{"ip":"69.12.166.128","total_events":29,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"10 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["10 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 166,340 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"166,340 bytes sent","bytes_sent":166340,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-22T19:32:42","last_seen":"2026-09-23T14:17:48","events_24h":29,"events_7d":29,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.1027,"lon":-118.2231,"asn":7065,"org":"Sonic.net, LLC"},"source_domain":"69-12-166-128.fiber.dynamic.sonic.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7065","label":"Sonic.net, Inc.","category":"isp","url":"https://www.peeringdb.com/asn/7065"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":26},{"port":2222,"proto":"tcp","label":"SSH-alt","count":3}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cuq070_0000066b_792cca9e"]},"fingerprint_peers":{"19532158b559096b89b1a5f7d17175b2":172,"a11cuq070_0000066b_792cca9e":3},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-22","count":3},{"date":"2026-09-23","count":26}],"recent_events":[{"timestamp":"2026-09-23T14:17:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":13,"duration_ms":6090,"bytes_in":9738,"bytes_out":1014},{"timestamp":"2026-09-23T14:17:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":13,"duration_ms":6090,"bytes_in":9738,"bytes_out":1014},{"timestamp":"2026-09-23T14:17:47","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":11,"duration_ms":5085,"bytes_in":9202,"bytes_out":858},{"timestamp":"2026-09-23T14:17:47","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":12,"duration_ms":5552,"bytes_in":9464,"bytes_out":936},{"timestamp":"2026-09-23T14:17:47","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":11,"duration_ms":5085,"bytes_in":9202,"bytes_out":858},{"timestamp":"2026-09-23T14:17:47","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":12,"duration_ms":5552,"bytes_in":9464,"bytes_out":936},{"timestamp":"2026-09-23T14:17:46","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":9,"duration_ms":4050,"bytes_in":8688,"bytes_out":702},{"timestamp":"2026-09-23T14:17:46","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":10,"duration_ms":4613,"bytes_in":8947,"bytes_out":780},{"timestamp":"2026-09-23T14:17:46","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":9,"duration_ms":4050,"bytes_in":8688,"bytes_out":702},{"timestamp":"2026-09-23T14:17:46","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"3a38300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"","session":"02cf16c7-b0e5-4f0c-ad9e-491927a07264","seq":10,"duration_ms":4613,"bytes_in":8947,"bytes_out":780}],"http_methods":[{"method":"POST","count":14},{"method":"GET","count":12}],"distinct_ports_total":2,"top_paths":[{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":2,"ports":1},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":1},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","count":2,"ports":1},{"path":"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","count":2,"ports":1},{"path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","count":2,"ports":1},{"path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/vendor/phpunit/src/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":2,"ports":1},{"path":"/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","count":2,"ports":1},{"path":"/vendor/phpunit/Util/PHP/eval-stdin.php","count":2,"ports":1},{"path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","count":2,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":3}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":":80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/phpunit/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-23T17:43:14.612123+00:00"}