{"ip":"87.58.199.133","data_as_of":"2026-10-21T15:04:59+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive login(s) succeeded","confidence":"high","network_type":"CDN","why":["2 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 41,657 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"41,657 bytes sent","bytes_sent":41657,"session_seconds":41,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-20T02:13:34","last_seen":"2026-10-20T02:14:59","events_24h":0,"events_7d":0,"interactive_sessions":51,"interactive_sessions_24h":0,"interactive_sessions_7d":51,"interactive_protocols":[{"protocol":"smtp","sessions":31},{"protocol":"http","sessions":15},{"protocol":"ftp","sessions":1},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":18450,"org":"WebNX, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as18450","label":"WebNX","category":"cdn","url":"https://www.peeringdb.com/asn/18450"},"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"cve_id":"CVE-2015-1579","title":"WordPress Slider Revolution - Local File Disclosure","severity":"medium","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":1,"kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":51,"first_seen":"2026-10-20T02:13:34","last_seen":"2026-10-20T02:14:59","verdicts":[{"verdict":"scan","sessions":37},{"verdict":"unknown","sessions":6},{"verdict":"exploit-attempt","sessions":6},{"verdict":"credential","sessions":2}],"personas":[{"persona":"smtp@3.4.13","sessions":31},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":12},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":3},{"persona":"ftp@3.0.3","sessions":1},{"persona":"linux-ubuntu@20.04","sessions":1}],"services":[{"protocol":"smtp","port":587,"sessions":31},{"protocol":"http","port":443,"sessions":12},{"protocol":"http","port":80,"sessions":3},{"protocol":"tcp","port":2083,"sessions":2},{"protocol":"tcp","port":45428,"sessions":1},{"protocol":"ssh","port":22,"sessions":1},{"protocol":"ftp","port":21,"sessions":1}],"logins":[{"username":"shopfront","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ftp-login","outcome":"success","tries":1,"last_seen":"2026-10-20T02:14:19"},{"username":"shopfront","password":"Sh0pfr0nt!2024","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-20T02:14:19"}],"commands":[],"downloads":[],"files":[{"sha256":"6a869441da022c380f88e267b8723f7a69ab58a5c99b9439b5825411a590e177","name":"listing","size":266,"mime_type":"text/plain","kind":"ftp-listing","times":1,"first_seen":"2026-10-20T02:14:20","last_seen":"2026-10-20T02:14:20","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":42},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":6},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":31},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":12},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":3},{"port":2083,"proto":"tcp","label":"","count":0,"sessions":2},{"port":21,"proto":"tcp","label":"FTP","count":0,"sessions":1},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1},{"port":45428,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["7b632b131f66843b3829f2835f521e15"],"tls_ja4":["t13i220900_231e334592e8_29829a46703f","t13i221000_231e334592e8_533b6d20482b"],"tls_client_hello":"","tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0","85182f532cc3ec9202ca90e103c60767"],"http_akin":[],"interactive":{"ssh_hassh":["7b632b131f66843b3829f2835f521e15"],"tls_ja4":["t13i220900_231e334592e8_29829a46703f","t13i221000_231e334592e8_533b6d20482b"],"tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0","85182f532cc3ec9202ca90e103c60767"]}},"fingerprint_peers":{"t13i221000_231e334592e8_533b6d20482b":1,"t13i220900_231e334592e8_29829a46703f":10,"7b632b131f66843b3829f2835f521e15":0},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0","Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36"],"timeline":[{"date":"2026-10-20","count":0,"sessions":51}],"recent_events":[{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f6b6579776f72643d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031312e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133302e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","ja3":"85182f532cc3ec9202ca90e103c60767","session":"bcf9d62d-40ce-43f0-a3c7-6f645444a26e-107","seq":107,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f7265663d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e3336204564672f3133312e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"312087b3-f401-412f-ba24-07605542e1aa-103","seq":103,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f6e6578743d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"85182f532cc3ec9202ca90e103c60767","session":"2a787eb1-d0ba-45c0-9c44-3e1eb2db5c70-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f75726c3d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"85182f532cc3ec9202ca90e103c60767","session":"c457e990-f024-4d2d-b63b-d0ac47fd60dd-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f72656469726563743d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e3336204564672f3133312e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"bcf9d62d-40ce-43f0-a3c7-6f645444a26e-105","seq":105,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/search.php","summary":"","payload_hex":"474554202f7365617263682e7068703f713d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e3336204564672f3132392e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"f3c96410-221a-47b7-9857-04455642b031-109","seq":109,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e7068703f713d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533457465737420485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e3336204564672f3133312e302e302e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"312087b3-f401-412f-ba24-07605542e1aa-101","seq":101,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f6361743d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533453120485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a3133332e3029204765636b6f2f32303130303130312046697265666f782f3133332e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"2a787eb1-d0ba-45c0-9c44-3e1eb2db5c70-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f706167653d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533453120485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031385f31206c696b65204d6163204f53205829204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e31204d6f62696c652f313545313438205361666172692f3630342e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1","ja3":"85182f532cc3ec9202ca90e103c60767","session":"c457e990-f024-4d2d-b63b-d0ac47fd60dd-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-20T02:14:29","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f3f69643d253232253232253345253343683125334557424d2d5853532d50524f42452533432f68312533453120485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133332e3029204765636b6f2f32303130303130312046697265666f782f3133332e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"1ab70bb6-2417-494a-b8e8-8efbc0c4c1fa-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":340},{"method":"POST","count":3}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":17,"ports":1},{"path":"/wp-admin/admin-ajax.php","count":3,"ports":1},{"path":"/index.php","count":3,"ports":1},{"path":"/.env","count":3,"ports":1},{"path":"/.git/HEAD","count":3,"ports":1},{"path":"/config.json","count":2,"ports":1},{"path":"/debug.php","count":2,"ports":1},{"path":"/.git/logs/refs/remotes/origin/master","count":2,"ports":1},{"path":"/.git/logs/refs/remotes/origin/HEAD","count":2,"ports":1},{"path":"/.git/logs/refs/heads/production","count":2,"ports":1},{"path":"/var/www/.aws/credentials","count":2,"ports":1},{"path":"/.git/refs/remotes/origin/master","count":2,"ports":1},{"path":"/root/.aws/config","count":2,"ports":1},{"path":"/.git/refs/heads/main","count":2,"ports":1},{"path":"/.aws/credentials","count":2,"ports":1}],"distinct_paths_total":199,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host","User-Agent"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":"2022-02-15"},{"tag_id":"CVE-2015-1579","tag_type":"cve","title":"WordPress Slider Revolution - Local File Disclosure","severity":"medium","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html","https://cxsecurity.com/issue/WLB-2021090129","https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80","https://nvd.nist.gov/vuln/detail/CVE-2015-1579","https://wpvulndb.com/vulnerabilities/7540"],"confirmed_by":"interactive_session","sessions":1,"kev_date_added":null},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}