDoChdUC723A==","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]}],"data_as_of":"2026-09-28T20:50:51.413092+00:00"}