{"ip":"218.244.143.162","data_as_of":"2026-10-26T22:48:34+00:00","observed":true,"total_events":4,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"CDN","why":["1 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","The first-packet sensors recorded 4 event(s) from this address as well.","Not in any known-scanner range.","Sent 11,519 bytes, which is sustained payload delivery.","Held a session open for 91s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"11,519 bytes sent, longest session 91s","bytes_sent":11519,"session_seconds":91,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-10T16:31:56","last_seen":"2026-10-25T22:59:11","events_24h":1,"events_7d":2,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"CN","country_name":"China","region":"Zhejiang","city":"Hangzhou","lat":30.2943,"lon":120.1663,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-17T16:31:33","last_seen":"2026-10-17T16:31:33","verdicts":[{"verdict":"exploit-attempt","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","name":"phpunit-eval-stdin","size":33,"mime_type":"text/x-php","kind":"payload","times":3,"first_seen":"2026-10-17T16:30:27","last_seen":"2026-10-17T16:31:00","virustotal":{"sha256":"39fb1ae987e5b03e4e0c6e98fdb53f1257735acf23808833c7017830731ddde0","status":"known","malicious":0,"total":74,"name":"lzddx06o.exe"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1}]},"top_ports":[{"port":2375,"proto":"tcp","label":"Docker","count":3,"sessions":0},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":153,"b11cun050_00040035_dd905059":273},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-15","count":1,"sessions":0},{"date":"2026-10-17","count":0,"sessions":1},{"date":"2026-10-24","count":1,"sessions":0},{"date":"2026-10-25","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-25T22:59:11","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"2991d4b6-c622-47f1-951d-0f25f8b822f5","seq":1,"duration_ms":100,"bytes_in":154,"bytes_out":80},{"timestamp":"2026-10-24T00:26:56","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"9d141bd2-9d62-49e6-8722-3c5683a25f84","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":80},{"timestamp":"2026-10-17T16:31:03","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6c69622f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-35","seq":35,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:31:03","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/phpunit/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f706870756e69742f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-33","seq":33,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:31:02","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-31","seq":31,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:31:02","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/phpunit/phpunit/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f706870756e69742f706870756e69742f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-29","seq":29,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:31:02","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-27","seq":27,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:31:00","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-25","seq":25,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:30:52","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f4c4943454e53452f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T16:30:52","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"1fe3619c-7601-48ab-997c-f92cb7dadbdd-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":14},{"method":"POST","count":7}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":4,"ports":1},{"path":"/containers/json","count":3,"ports":1},{"path":"/index.php","count":1,"ports":1},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":16,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"}]}