{"ip":"87.106.118.51","total_events":350,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"128 exploit-path hits","confidence":"high","network_type":"nsp","why":["128 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 98,898 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"98,898 bytes sent","bytes_sent":98898,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T11:10:46","last_seen":"2026-09-03T12:01:21","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":8560,"org":"IONOS SE"},"source_domain":"ip87-106-118-51.pbiaas.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as8560","label":"IONOS SE","category":"isp","url":"https://www.peeringdb.com/asn/8560"},"cve_matches":[{"cve_id":"CVE-2018-7600","title":"Drupal - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/user/register"},{"cve_id":"CVE-2021-3129","title":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/_ignition/execute-solution"}],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":50},{"port":80,"proto":"tcp","label":"HTTP","count":50},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":50},{"port":3000,"proto":"tcp","label":"Web-alt","count":50},{"port":443,"proto":"tcp","label":"HTTPS","count":50},{"port":8090,"proto":"tcp","label":"","count":50},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":50}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"ja4h":["ge11nn0400_8fd06a127c33","ge11nn0600_99a8bce9aba9","po11nn0600_e2685917a2e8","po11nn0700_c042c098b859"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":1158,"ge11nn0400_8fd06a127c33":61,"ge11nn0600_99a8bce9aba9":1,"po11nn0600_e2685917a2e8":9,"po11nn0700_c042c098b859":8},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-03","count":350}],"recent_events":[{"timestamp":"2026-09-03T12:01:21","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"ff3a0f41-fdac-43b8-a057-d0ee674eb3d1","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T12:01:21","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"97b2e0de-9e12-4c67-8e11-300628e9f04d","seq":1,"duration_ms":101,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T12:01:21","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"53823d95-1c6e-45dc-b059-0f28200c9eb8","seq":1,"duration_ms":105,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T12:01:20","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8c3bcf21-d50d-4e87-8c3e-68f01b9bdf62","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T12:01:20","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"fe4f84a9-e5e2-4dcb-94a4-1741da68e345","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-09-03T12:01:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"81103fea-bf8b-4ac0-8ef1-73d656fbeb33","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-09-03T12:01:19","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"40eb8848-256f-4844-a4b9-50f2411ca0ef","seq":1,"duration_ms":101,"bytes_in":121,"bytes_out":78},{"timestamp":"2026-09-03T12:01:19","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d676529a-e434-4d96-acc2-7efa76d73fb7","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-09-03T12:01:18","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9215901d-9588-475a-87b8-4a5b038adedb","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-09-03T12:01:18","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"a24ad3a5-534a-4df2-a3bf-b7f85c00fbdd","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78}],"http_methods":[{"method":"GET","count":222},{"method":"POST","count":128}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":56,"ports":7},{"path":"/index.php","count":42,"ports":7},{"path":"/public/index.php","count":28,"ports":7},{"path":"/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax","count":14,"ports":7},{"path":"/user/password","count":14,"ports":7},{"path":"/?q=user/password","count":14,"ports":7},{"path":"/_ignition/execute-solution","count":14,"ports":7},{"path":"/?lang=../../../../../../../../tmp/tp_tp47945_bb8aabc58a.php","count":2,"ports":1},{"path":"/index.php?lang=../../../../../../../../tmp/tp_tp47945_8a0a73995d.php","count":2,"ports":1},{"path":"/?lang=../../../../../../../../tmp/tp_tp47945_5b6a39d84d.php","count":2,"ports":1},{"path":"/?lang=../../../../../../../../tmp/tp_tp47945_bd48056acd.php","count":2,"ports":1},{"path":"/index.php?lang=../../../../../../../../tmp/tp_tp47945_5d6a842a6d.php","count":2,"ports":1},{"path":"/index.php?lang=../../../../../../../../tmp/tp_tp47945_9379878af9.php","count":2,"ports":1},{"path":"/?lang=../../../../../../../../tmp/tp_tp47945_350de67ce0.php","count":2,"ports":1},{"path":"/public/index.php?lang=../../../../../../../../tmp/tp_tp47945_5d6a842a6d.php","count":2,"ports":1}],"distinct_paths_total":133,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2018-7600","tag_type":"cve","title":"Drupal - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/user/register","reference_urls":["https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600","https://nvd.nist.gov/vuln/detail/CVE-2018-7600","https://www.drupal.org/sa-core-2018-002","https://groups.drupal.org/security/faq-2018-002","http://www.securitytracker.com/id/1040598"]},{"tag_id":"CVE-2021-3129","tag_type":"cve","title":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/_ignition/execute-solution","reference_urls":["https://www.ambionics.io/blog/laravel-debug-rce","https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129","https://nvd.nist.gov/vuln/detail/CVE-2021-3129","https://github.com/facade/ignition/pull/334","https://github.com/d4n-sec/d4n-sec.github.io"]}],"data_as_of":"2026-09-11T06:10:45.383246+00:00"}